Legitimate interest under Article 6(1)(f) of the GDPR lets you process personal data without consent when the processing is necessary for a real interest of yours and people's rights do not override it. It works for fraud prevention, network security and some direct marketing by post. It does not replace consent for non-essential cookies: Article 5(3) of the ePrivacy Directive requires consent before analytics or advertising cookies are set, whatever basis you use for the processing that follows.
Legitimate interest sounds like a shortcut. If your business has a good reason to process personal data, you might assume you can skip consent altogether. That assumption has cost organisations millions of euros in fines.
Article 6(1)(f) allows data processing when it is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided those interests are not overridden by the rights and freedoms of the data subject. It is genuinely flexible - the GDPR does not provide a closed list of what counts as legitimate - but flexibility does not mean you can use it to avoid getting consent for cookies, tracking pixels, or behavioural advertising.
What legitimate interest means under the GDPR
The GDPR recognises six legal bases for processing personal data: consent, contractual necessity, legal obligation, vital interests, public task, and legitimate interest. Each exists for different situations. Consent works when you need a clear opt-in. Contract applies when processing is needed to fulfil an agreement. Legitimate interest fills the gap where processing serves a real business or societal purpose and consent would be impractical or disproportionate.
Recital 47 of the GDPR states that a legitimate interest does not need to be enshrined in law. It can be commercial, organisational, or societal. The recital mentions direct marketing as something that "may" be a legitimate interest - a point that has generated significant confusion. That word "may" is doing a lot of work. It does not mean direct marketing automatically qualifies.
On 4 October 2024, the Court of Justice of the European Union (CJEU) ruled in Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (KNLTB). The Dutch Data Protection Authority had fined the Royal Dutch Tennis Association EUR 525,000 for sharing members' personal data with sponsors, arguing that purely commercial interests could never be legitimate interests. The CJEU disagreed, confirming that commercial interests can qualify as legitimate - but only if they pass a strict three-part test.
Legitimate interest vs consent: a quick comparison
The two bases differ most on cookies, sensitive data and what people can do afterwards:
| Aspect | Legitimate interest | Consent |
|---|---|---|
| Prior opt-in required | No | Yes |
| Documented assessment required | Yes (LIA) | No (but you must record consent) |
| Right to object | Yes, under Article 21 | Right to withdraw at any time |
| Works for cookies and tracking | Almost never (the ePrivacy Directive requires consent) | Yes |
| Works for email marketing | Only in very limited cases (existing customers, soft opt-in where national law permits) | Yes |
| Data portability applies | No | Yes |
| Can be used for sensitive data | No (Article 9 requires explicit consent or another specific condition) | Yes, with explicit consent |
The three-part legitimate interest test
Every use of legitimate interest requires a documented assessment. The UK's Information Commissioner's Office (ICO) calls this a Legitimate Interests Assessment (LIA), and while the GDPR does not mandate the term, the accountability principle in Article 5(2) effectively requires you to document your reasoning. The EDPB's draft Guidelines 1/2024 on legitimate interest, published for consultation in October 2024, follow the three-step approach set by CJEU case law.
Step 1: purpose test - is there a legitimate interest?
You must identify a specific, concrete interest. Vague statements like "improving our services" or "business development" are not enough. The interest must be lawful, clearly articulated, and real - not hypothetical.
Recital 49 of the GDPR gives network and information security as an explicit example. Fraud prevention is another. Processing employee data for internal administration, sharing data within a corporate group for internal purposes (Recital 48), and certain types of direct marketing to existing customers are all recognised starting points. The CJEU's KNLTB ruling confirmed that commercial interests such as generating revenue through sponsorship can pass this first step, provided they are not contrary to law.
Step 2: necessity test - is the processing actually needed?
This is where many assessments fail. The EDPB's draft guidelines stress that processing must be necessary, not merely useful. If you can achieve the same goal through less intrusive means - anonymisation, aggregation, or asking for consent - then legitimate interest does not apply.
The necessity test also ties into data minimisation under Article 5(1)(c). You cannot collect more data than the minimum required. The CJEU noted in the KNLTB case that the tennis association could have asked its members whether they wanted their data shared with sponsors, a less intrusive alternative that the national court has to weigh.
Step 3: balancing test - do the individual's rights override your interest?
Even if your interest is legitimate and the processing is necessary, you must weigh it against the impact on individuals. Key factors include:
| Factor | Weighs in favour of controller | Weighs against controller |
|---|---|---|
| Data subject expectations | Processing is expected given the relationship | Processing would surprise or concern the individual |
| Nature of data | Non-sensitive, limited scope | Special category data, children's data, financial records |
| Impact on individuals | Minimal or beneficial effect | Risk of discrimination, financial loss, reputational harm |
| Safeguards | Pseudonymisation, access controls, opt-out available | No safeguards, no opt-out mechanism |
| Power imbalance | Individual has genuine choice | Individual depends on the service (for example employment or essential services) |
The EDPB guidelines emphasise "reasonable expectations" as a central concept. If a data subject would not expect their data to be used in the way you intend, the balancing test is unlikely to go in your favour. A customer who buys hiking boots might reasonably expect the retailer to send related product recommendations by post. That same customer would not expect the retailer to share their purchase history with insurance companies.
Where legitimate interest works in practice
Legitimate interest is not a loophole, but it is not a dead letter either. Several common processing activities sit comfortably within its scope when the LIA is done properly.
Fraud prevention and network security are the textbook examples. Recital 49 explicitly recognises that processing data to prevent unauthorised access to networks, stop the spread of malicious code, and detect denial-of-service attacks is a legitimate interest. A website logging IP addresses and monitoring traffic patterns for security purposes can rely on Article 6(1)(f) without difficulty.
Intra-group data transfers for internal administrative purposes also have explicit backing in Recital 48. A parent company processing employee contact details across subsidiaries for payroll coordination or IT support typically passes the three-part test.
Postal direct marketing to existing customers can work under legitimate interest in many EU jurisdictions, provided you offer a clear opt-out. Note the emphasis on postal: electronic direct marketing (email, SMS) is governed separately by the ePrivacy Directive and usually requires prior consent, apart from the soft opt-in for existing customers where national law allows it.
CCTV and physical security of business premises is another area where legitimate interest frequently applies. The processing is clearly necessary, the interest is straightforward, and individuals generally expect to be recorded in commercial spaces when signs are displayed.
Legitimate interest cookies: why consent still applies
You cannot rely on legitimate interest to set analytics or advertising cookies in the EU. Article 5(3) of the ePrivacy Directive requires prior consent before storing or accessing information on a user's device. The only exceptions are cookies that are strictly necessary to transmit a communication or to provide a service the user has explicitly requested. Analytics cookies, marketing cookies, social media pixels, and behavioural tracking tools do not qualify for either exception.
The ePrivacy Directive is lex specialis - a more specific law that takes precedence over the GDPR's general provisions in matters relating to electronic communications. This means that even if you could construct a valid legitimate interest argument under Article 6(1)(f) GDPR for the data processing that follows, you still need consent under the ePrivacy Directive for the act of placing the cookie on the user's device in the first place.
The EDPB's draft guidelines address this directly. They confirm that consent requirements under Article 5(3) of the ePrivacy Directive must be respected when tracking techniques are used for direct marketing. Any subsequent processing of personal data obtained through cookies must also have a legal basis under Article 6(1) GDPR, and the guidelines state that consent will "likely constitute the appropriate legal basis" in this context, "normally precluding reliance on Article 6(1)(f)."
Put plainly: legitimate interest does not let you skip the cookie consent banner.
The IAB TCF dropped legitimate interest for personalised ads
If you have ever configured a consent banner using the IAB Transparency and Consent Framework (TCF), you may have seen advertising vendors list "legitimate interest" alongside consent. That has changed. Since TCF v2.2, vendors can only register consent as the legal basis for purposes 3, 4, 5 and 6 (creating and using personalised advertising and content profiles), according to IAB Europe's January 2026 FAQ on the APD decision. As of October 2026, TCF v2.3 is the current version, and Google has required v2.3 strings since 28 February 2026.
The change followed enforcement. In 2022, the Belgian Data Protection Authority (APD) found that IAB Europe had breached the GDPR through the TCF. On 7 March 2024, the CJEU held in Case C-604/22 (IAB Europe) that a TC string can be personal data and that IAB Europe can be a joint controller. On 14 May 2025, the Brussels Market Court annulled the APD's decision on procedural grounds but confirmed the EUR 250,000 fine and held that the TC string is personal data.
The EDPB's cookie banner taskforce, reporting in January 2023, also looked at banners that claim legitimate interest for cookie purposes. Some sites present users with a button to reject cookies while pre-selecting legitimate interest toggles for advertising vendors in a separate tab, forcing users to deselect them one by one. Data protection authorities have treated that design as a way around a refusal.
Real enforcement: what happens when you get it wrong
The consequences are not theoretical. The Irish Data Protection Commission fined LinkedIn EUR 310 million in October 2024 for processing user data for behavioural analysis and targeted advertising without a valid legal basis. The investigation found that LinkedIn's reliance on consent, legitimate interest, and contractual necessity were all insufficient for the processing it carried out.
In France, the CNIL fined Amazon France Logistique EUR 32 million for an employee monitoring system that tracked warehouse workers' scanning speed, idle time, and break duration. The CNIL found that the monitoring system's reliance on legitimate interest was unjustifiable given the intrusive nature of the data collection and the power imbalance between employer and employees.
How to conduct a legitimate interests assessment
If you believe legitimate interest is the right legal basis for a specific processing activity (not involving cookies or tracking technologies), you need a documented LIA before you start processing. Doing it retrospectively is not permitted - processing data without an established legal basis is unlawful from the outset.
Your LIA does not need to follow a specific template, though the ICO publishes a useful one. At minimum, it should cover:
| LIA section | What to document |
|---|---|
| Purpose | The specific legitimate interest, stated precisely - not vaguely |
| Necessity | Why processing is needed, what alternatives were considered, how data minimisation is applied |
| Balancing | Impact on individuals, their reasonable expectations, nature and sensitivity of data, safeguards in place |
| Outcome | Clear conclusion on whether the interest overrides the individual's rights, or the other way round |
| Review date | When you will reassess - circumstances change, and your LIA must remain current |
If the balancing test is close, you can tip the scales by introducing additional safeguards: pseudonymisation, strict access controls, shorter retention periods, or a clear opt-out mechanism. But if the result is clearly negative - the processing is too intrusive, too unexpected, or involves sensitive data - you need to find an alternative legal basis or reconsider the processing entirely.
Transparency requirements
Article 13(1)(d) of the GDPR requires you to inform data subjects about your legitimate interests at the time of data collection. Your privacy notice must state what those interests are - not just say that you rely on legitimate interest. The CJEU reinforced this point in the KNLTB ruling, noting that proper transparency could have given individuals the opportunity to retain control over their data.
The right to object
Article 21 of the GDPR gives individuals the right to object to processing based on legitimate interest at any time. When someone objects, you must stop processing unless you can demonstrate "compelling legitimate grounds" that override the individual's interests. For direct marketing specifically, the right to object is absolute - no balancing exercise, no exceptions. You must stop immediately.
Common mistakes website owners make
The most frequent error is treating legitimate interest as a fallback when consent is inconvenient. If your real concern is that users might not consent - for instance, to analytics or advertising cookies - that reluctance is a signal that the processing may be too intrusive. Choosing legitimate interest to avoid giving people a choice defeats the purpose of the legal basis.
Another common mistake is conducting the LIA after starting the processing. An LIA must be completed before data collection begins. A retrospective assessment carries no legal weight and can be seen as evidence that you did not take your obligations seriously.
Some organisations treat the LIA as a one-off exercise. Your processing context changes over time - new data sources, new purposes, new risks. The EDPB expects ongoing review, particularly where the balancing test was borderline.
A fourth error is failing to distinguish between what the GDPR permits for data processing and what the ePrivacy Directive requires for device access. These are separate legal instruments with separate requirements. A valid legitimate interest under the GDPR does not override the consent requirement under Article 5(3) of the ePrivacy Directive.
The ePrivacy Regulation was withdrawn
The ePrivacy Regulation was proposed in 2017 to replace the 2002 ePrivacy Directive. In its February 2025 work programme, the European Commission announced the withdrawal, and the withdrawal was formally published on 6 October 2025, so the Regulation will not come.
The ePrivacy Directive, as transposed into national law by each EU member state, therefore remains the framework for cookies and electronic communications. A Digital Omnibus proposal from November 2025 would move the cookie rule into the GDPR, but as of October 2026 it is still a proposal before the European Parliament and the Council. In practice, consent is still required for non-essential cookies, and legitimate interest remains unavailable for most tracking activities.
Questions about legitimate interest
Can I use legitimate interest instead of consent for Google Analytics cookies?
No. Placing analytics cookies on a user's device requires prior consent under Article 5(3) of the ePrivacy Directive. Legitimate interest under the GDPR does not override this requirement, because the ePrivacy Directive is the more specific law governing device access. You need a cookie consent mechanism that blocks analytics scripts until the user opts in.
Does the CJEU's KNLTB ruling mean I can process data for any commercial purpose?
No. The ruling confirms that commercial interests can qualify as legitimate interests, overturning the Dutch DPA's strict interpretation. But the CJEU stressed that all three parts of the test - legitimate purpose, necessity, and balancing - must still be satisfied. A commercial motive alone is not enough.
Do I need to conduct a Legitimate Interests Assessment for every processing activity?
You need an LIA for every processing activity where you rely on legitimate interest as your legal basis. The depth of the assessment depends on the risk - low-risk activities may only need a short document, while high-risk processing may require a full Data Protection Impact Assessment (DPIA) as well.
What happens if a user objects to processing based on legitimate interest?
Under Article 21 of the GDPR, you must stop processing unless you can demonstrate compelling legitimate grounds that override the individual's rights. For direct marketing, the right to object is absolute - you must stop immediately with no balancing exercise required.
Can legitimate interest apply to email marketing under GDPR?
The GDPR's Recital 47 mentions direct marketing as a possible legitimate interest. However, the ePrivacy Directive requires prior consent for electronic marketing communications such as email and SMS. Some EU member states permit a "soft opt-in" exception for existing customers, but this varies by country and must be checked against local transposition of the Directive.
Is legitimate interest available under the CCPA or other non-EU privacy laws?
The CCPA and CPRA do not use the concept of legitimate interest. US privacy laws generally allow processing unless the individual opts out or the data is sensitive. Brazil's LGPD does include legitimate interest as a legal basis (Article 10), with a similar balancing test to the GDPR. Each jurisdiction has its own framework.
Why do some cookie banners show a legitimate interest tab with pre-selected vendors?
That tab comes from the IAB Transparency and Consent Framework (TCF), where vendors can still declare legitimate interest for some purposes. Since TCF v2.2, legitimate interest is no longer allowed for personalised advertising and content profiles, and the EDPB's draft guidelines say consent is normally the appropriate basis when tracking technologies are involved.
Check what your website actually sets
If you are unsure whether your site relies on legitimate interest where consent is required, start by knowing exactly which cookies and trackers are present. Kukie.io scans your website, sorts every first-party and third-party cookie into a category and feeds that list into your consent banner, which holds non-essential cookies until visitors opt in.
