[cccbbbaaa]

You're mostly right, but legitimate interest also require balance. Fingerprinting may be considered to be too intrusive if logs are enough.

[mpeg]

Depends on the product, payments products generally use fingerprinting and present extra prompts if you're using an unknown device – that is kind of one of the main problems of the GDPR though, there are nuances and it's usually not white and black what can be done without specialised legal counsel (and sometimes, even then...)