GDPR may mean less money for websites, report says