The GDPR has the notion of "_legitimate interest_", however tracking, marketing and advertising don't fit the criteria. For an explanation see: https://www.gdp

The GDPR has the notion of "_legitimate interest_", however tracking, marketing and advertising don't fit the criteria. For an explanation see: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat... Basically you can say that a company doing home deliveries needs your home address to do so, therefore that's a legitimate interest. But note the same company cannot use your address for sending marketing materials. And publishers cannot claim to have a legitimate interest in tracking users, even if their revenue comes from serving ads and even if their performance improves by tracking. That is because you can serve ads and do optimizations without tracking users. Even if it is less effective, it's not legitimate. And it's not that complicated, really. The question is, by providing the service, does the user expect you to use his data or not? In case of pizza delivery, the customer does expect you to use his address for delivering pizza, but at the same time the customer doesn't expect you to give his address to other companies or to use his address for sending marketing materials.