So almost every GDPR cookie consent banner out there has a section for "legitimate interest" cookies that they can leave on by default and you will inadvertently accept even if you choose "Reject all" unless you go to the detailed settings and disabled those too.
Some of them have dozens of legitimate-interest cookies.
I read some articles about what they are and why it is allowed to keep them on by default, but they were very vague. So can someone explain it to me like I am five?
It's rather vague to me too, the most helpful summary I found was this one:
In general, the condition applies when:
The processing isn’t required by law, but there’s a clear benefit to it;
There is little risk of the processing infringing on data subjects’ privacy; and
The data subject should reasonably expect their data to be used in that way.
So "we don't have to do this, and most likely it won't be privacy sensitive, and you probably already know we want to do this, but you can still opt out"
It's rather vague to me too, the most helpful summary I found was this one:
So "we don't have to do this, and most likely it won't be privacy sensitive, and you probably already know we want to do this, but you can still opt out"
Source: https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-interest-what-is-it-and-when-does-it-apply
Oh, that's helpful and sheds some light, thanks.
Still leaves a lot of room for interpretation, though! But it is what it is.