> Are there counter examples to this where the exception might apply? The "legitimate interest" basis for processing data is meant for things like security, fr

> Are there counter examples to this where the exception might apply? The "legitimate interest" basis for processing data is meant for things like security, fraud prevention, etc. So more concretely, credit card buyers can't to opt out of data processing for fraud prevention, because that's what every fraudster would do. Or as another example, sites need to be able to log data like IP addresses for a reasonable time to figure out if they're under a Dos attack, or a password stuffing attack, etc, and to block abusive IPs. These can't require consent, because an attacker will not give consent. (And you can't just block everyone that withholds consent either.) Legitimate interest is definitel not supposed to be used as "it's our legitimate interest to make as much money as possible", and it's kind of crazy how many companies have tried that. There's just no ambiguity to that. But there is various interesting and ambiguous middle ground. Is a site allowed to claim legitimate interest in order to use Recaptcha to protect their login form? It is necessary to protect that login page one way or another. But there could be other ways to protect it with a smaller data footprint. Those ways might not be as effective, or they might not be more expensive, but obviously the law doesn't specify any kind of crisp criteria for just what tradeoffs are acceptable.