* it's hard/impossible to prove - given how many factors go into ad targeting there isn't a conclusive way to prove whether an ad was targeted because of illicitly-collected data.
* as you see here even blatant GDPR breaches and acting in bad faith doesn't actually land you in trouble, so although it's "illegal", the law isn't enforced. Experian (or Equifax) got caught by the ICO knowingly misusing people's credit data for marketing purposes and all they got was a warning, so clearly the message is that "breaching the GDPR does pay".
* it's hard/impossible to prove - given how many factors go into ad targeting there isn't a conclusive way to prove whether an ad was targeted because of illicitly-collected data.
* as you see here even blatant GDPR breaches and acting in bad faith doesn't actually land you in trouble, so although it's "illegal", the law isn't enforced. Experian (or Equifax) got caught by the ICO knowingly misusing people's credit data for marketing purposes and all they got was a warning, so clearly the message is that "breaching the GDPR does pay".