Have something that NBC News' tech investigations team should be digging into?

Yes: What is this crap called “legitimate interest”, as in privacy policies? Can companies really decide to track us even if we don’t want them to just by saying that they believe ottimo their legitimate interest to do so? Is this legal by GDPR standards? Is this legal according to California’s privacy law?

Lastly, what (if any) better alternative do we have as users to saying NO to all the requests we get to use (and misuse) our data? Is there a browser that will just let us say YES once and for all and yet protect us as if we had said NO?