It does exist, but the allowable use cases that third parties can claim "legitimate interest" for need to be severely restricted. At present, it's a joke - a single site can have dozens or even hundreds of companies claiming "legitimate" interests, but which are anything but legitimate.

It's almost hilarious how every cookie form now has a "legitimate interest" section that's just a copy of the "consent" section with defaults set to "allow".

They're not even pretending anymore and are just trying everything they can't get consent for again via the "legitimate interest" route.

I was actually wondering if the mandated "refuse everything" button that revokes my consent in bulk (and then conveniently closes the window) also implies I objected to all "legitimate interest" claims, or if that is another malicious compliance trick...