It does exist, but the allowable use cases that third parties can claim "legitimate interest" for need to be severely restricted. At present, it's a joke - a single site can have dozens or even hundreds of companies claiming "legitimate" interests, but which are anything but legitimate.

Even if they were well-funded, I suspect the history of regulatory capture, at least in the U.S., shows that meaningful pro-consumer reforms get slow-walked until the underlying bills dilute and/or die in committee.

Or, if reforms do pass, they get reversed the next time the counter-party gains enough power in Congress to roll back the progress.

Legitimate interests exist, and the loophole exists because otherwise legitimate use cases like security audits or fraud detection would be impossible.

Most of EU laws are "these are sensible defaults and we expect you to behave like adults". As we've seen, digital services are anything but.

"legitimate interest" was supposed to be for things like remember-login cookies and the like. Not for advertisers going "my interest is legitimate because it's how I make money".

Legitimate interest does exist and is a specific purposeful provision in the law.

€6.3B cumulative fines says that they’re enforcing the law to at least some extent: https://www.enforcementtracker.com/statistics

They are useful as a deterrence system, can't decline in one click? I'm out thanks.