Then you get into the quagmire of what is personal data, right? As in, how many clicks on external ads are considered personal data? IIRC the definition of personal data under GDPR is "any data or collection of data that when combined with any other data can uniquely identify you" (or at least that is what my company is operating under). So that means a lot more that what we traditionally see as "personal data".
I’m not sure I follow? By clicking on an advert you’re moving to a 3rd party with their own potential collection and collation of personal data, and their own opt-in requirements. It would be down to the advertiser at that point to receive consent from the user.
In this case the advertisers don’t get a choice. Under GDPR data subjects have to opt in to personal data collection and processing by third parties, and they can’t be denied access to the service for failing to opt in. The advertisers are going to have to get used to a new reality of mostly targeting page context.