On the other hand, the main source of the money for the industry - major advertisers - are legitimate above-board companies, who either are honest or are liable

On the other hand, the main source of the money for the industry - major advertisers - are legitimate above-board companies, who either are honest or are liable for enforcement. GDPR is not really about selling personal data but about using it; a big part of its effect is on buyers of data since GDPR effectively (there are all kinds of nuances) means that it's not legally possible for legitimate company to simply buy personal data for arbitrary purposes, since the data subject obviously did not opt-in to that particular purpose by that company when the data was collected.