As I understand it, it is the position of several DPAs that denial of access entirely (i.e. "consent or pay") could contravene the "freely given" requirement of GDPR in most cases, though this has thus far not been tested in court.

(see e.g. https://iapp.org/news/a/cjeu-clarifies-cookie-consent-requir... https://www.edpb.europa.eu/news/edpb-consent-or-pay-models-s... )

> but companies could start offering content in return for those things instead of ads.

Again, that is not a requirement. If your argument is that they give us content for free because of ads, ads don't require pervasive and invasive tracking. Or hiding stuff behind paywalls (since ads pay for it).