> I couldn't really tell what was really being sold routinely, personal info or ad space It’s the same thing. Look, the website deals in mental health informa

> I couldn't really tell what was really being sold routinely, personal info or ad space It’s the same thing. Look, the website deals in mental health information, right? And health information is part of a class of information that’s protected under the GDPR. Under that protection, explicit user consent is required before that info can be shared with anyone. When the website invokes the Google ad APIs, that results in Google learning that this user, who they build an identity around via tracking cookies, is reading a website with information about a health condition. Google isn’t the website the user visited, it’s a third-party the website just informed without explicitly asking for the user’s permission. That violates the GDPR. The website makes money off of informing Google about this. That’s “selling user health information” to an advertiser — Google. Google turns around to its ad bid network and solicits bids to show an ad to google push_id abcdefghihk123, who is visiting a website about mental health. That, again, is a GDPR violation, because disclosing information about a pseudonym ID still counts under the GDPR (and the info can be de-anonymize easily by aggregation networks). That, again, is Google selling personal info to advertisers. What it boils down to is you’re thinking about this is all wrong; the way Google sells ads, there’s no difference between selling personal info and selling ad space because you’re always bidding to show an individual you’re given data about an ad. The bids are based on how much the person’s profile matches the bidder’s interests, and anything new learned about the person that can be gleaned from the current website visit is added to that profile. Advertisers are literally being told “here: this person with id 12345 and these characteristics matching your target profile is currently reading about depression. How much to show them an ad?” The bid request data they’re given in turn is enough to identify the user in any number of data aggregation services — most of which require “share and share alike” participation — so the bidder looks up the bid request data and discovers probable email address, location, income, marital status, interests, etc, and in return tells the aggregation service “this user is currently visiting doihavedepression.com”. Again, GDPR violation. That’s the nature of modern online advertising. You’re never bidding to just show N ads on site Y. There is no such thing, in using Google’s advertising system, as selling an ad space on your site to Google that isn’t also a sale of personal information to Google and by Google to the advertisers bidding to fill that spot. As such there are entire classes of websites that probably should not be showing Google ads.