Sponsorship (including merch) works for things people love - not stuff they casually use. In that case ads are probably the best option - but that's easily possible GDPR compliantly.