European GDPR watchdog rules IAB ad-consent system unlawful

> [A]ny personal data collected so far by means of a TC String in the context of the globally scoped consents, which is no longer supported by IAB Europe, shall be deleted without undue delay by the defendant.

I don't get it, did they basically have a tracking backdoor that companies like Google and Facebook happily used that they now must plug?

> In addition, the Litigation Chamber orders the defendant to prohibit the use of legitimate interest as a legal ground for processing by the organisations participating in TCF in its current format, via its terms of use.

Wait, what? So what's the point of consent if they can just claim is "legitimate use" and have your data anyway??