I didn't mean ads need to be served 1st party. I think GDPR does not prevent Google or anyone from hosting ads for their customers. Maybe it's hard to imagine,

I didn't mean ads need to be served 1st party. I think GDPR does not prevent Google or anyone from hosting ads for their customers. Maybe it's hard to imagine, but it is really simple to host ads without tracking users... Google simply has to NOT DO it. And guarantee that in writing to the publisher. Counting impressions and clicks are no problem, as long as no personal data is collected. But storing personally identifiable data for the click/impression (such as the full ip address, or advertising id in a cookie) needs consent. Unless you need (and only use it) to prevent fraud, which is a valid legitimate interest. Using it for (Re)marketing is not.