GDPR basically says “get consent for what you do with peoples data”. If you can’t do that I would say your business model is it very ethical.

Edit: or have “legitimate interest” - in either case it’s a very low bar for ethical standards so GDPR shouldn’t be an issue