I'd say "way before GDPR" we had a local maximum with the initial AdWords experience, where those ads were pretty unobtrusive and there was limited .js spam

"They still made money" sure, on top of externalities.

And now they realize, with some help from Apple and Chrome that this business model has a limit