This "legitimate interest" crap should be hit hard, with a few big examples made to warn others. The cases where you can claim legitimate interest are essentially "when the user agrees with you that it's legitimate", not "we have a legitimate interest in profiting off your data".