> GDPR: "legimate interest"

It doesn't allow spying though. It allows, e.g., to save your session if you intentionally logged in.