The documentation for the GDPR plugin (here: https://gdpr-wp.com/knowledge-base/enabling-or-disabling-functionality-based-on-consent-and-cookies/) suggests wrapping the applicable code within an IF statement, e.g.,:
if ( has_consent ( 'privacy-policy' ) && is_allowed_cookie ( paypal-button ) ) {
// Run the code.
}
I would think if the code within the AJAX widget were wrapped that way, rather than applying it to the widget itself with Widget Logic, the result would be that the widget would always load, but if the tests fail, the code within it would not and the result would be an empty widget with only a title (not the most elegant solution, but probably acceptable).
However, if I add that code within the AJAX widget, it just outputs as plain text. In principle, the has_consent ( ) and is_allowed_cookie ( ) functions are supposed to be available in both JavaScript and PHP (and work that way with caching disabled).
As you can see, I’m out of my depth, and I’m not sure if this is a plugin issue or, as @dimalifragis suggests, my fundamentally misunderstanding how the AJAX widgets are supposed to work.