*without consent
It's perfectly acceptable under GDPR to do targeted advertising, as long as you have a user consent to it.