"Are the 4% fines levied on both Google AND the advertisers"
GDPR is about data "controllers" and "processors":
https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controller-processor/what-data-controller-or-data-processor_en
Both can be fined if they don't abide to the rules - but an advertiser may be none of them, as they can never gather, store or process personal data. For example, if Google lets you chose a target (say "single white male nerd between 30 and 40, living in a city > 100,000, income above X, good credit score, Star Wars fan, buys online"), and Google does the targeting, the advertiser never see the actual personal data. so it isn't nor the controller nor the processor - Google is both.
If, as in the CA scandal, data are actually transferred, both can be fined.
However, GDPR is not a law against the advertising industry - it's to protect personal data.
Evidently, the slant the ads industry took in the past years toward targeted behavioral advertisement (plus using "influencers" to hide the ad origin...) is built on data hoarding, and won't work well without it.
Biting the hand that feeds IT
