[GordonS]

Annoyingly, legitimate interest covers more than that - it also covers opt-in-by-default to direct marketing. Yes, if a customer registers an account or makes a purchase, you can opt them in by default on the basis of "legitimate" interest[0].

[0] https://ico.org.uk/for-organisations/data-protection-advice-...