Legitimate interest does not exist and is a loophole in the law which should be killed. You can challenge it but the authorities who should handle that are grossly underfunded.
Legitimate interests exist, and the loophole exists because otherwise legitimate use cases like security audits or fraud detection would be impossible.
Most of EU laws are "these are sensible defaults and we expect you to behave like adults". As we've seen, digital services are anything but.
It does exist, but the allowable use cases that third parties can claim "legitimate interest" for need to be severely restricted. At present, it's a joke - a single site can have dozens or even hundreds of companies claiming "legitimate" interests, but which are anything but legitimate.
It's almost hilarious how every cookie form now has a "legitimate interest" section that's just a copy of the "consent" section with defaults set to "allow".
They're not even pretending anymore and are just trying everything they can't get consent for again via the "legitimate interest" route.
I was actually wondering if the mandated "refuse everything" button that revokes my consent in bulk (and then conveniently closes the window) also implies I objected to all "legitimate interest" claims, or if that is another malicious compliance trick...
Even if they were well-funded, I suspect the history of regulatory capture, at least in the U.S., shows that meaningful pro-consumer reforms get slow-walked until the underlying bills dilute and/or die in committee.
Or, if reforms do pass, they get reversed the next time the counter-party gains enough power in Congress to roll back the progress.
"legitimate interest" was supposed to be for things like remember-login cookies and the like. Not for advertisers going "my interest is legitimate because it's how I make money".
Most of EU laws are "these are sensible defaults and we expect you to behave like adults". As we've seen, digital services are anything but.