> 2. Why is there a second set of things to opt out of as "Legitimate Purpose"? Why doesn't the "Reject All", when present, not cover these too?
Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation ("legitimate interest")... but you do not need consent from the user for these.
Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation ("legitimate interest")... but you do not need consent from the user for these.