“Legitimate interest” is a concept from GDPR, which is the EU’s major legislation around digital rights. “Legitimate interest” is an extremely soft concept that basically says “a company must have some reason that is not obviously bullshit to process your data.” That includes advertising. “We need to know your age, gender and city so we can decide what ads to show you” is considered “legitimate interest.” See? Soft.

What it doesn’t cover is “We just think it’s desirable to accumulate as much data as we can about you for no particular reason and maybe we can just sell it one day, idk.” That would not be considered “legitimate interest.” Similarly, asking for e.g. a user’s phone number but having no particular explanation for why you need it would not be “legitimate interest.”

So when you see “legitimate interest” cookies as a category, you can interpret that as “cookies that have some purpose-- including advertising-- as opposed to literally no purpose other than superstitious data hoarding.” Block them.