Comment by johannes1234321
13 hours ago
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
Legitimate interest definition is pretty narrowly scoped. Most of the sneakiness relies on nobody checking or enforcing it.
You are confusing GDPR and ePD. Legitimate interest is GDPR legal basis for processing personal data (it has it's own requirements). ePD triggers when you read/store e.g. browser data and make it available via network. Consent is the primary ePD legal basis and the exception related to that is much narrower (strictly necessary for ISS provider to provide service requested by user).
Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).