IANAL, but if you deem the processing necessary, then you can use "fulfilment of a contract" or "legitimate interests" as your legal basis and argue on that. Th

IANAL, but if you deem the processing necessary, then you can use "fulfilment of a contract" or "legitimate interests" as your legal basis and argue on that. There's no "right" legal basis, and you can choose whichever you deem necessary. This just now means you have to be pretty darn sure you're choosing the right one (because, you've always had to protect and limit the amount of information you collect and process, now it's just much more explicit). As with everything GDPR (and most digital regulations in general), the large companies will win as they have the legal teams to draft the statements and scores of developers in order to get the UX process sorted (or argue their case in the event something goes awry).