Re: "Are the 4% fines levied on both Google AND the advertisers"
"Google does the targeting, the advertiser never see the actual personal data. so it isn't nor the controller nor the processor - Google is both."
Technically, Google is just the controller in the example you give, there is no processor.
The controller is responsible for compliance with the principles of processing of personal data under it's control. If an processor were acting on Google's behalf, it would act only on Google's instruction, so the big G carries the can (unless the processor acts outside of those instructions).
It would be more likely if there were sharing of identifiable information with an advertiser, that both are controllers (rather than controller-processor) and so both are equally responsible for their own processing activities.
I agree, the business models that ad industry and consumer web services like Google have put in place are heavily dependent on data slurping. When regulation under GDPR and other DP laws start to have an effect, they may use that to move to a more freemium type of model for some services, or charge more for products e.g. Android devices, if that source of revenue is to be undercut.