Only if the lawfulness for processing is based in consent rather than “the legitimate interests pursued by the controller or by a third party” - exactly what is

Only if the lawfulness for processing is based in consent rather than “the legitimate interests pursued by the controller or by a third party” - exactly what is considered a legitimate interest is only going to wind up being settled between Facebook/Google and a regulator in court.