1. Purely transmitting data

2. Delivering a service explicitly requested by the user

3. Aggregated audience measurement carried out by the controller for internal use only

4. Maintaining or restoring the security of the service or user device

If a processing activity falls strictly within one of these categories, cookie banners and consent dialogs would no longer be required, as the operation would be considered lawful without further user interaction.