Explain Like I'm Five

It's extra weird because by definition, whatever they thought "legitimate interest" really meant, they wouldn't need your consent for. That's a different letter or clause or whatever.

The rule itself is not a loophole.

To use legitimate interest as a reason to process data you need you be able to argue that you do actually have a good reason to do so and that the user would expect you to process it.

For example, I think that websites have a legitimate interest in anonymously tracking your browser behaviour to analyse performance data and errors so that they can improve their app.

The loophole is that advertisers use it to process way too much data (when they are pretty much the reason for the bloody law in the first place) and that nothing is done about it.

I know right? Now, I'm not a lawyer, but it seems interesting because of what it isn't. 1a through e are consent, needed for business, legal obligation, (your) vital interests or another being, or public interest/authority.

So after all that, you have to figure... what legitimacy's left?

GDPR is pretty airtight in general, so I'm guessing we're missing something.

Edit: Hmm, it looks like the definition is left up to the courts of individual countries. That's not great.

Just a reminder that there's never such a thing as "a loophole". What there is is a carefully-worded, innocuous-sounding phrase that some corporation "helpfully" got added to a law or regulation (usually "for clarity"), and which the corporation already plans to mis-use in a given way should the appropriate circumstances arise (and in contradiction of all "we should never do that!" protestations they might make prior to the law or regulation taking effect).

Again, there is no such thing as "a loophole".

It would help to clarify in the post that you're interested in the legal aspects for the EU under the GDPR.

To answer your question though, on the GDPR website I thought these snippets were the most helpful:

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

• Receive users’ consent before you use any cookies except strictly necessary cookies.

....

Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.

....

The rules regulating cookies are still being set, and cookies themselves are continually evolving, which means maintaining a current cookie policy will be a continuous job. However, properly informing your users about the cookies your site is using and, when necessary, receiving their consent will keep your users happy and keep you GDPR-compliant.

Edit: Sorry, forgot the ELI5. As long as the website informs users why a cookie is necessary for the website to function correctly, it can be classified as 'strictly necessary' and not require consent. As far as what's "necessary"... that's still being defined and will probably be reviewed on a case by case basis.

They're different because you can't use the service without them. For example like with an auth cookie.

Someone before me answered the question quite well. No need to repeat it.