It's defined in GDPR as something that 'can be reasonably expected for the business' and has 'little risk of infringing on privacy'. They specifically list fraud prevention, information security, dealing with employee data, as valid use cases. Marketing most definitely is not.

This move is basically clarifying that you can't simply claim legitimate interest for most advertising purposes, which the TCF was encouraging/facilitating.