Have my upvote. I have just learned that targeted ads might be considered direct marketing. I always thought it was limited to things that had my name and address (physical, email or other) on it, excluding online ads unless they were part of a "logged in experience" like upsells inside the product I am currently using.

That said, I read the rest of the recital and I think it is rather clear to the degree that such things can be clear that if you didn't expect it, it isn't legal. Here are some quotes:

- "[...]provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller."

- "At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place."

I can assure you the even after reading this, if I have clicked "necessary only" (as this discussion started with) it is not my reasonable expectation that any data are stored except those that are strictly necessary for the navigation and the user visible features[1] of the site works.

I'll admit that it seems some people think there is an argument that can me made that online ads can be direct marketing, but I would not risk any of my savings to defend that claim in court and I don't think Facebook or Google want to help you either as they seem to trying their best to prevent people from targeting individuals or at least pretending they do. And if it does, it is still covered by the conditions above.

[1]: and yes, that means user features, so unless you are creating an online ad-collection of some kind, that probably does not mean ads