Comment by ramboram

I think it's possible with user's consent.

> It is allowed to sell personal data under the GDPR subject to receipt of consent for it from data subject and compliance with the rights of data subject even if it decided to exercise the right to object or the right to be forgotten.

Source: https://legalitgroup.com/en/gdpr-requirements-to-selling-of-...