Agree about the overlap, but want to call to attention OP's requirement that I don't believe is part of GDPR:
> Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user.
This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads.
Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.
This is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL)
Belated thanks for the really useful link! I hadn't looked into these opt-out/review requirements before. But, FWIW, I still think there's an important difference between a user-driven opt-out (which I also don't read as a guarantee of explanation) and proactive publication of the personalization criteria. It's still possible for an uninformed individual to never even realize content is being personalized for them, much less pass the threshold of asking how.
> Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user.
This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads.
Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.