The GDPR makes it pretty clear that you need a legal basis for processing personal data. And serving personalised ads, with the purpose of increasing revenue, is not a legitimate interest. Moreover, consent is not only required for such use-cases, but rejection should not degrade the service for the user.
The writing has been on the wall since 2018, when the GDPR came into effect. What's new is its enforcement. The DPAs are slow, but the law is clear, and eventually everyone will be forced to comply, if they want to do business within the EU.