Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout).

The fact that the BBC have chosen to add consent options to a purported legitimate interest is a hint that they’re trying to confuse the user.

> Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout).

Nope, that'd be the "contract" basis (i.e. this information is strictly necessary for the user's intended task).

Legitimate interest is for non-essential data that it is, somehow, in the user's best interest to gather. But convincing a judge of that data being in the user's best interest is a...tricky bar to clear.

> The fact that the BBC have chosen to add consent options [...] is a hint that they’re trying to confuse the user.

Yes, just another dark pattern which you see so often with those cookie banners.

It's one of the reasons that allows a company to collect/process personal information without a) consent b) contractual obligation c) legal requirements

It's a bit loopholey, but has high hurdles since the processor needs to argue that their legitimate interest is bigger than the right for data privacy of the user. The processor has to create a DPIA (data privacy impact assessment) to show that they indeed balanced these both sides. The document can only be requested from the data protection authorities and are not public though.

Those are things you need for the website to work. Session/login cookies are examples of this. It also applies to other data, for example if you order something they have a legitimate interest to ask for and store your address (but only for the purposes of shipping, they cannot use it for anything else).

This has been twisted into "It's legitimate we track you because this is how we make money and we can't exist without money" which is obvious bullshit.

GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Anyway, flimsy legitimate interest excuses are easiest to override. You just object to data processing, then it's upon the other side to provide overriding reasons why their legitimate interest is more important than your "interests or fundamental rights and freedoms" of which right to object to data processing is one.

Almost nobody even tried to pass that hurdle when I objected to data processing. And those few that did try, I just sent them the decision to fine for almost identical situation (where a company tried to claim legitimate interest for mining data from public registries and sources and publishing them on a website) from my country's DPA. And that made them comply too.

>You just object to data processing

The problem with objecting is that they claim to need to store your info for the future to exclude you from data gathering. And presumably give that blacklist to everybody else to "exlude" you.

Fine by me, as long as they can't use it for anything else.

The GDPR has a part about that, it's where this wording comes from.

It boils down to basic visitor counting without privacy violations.

Companies obviously try to broaden the definition of that.