That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for l

That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for logins). Everything else is abusing the term and should be reported to the responsible data protection authority.