I've seen it in some Spanish newspapers and those are subject to the regular GDPR.
You get tracked when you subcribe as well. The Guardian is far from perfect, and that bothers me more when I'm paying a subscription.
Fair enough - I don't think the laws have diverged much in this area in the last several years, and while there was always a difference in national legislation and how the actual enforcement bodies would act, there's generally more commonality than difference.
And yes, that sucks. I object very much to the "you subscribe and we still track/advertise" model, just as I object to ads creeping into paid tv streaming services now. And yes, I would expect the guardian to hold itself to a higher standard :/