> Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation No you don't. You don't

> Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation No you don't. You don't need to ask for permission for data you collect/store that is strictly required for your business to operate. Key word: strictly required. Meanwhile these leeches have latched on on a more nebulously defined "legitimate interest". For example, if you need fraud protection for your order-processing business, you have a legitimate interest to process and store more data than is strictly required. Since such legitimate interests are innumerable they are not explicitly defined in the law. So, the parasites clamp things like "siphon your data and sell it to the highest bidder" under "legitimate interest". Which skirts the law, and will fall apart under scrutiny. See the three-part test by UK's data authority, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-data-protectio... (UK is so far still bound by GDPR)