“The alleged switch of legal basis happened exactly on 25 May 2018 at midnight when the GDPR came into force.”
Meta’s answer to the GDPR was to call surveillance ads part of the “service” you contractually owe yourself. The Irish DPC held ten confidential meetings with Meta, blessed the trick, and proposed a fine of 28 to 36 million euros. The rest of Europe overruled it and raised the fine to 390 million. The money goes to Ireland, the regulator that spent four years shielding the company it was paying to regulate.