What is The 'Legitimate Interest' Loophole?
'Reject All' usually only switches off the tracking that asks for consent. Hidden in a second tab, dozens of ad vendors keep processing your data under pre-enabled 'legitimate interest' toggles that your rejection never touched.
Where it comes from
IAB Transparency & Consent Framework (2018)
How it hooks you
Exploits satisficing: 'Reject All' looks like the complete answer, so you never look for the second layer where the tracking continues.
What the research shows
EU regulators ruled the ad industry's standard consent framework unlawful and ordered it to stop using 'legitimate interest' for ad tracking — yet the pre-enabled toggles still appear in banners across the web.
How to resist it
Open the banner's 'Legitimate interest' or 'Vendors' tab and press 'Object to all' — it is a separate switch from Reject All, and often the one that matters.