This is wrong. Cookies are covered by ePrivacy, article 5(3), not GDPR. There are two regimes for cookies: strictly necessary ones, and others, requiring consent. The fact that disabling “legitimate interest” cookies does not break the service should tell you that they are not strictly necessary.

GDPR enters the picture when cookies are used to identify users. And using the “legitimate interest” basis for ad purposes is illegal, and instead will require consent. Adtech is just hoping that users won't notice and lodge a complaint.

Thank you for the correction!