The French personal data regulation authority ruled that the system whereby companies bid to show a particular user an ad at that very moment violates the GDPR, because it shows the bidders that user's personal data without consent.

This relates to the fact that "consent" for data collection is meaningless because it is impossible to express what actions the consent is for.

But even if that problem had a solution, it is so easy for sites to manufacture "consent" that it can't be enough to permit the surveillance.

I will be glad if this decision throws a monkey wrench into the system that motivates collecting so much personal data, and especially if it makes some of that collection not worth doing. But that won't be enough to convince me to hand over any personal data. and won't convince me that it is safe for society to permit this massive surveillance to happen at all, "consent" or no "consent".