IANAL and all that. This is the most vague part of the law because the law couldn't just forbid everything and then run into issues. For example, to run a bus

IANAL and all that. This is the most vague part of the law because the law couldn't just forbid everything and then run into issues. For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate. However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required. As with any vague parts this "legitimate" part is now abused by the ad industry.