At our company, we are actually required to timestamp and enumerate the legitimate interest on all new marketing leads. I think the issue is here that GDPR is

At our company, we are actually required to timestamp and enumerate the legitimate interest on all new marketing leads. I think the issue is here that GDPR is a fairly poorly written cudgel of a law, and regulators are really only using it to go after larger foreign tech companies. Smaller, local companies can get away with much more malfeasance because it would be such a pain to enforce.