GDPR requires consent for the processing of the personal data. Displaying an ad per se is not regulated by GDPR, and does not require consent. Though personalization of this advertisement requires processing of the PII, and thus it is supposed to be regulated.

Facebook UI is full of dark patterns, but it is possible to withdraw consent through settings: www.facebook.com/ads/preferences/