[merijnv]

> Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout).

Nope, that'd be the "contract" basis (i.e. this information is strictly necessary for the user's intended task).

Legitimate interest is for non-essential data that it is, somehow, in the user's best interest to gather. But convincing a judge of that data being in the user's best interest is a...tricky bar to clear.