One example is https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right.
This is because the BBC hates you and wants you to be unhappy.
Is it possible for a website to say, if you object to these, just don't use our website/service?
IIRC this is against both the meaning and the letter of the law, but that is not practical to properly enforce so they get away with it.
This is the most vague part of the law because the law couldn't just forbid everything and then run into issues.
For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate.
However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required.
As with any vague parts this "legitimate" part is now abused by the ad industry.
While some comments are saying that legislation can narrow this down, I don't think it's anything that can be agreed up front any longer.
Web is heading toward a complete change of protocol. One that can operate between mutually hostile and untrustworthy principles. (that's what the web is now, let's face it)
What the service provider's and your "legitimate" requirements are, will have to be negotiated per transaction.
It's the end of the "uniform" web. But I think that already happened and we're long into "The Splinternet".
As I said in Digital Vegan, technology access will not be defined by the "have and the have-nots", but by the "will and the will-nots".
In most cases "legitimate interests" checkboxes, particularly those referring to 3rd parties, basically mean "we see you preference not to be stalked and, while we may claim to respect you and your privacy, fuck you and your silly desire for privacy".
> and is it even possible to object to them, legally speaking?
Legally, in theory, yes.
Practically, not really. You can go through and uncheck the hundreds of preselected consent options some sites present, but do you check that this actually results in tracking information not being dropped?