I think what you're proposing is: 1. Collect data for DOS-prevention purposes. 2. Analyze it afterwards in aggregate for advertising purposes. Except you can

I think what you're proposing is: 1. Collect data for DOS-prevention purposes. 2. Analyze it afterwards in aggregate for advertising purposes. Except you can't do #2 without turning #1 into "collect data for DOS-prevention and advertising purposes", which goes beyond your legitimate interest in collecting the data. I agree that #2 should be allowed if you'd do #1 anyway, but this isn't how the GDPR works.