It's not defined. It was left intentionally ambiguous in the GDPR so member states have some flexibility in definition.

I've got a call with a lawyer on Monday to clarify some bits of the GDPR. Number one Q for me is "how far can you take legitimate interests?".

Some lawyers are advising that marketing data and usage falls under legitimate interest, in a way that these higes drives for consent seem unnecessary.

If anyone else has any questions, I can ask and feedback. I'm sure I'll have those questions too.