Good summary, only one point: it is not legal under the GDPR to use data you get from one reason (DDoS protection) for another reason (ad tracking) without also specifying that that is happening and allowing that to stop.
I don't say that isn't happening, but it is not legal, if it is.