There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless

There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one. One example is https://www.bbc.com https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right. This is because the BBC hates you and wants you to be unhappy.