First-party, strictly necessary cookies, that are required to complete users' orders or to login into their account, could be the lawful basis for legitimate interest. However, marketing or tracking cookies that collect and process website users’ personal information for marketing purposes, do not fall under the legitimate interest. The ePrivacy Directive and the GDPR require you to get user consent prior to using cookies. If you did not get the user consent, you cannot use legitimate interests instead!