Recently issued regulator rulings on Google, ad tech companies and Facebook challenge prevailing online advertising practices of obtaining user consent under the EU’s General Data Protection Regulation (GDPR). Rulings from France on Google and ad tech partners of media owners called them out for inadequate disclosure to users, and excessive merging and processing of data. In a landmark precedent for Germany, the Federal Cartel Office found that Facebook lacked “freely given” consent from users, calling its terms “exploitative” and an abuse of its dominant position, also harming competitors.