According to Rec. 47 (7) GDPR direct marketing "may" be a legitimate interest:
“The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”
Advertising purposes are otherwise only addressed in the GDPR in the following regulations:
Article: 21 II/III (right to object).
Recitals: 38 (2) (use of children's data for advertising purposes), 58 (3) (transparency in advertising on the internet), 70 (right to object).