I'm a European software developer, so here's my feedback you didn't ask for:
The ad services in the third-party popup are unrelated to the approval you give on the first black banner. They are checked by default because they are services we've used historically, so that reflects the current state of thing.
To be GDPR compliant data sharing must be opt-in. It doesn't matter what the current state of things is, users must be opted out of data sharing until they themselves have given permission.
They are necessary for us to operate and support our sites with basic ad offerings. Naturally that doesn't apply to GB premium folks who won't see any ad-related tracking.
Providing tailored ads doesn't fall into GDPR acceptable reasons for collecting and sharing data, in fact allowing opting out of ads like these is pretty much one of the main things the regulations are designed to do.
I understand that this seems to be a CBSi developed thing, and the GB team don't have much control over it, but at the moment it's not implemented correctly and isn't compliant.