The European Data Protection Board adopted the final version of its guidelines on processing personal data under Article 6(1)(f) of the GDPR on November 10, 2026, more than two years after it approved a draft for public consultation on October 8, 2024. Guidelines 1/2024, version 2.0, run to 42 numbered pages, 136 paragraphs, 202 footnotes and eight worked examples, and the board published them together with a four-page assessment flowchart and a two-page summary.

For advertisers, publishers and ad tech companies, the central marketing passage survived the consultation intact in substance. Marketing practices that involve intrusive profiling and tracking, "including those which involve tracking individuals across multiple websites, locations, devices or services," are ones for which "the balancing test would be very unlikely to yield positive results," according to the guidelines. Trade associations had asked the board to drop that position. It did not.

In Short

Europe's data protection regulators have finished their rulebook on when companies can use people's data without asking, under a legal ground called legitimate interest. It matters to anyone running email marketing, personalised ads, fraud checks or AI projects in the EU, because the guidelines set out the shared position of the national regulators that enforce the GDPR. If your marketing tracks people across sites or devices, profiles children, or relies on data someone else collected unlawfully, the regulators say legitimate interest will rarely, if ever, cover it.

What the board adopted

Legitimate interest is one of six legal bases in Article 6(1) of the GDPR. It allows processing that is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child," according to the text of the provision quoted in the guidelines.

The version history at the front of the document is short. The gap between the two adoption dates is 763 days, by PPC Land's count. Version 1.0 was adopted "for public consultation" on October 8, 2024. Version 2.0 was adopted on November 10, 2026, as the "adoption of the guidelines after public consultation." The consultation ran until November 20, 2024, according to submissions published by the EDPB. The final text is signed by Anu Talus, the board's chair.

The guidelines open with a warning in two directions. Article 6(1)(f) "should neither be treated as a 'last resort' for rare or unexpected situations where other legal bases are deemed not to apply, nor should it be automatically chosen or its use unduly extended because of a perception that it is less constraining than other legal bases," according to the executive summary. Later, the board adds that the provision "should not be considered as an 'open door' to legitimise all data processing activities which do not fall under any of the other legal bases." Citing the Court of Justice of the European Union, it says each legal basis "must be interpreted restrictively."

Three cumulative conditions apply. A legitimate interest must be pursued by the controller or a third party; the processing must be necessary for that interest; and the interests or fundamental rights and freedoms of the person concerned must not take precedence. The assessment must be done "before carrying out the relevant processing operation(s)" and documented under the accountability principle in Article 5(2).

The flowchart

The annex, titled "Legitimate Interest Assessment (LIA) flowchart" and labelled as version 2 on the EDPB's document page, turns that structure into a checklist. It opens with a statement that a legitimate interests assessment "must be carried out before the relevant processing begins." Two preliminary checks come first: whether the controller has identified the specific processing activity, its purpose, means and circumstances, and whether EU or national law requires another legal basis or rules out legitimate interest.

Each of the three steps carries paragraph references to the guidelines. Under the balancing step, the flowchart lists possible harms to weigh: "financial loss, reputational harm, discrimination, loss of privacy or control, emotional distress, chilling effects, or legal or similarly significant effects such as refusal of credit, job rejection or service denial." It ends with a blunt branch. If the interest remains overridden after extra safeguards, Article 6(1)(f) "cannot be relied upon," and "if no appropriate legal basis is available, the processing must not proceed." Where the test is passed, the flowchart's final instructions are to document the assessment, inform people of the interest and of their right to object, put procedures in place, including a data protection impact assessment where relevant, and "keep the assessment under review."

The two-page summary published alongside the final text still carries the date October 2024 on its cover. It lists "commercial interest" and "product improvement" among examples of interests that may qualify, next to fraud prevention, access to information online and assessing creditworthiness.

Tracking and personalised advertising

The direct marketing chapter is where the guidelines meet the advertising business most directly. Recital 47 of the GDPR says processing for direct marketing "may be regarded as carried out for a legitimate interest." The board's reading is that this "does not mean that direct marketing always constitutes a legitimate interest and that it is automatically possible to rely on Article 6(1)(f) GDPR to engage in all kinds of direct marketing activities."

Paragraph 119 draws the line. Controllers "may have a legitimate interest in getting to know their customers' preferences so as to better personalise their offers," but certain marketing practices "can be considered intrusive from the perspective of the data subject, notably if they are based on extensive processing of potentially unlimited personal data." The level of intrusiveness, the board writes, "can be a particularly relevant factor." Then comes the sentence about tracking across websites, locations, devices or services.

The 2024 draft made the same point in its paragraph 120, according to the text quoted in consultation submissions from IAB Europe and FEDMA, the Federation of European Direct and Interactive Marketing. In the draft, the balancing test would hardly produce a positive result for such practices. FEDMA asked the board to remove the statement, describing it as a reference to the CJEU's Meta judgment; IAB Europe argued that it implied a blanket exclusion at odds with the case-by-case assessment the GDPR requires. The final wording, "very unlikely to yield positive results," keeps the position and adds that the examples include practices "based on large volumes of data for marketing purposes."

The same paragraph describes the other end of the scale. It "may be easier for controllers to justify relying on Article 6(1)(f) GDPR with respect to less intrusive marketing activities, for example in the context of an advertising campaign consisting in sending the same commercial communication (e.g. a catalogue of products) to all existing customers who have already bought products similar to those that are advertised." Paragraph 118 adds that controllers "may have to implement appropriate safeguards and measures limiting the impact of the processing on the data subject, such as using privacy-enhancing technologies." IAB Europe's submission had asked the board to recognise such technologies.

Personalised advertising is direct marketing

A small change of wording carries weight for ad platforms. Neither "direct marketing" nor "personalised advertising" is defined in the GDPR. The 2024 draft said CJEU case law suggested that personalised advertising could be considered a form of direct marketing, according to the draft text. The final version is firmer: "CJEU case-law suggests that personalised advertising may be equated with direct marketing." It cites the Meta v. Bundeskartellamt judgment of July 4, 2023 and the Mousse v. CNIL, SNCF Connect judgment of January 9, 2025, which came after the draft.

The consequence follows in paragraph 121. Under Article 21(2) of the GDPR, the right to object to direct marketing "is unconditional and irrespective of the legal basis relied on by the controller." No reasons are needed, "there is no need for any 'balancing of interests'" and "it is enough that the data subject puts forth an objection for the objection to be successful." The controller cannot keep processing for marketing by pointing to compelling grounds, and must allow the objection "at any time in an easy way and free of charge."

Expectations, not industry habit

Example 5 in the guidelines describes an online social network funded by advertising tailored to "consumer behaviour, interests, purchasing power and personal situations," built from data collected "both on and off that social network." Although the service is free, the user "cannot reasonably expect that the operator of the social network will process that user's personal data, without his or her consent, for the purposes of personalised advertising," the board writes, and users "cannot reasonably expect those data to be processed even for other purposes such as product improvement." Example 6 covers a company printing marketing flyers with face photos that people had posted publicly themselves. They "could not reasonably expect that their photos would be processed and published by a third party."

Two passages that FEDMA contested remain. "The fact that certain types of personal data are commonly processed in a given sector does not necessarily mean that the data subject can reasonably expect such processing," according to paragraph 49. And "the mere fulfilment of the information obligations set out in Articles 12, 13 and 14 GDPR is not sufficient in itself" to make processing expected, according to paragraph 50. A privacy notice, in other words, does not manufacture expectations.

Tracking technologies sit under a separate law. Article 5(3) of the ePrivacy Directive requires consent for storing cookies or accessing information on a user's device, and paragraph 114 says "consent would likely constitute the appropriate legal basis both for storing and gaining access to information already stored on the user's device and for the subsequent processing of personal data, which would normally preclude reliance on Article 6(1)(f) GDPR in this context." The guidelines point to the EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), version 2.0 of October 7, 2024. PPC Land reported on the draft of those guidelines in December 2023, when the board extended Article 5(3) to tracking links, pixels and unique identifiers.

Email, messaging and the soft opt-in

The list of channels needing prior consent has grown. Under the ePrivacy Directive, unsolicited direct marketing "by email, SMS, MMS, RCS, messenger and other kinds of similar applications can only take place with the prior consent of the individual recipient," according to paragraph 113, and that consent must meet the GDPR standard in Article 4(11). The 2024 draft named email, SMS and MMS. In those channels, "the processing for direct marketing purposes may not be based on Article 6(1)(f) GDPR." A footnote recalls that the CJEU found the list of communication means in the directive "is not exhaustive."

The existing-customer exception, often called the soft opt-in, gets a new legal footing. Article 13(2) of the ePrivacy Directive allows a business that obtained electronic contact details from its own customers in the context of a sale to market its own similar products or services, provided customers can object easily and free of charge at collection and in each message. The final guidelines add that "when the conditions in Article 13(2) ePrivacy Directive are met for the sending of the direct marketing communication, it is sufficient in itself as a legal basis and no legal basis under Article 6 GDPR for the specific activity of sending the communication needs to be identified." The authority is the CJEU's Inteligo Media SA judgment of November 13, 2025, case C-654/23, which the guidelines quote as saying Article 13(2) "governs comprehensively the conditions and purposes of the processing." The 2024 draft described the exception but did not say it was sufficient on its own, according to the draft text.

Paper is different. Marketing "not provided by electronic means of communication (e.g. a letter)" falls outside the ePrivacy Directive and "would therefore not require consent under that Directive." Marketing by electronic means to legal persons, where no personal data is processed, is governed only by the directive. National implementing rules "may occasionally impose consent requirements that go beyond those laid down in that Directive (e.g. with respect to direct marketing towards professionals)." France is one example of how those national layers work in practice: Alliance Digitale's April 2026 prospecting guide said B2C email and SMS prospecting needs opt-in while B2B contact and postal mail can generally rely on legitimate interest.

Charities, parties and political ads

The final text widens the notion of direct marketing beyond commerce. "The GDPR does not expressly limit the notion of direct marketing to commercial purposes only," paragraph 109 says, so unsolicited communications "made by political parties, associations or charitable organisations, may therefore also be considered as direct marketing under the GDPR." It adds that Regulation (EU) 2024/900 on political advertising may also apply, and a footnote notes that Article 18(1)(b) of that regulation "requires 'explicit consent' within its scope of application," with a single exception in Article 18(3). Neither the regulation nor political parties appeared in the corresponding passage of the 2024 draft, according to the draft text. The regulation started to apply in October 2025; Meta stopped political, electoral and social issue ads across the EU from October 6, 2025 rather than operate under it.

Children: any marketing profiling, not only extensive profiling

The children's section, paragraphs 91 to 97, contains the most consequential edit for ad targeting. The board considers that "there are certain types of data processing operations, such as those consisting of profiling for marketing purposes and targeted advertising activities, which - subject to certain limited exceptions - will generally not align with the obligation to ensure specific protection of children." In the 2024 draft, the same sentence referred to extensive profiling and targeted advertising, according to the draft text. The qualifier is gone.

Where a controller's legitimate interests "(including regarding processing of personal data for commercial purposes)" conflict with a child's interests or rights, "the interests or fundamental rights and freedoms of the child should in general prevail." A footnote defines commercial purposes by reference to "commercial practices" in Article 2(d) of the Unfair Commercial Practices Directive 2005/29/EC, which includes "advertising and marketing." Another footnote quotes the UN Committee on the Rights of the Child's General comment No. 25 of 2021, which says states "should prohibit by law the profiling or targeting of children of any age for commercial purposes."

The board also writes that "unless controllers can demonstrate that the activities in question which rely on the processing of children's personal data outweigh the children's interests, such activities should not be undertaken." The final text identifies the Digital Services Act provision precisely, noting that it "prohibits online platforms subject to Article 28(2) of the DSA from performing targeted advertising based on the profiling of children's personal data." Paragraph 97 recognises that a child is "every human below the age of majority," and that assessments "will likely vary greatly" across age groups and for children with disabilities.

Two years of case law

Much of the difference between the two versions comes from judgments handed down after October 2024. The Meta v. Bundeskartellamt case number, C-252/21, appears 32 times in the final text, by PPC Land's count. Several newer rulings now shape specific passages.

Data bought from unlawful sources

The most significant addition for data buyers sits in a footnote. The CJEU has found "that the fact that a controller knew, or ought to have known, that certain personal data transmitted to them had been collected or stored unlawfully by the entity transmitting said data precludes the receiving controller from collecting this data in the pursuit of a legitimate interest," according to the guidelines, citing the NTH Haustechnik judgment of June 18, 2026, case C-484/24. The footnote links the point to the EDPB's December 2024 opinion on AI models, which addressed models developed unlawfully and then deployed by another controller. For list rental, data enrichment and broker-supplied audiences, the provenance of records now feeds directly into whether legitimate interest is available at all.

Telling people at the moment of collection

The Mousse judgment of January 9, 2025 appears at several points. According to the guidelines, the court held that Article 13(1)(d) "requires the controller to inform the data subjects of the legitimate interest pursued at the time when the data is collected, otherwise that collection cannot be justified on the basis of Article 6(1)(f) GDPR." The same judgment is cited for a second point: when assessing whether the three conditions are met, "it is not necessary to take the possible existence of the data subject's right to object into consideration." The statutory right to object, in other words, does not count in the controller's favour when weighing lawfulness. The 2024 draft cited only the Advocate General's opinion in that case.

Commercial interests and gambling

The Koninklijke Nederlandse Lawn Tennisbond judgment of October 4, 2024, case C-621/22, was already in the draft. It holds that "a commercial interest of the controller could constitute a legitimate interest, within the meaning of Article 6(1)(f) GDPR, provided that it is not contrary to the law," to be assessed case by case. The guidelines also use it on harm: when a controller intends to transmit data to "a provider of games of chance and casino games," the "possible harmful effects" have to be considered "since data subjects could be exposed to the risks associated with the development of gaming addiction."

The Deldits judgment of March 13, 2025, another post-draft ruling, shapes the section on the right to rectification: a person can be asked for evidence of inaccuracy only where "this can reasonably be required" of them. The final text also cites the Schrems v. Meta judgment of October 4, 2024, case C-446/21, which PPC Land covered when it limited Meta's use of data for ads, for the principle that every processing operation must respect the rights in Articles 12 to 22.

AI enters the text

The draft predated the EDPB's work on AI models. The final version adds paragraph 90, which points to Opinion 28/2024 of December 17, 2024 for "general considerations to take into account when assessing whether controllers can rely on Article 6(1)(f) GDPR for processing conducted in the context of the development and deployment of AI models." The examples given are "developing the service of a conversational agent to assist users, developing an AI system to detect fraudulent content or behaviour, or the improvement of threat detection in an information system." A footnote refers to Guidelines 03/2026 on web scraping in the context of generative AI, adopted July 7, 2026, in particular paragraphs 46 to 66.

FEDMA's submission had asked the board to address AI model training. The final text does so by reference rather than with new analysis. It also cites the EDPB's anonymisation guidelines of July 7, 2026 and its pseudonymisation guidelines of January 16, 2025 for "the use of anonymisation or pseudonymisation as measures to limit the impact of the processing on data subjects." FEDMA had asked for pseudonymisation to be recognised as a mitigating measure.

Mitigating measures: portability out, transparency campaigns in

When a balancing test tips against the controller, paragraph 53 allows "additional mitigating measures going beyond what is legally required." The list in paragraph 54 has changed shape. The 2024 draft included allowing data portability even where processing rests on legitimate interest, according to the draft text. The final list does not mention portability.

What it does include is a set of transparency measures, citing paragraph 103 of the AI opinion: public communications going "beyond the information required under Article 13 or 14 GDPR, such as providing additional details about the collection criteria and all datasets used," and "media campaigns with different media outlets to inform data subjects, information campaign by email, use of graphic visualisation, frequently asked questions and annual transparency reports on a voluntary basis." On rights, the list offers an unconditional opt-out "from the outset," erasure even where the grounds in Article 17(1) do not apply, and "a reasonable period of time between the collection of personal data and their use, for instance in the context of direct marketing."

The board describes the list as "non-exhaustive and non-prescriptive." A footnote recalls that many measures that were optional under the old directive "are now legal obligations for the controller," and that whether a given measure is mandatory or goes further "will often depend on the concrete circumstances of the processing, the risk of the processing, the entirety of the measures implemented by the controller." Controllers that add such measures "should be able to demonstrate how this changes the outcome of the balancing test." If nothing suffices, "the processing cannot be based on Article 6(1)(f) GDPR."

The unconditional opt-out has a parallel in Brussels. A September 2026 Council compromise on the Digital Omnibus dropped the Commission's unconditional right to object from the proposed GDPR clause on AI development, while the EDPB keeps the same mechanism on its list of measures that can rescue a failing balancing test.

The necessity test did not soften either, despite IAB Europe's objection to the phrase "strictly necessary." Necessity "does not cover simply what is useful to pursue such an interest," and processing must be carried out "only in so far as is strictly necessary," according to paragraphs 25 and 26. If "reasonable, just as effective, but less intrusive alternatives" exist, the processing is not necessary. The test is tied to data minimisation under Article 5(1)(c), citing the Meta judgment and paragraphs 42 to 43 and 51 to 52 of the tennis federation ruling.

On data serving third parties, the final text is slightly less categorical than the draft. It says it "may generally be simpler" for a controller to show necessity for its own interests than for a third party's, and that third-party processing "may also be less expected by the data subjects." The draft stated both points as general rules, according to text quoted by IAB Europe.

On sensitive inferences, the board restates the CJEU's position in Meta that "a set of data that contains at least one special category data item is deemed special category data in its entirety," and that "the relevant question is whether it is objectively possible to infer special category information from the data processed, irrespective of any intention of actually doing so." That matters for behavioural segments built from browsing data, which can reveal health, religion or sexual orientation, all special category data under Article 9.

Objections, erasure and the higher bar

Chapter 3 explains how legitimate interest interacts with individual rights. The general right to object under Article 21(1) triggers a second, harder balancing exercise. "It is not sufficient for the controller to just demonstrate that its earlier legitimate interest assessment regarding that processing was correct," according to paragraph 72. Only "compelling" grounds count, "implying a higher threshold for overriding data subject objections." The board's example is a controller that must process data "to protect its organisation or systems from serious immediate harm or from a severe penalty which would seriously affect its business." By contrast, "showing that the processing would simply be beneficial or advantageous to the controller would not necessarily meet this threshold."

If an objection succeeds, "as a rule," a related erasure request "should also be granted." Requests do not need legal labels: the controller "cannot refuse to act on a data subject's request simply by referring to the lack of indication of the legal ground of the request."

On profiling, paragraph 81 lists factors for any balancing test, whether or not automated decisions follow: the level of detail of the profile, with "people with an interest in English literature" as an example of a broad cohort against granular segmentation; how comprehensive it is; its impact; "the possible future combination of profiles"; and safeguards for fairness, non-discrimination and accuracy. Article 6(1)(f), the board notes, "in itself, is not considered Union law authorising automated decision-making within the meaning of Article 22(2)(b) GDPR."

On transparency, people must be told that processing relies on Article 6(1)(f) and what the specific interest is. As "a matter of best practice," controllers can share information from the balancing test before collecting data, and it is "advisable to inform the data subjects that they can obtain information on the balancing test upon request." IAB Europe had asked the board to reconsider that passage.

Fraud, group sharing, security and the authorities

Chapter 4 covers contexts the GDPR names directly. On fraud prevention, Recital 47 refers to processing "strictly necessary for the purposes of preventing fraud," and the board warns that such processing "often affects not only data subjects who intend to commit fraud, but also data subjects who have no such intention." "A generic reference to 'combating fraud' in, for example, the privacy policy is not sufficient"; controllers "should be specific about the fraudulent activities they are trying to prevent." Storage limitation applies to retention of fraud data, and where the law requires fraud checks, Article 6(1)(c) is the appropriate basis.

For corporate groups, sending client data "from a local subsidiary's Customer Relationship Management (CRM) to a central corporate CRM for administrative purposes, such as global reporting or IT security, could be based on Article 6(1)(f) GDPR." Reasonable expectations depend on group structure: sharing is more expected in "a group of companies with one single brand" than in one "where the links are unknown to the average customer."

Network security processing can rely on legitimate interest, but deep packet inspection and similar analysis "may have a significant impact on the outcome of the balancing test," and "if the processing is not proportionate to the level of risk/sensitivity of the data, the balancing test is likely to be negative."

On law enforcement, the board repeats the CJEU's finding in Meta that sharing data with police "is not an objective that is capable of constituting a legitimate interest pursued by a private business operator whose activity is essentially economic and commercial in nature." Occasional reports of suspected crimes are different. Example 8 describes a company hit by a cyber attack sharing attacker IP addresses and online identifiers with cybercrime and cybersecurity authorities, which "could be based on Article 6(1)(f) GDPR" case by case. For requests from authorities outside the EU, the board recalls its 2019 joint response with the EDPS on the US CLOUD Act, which found that people's rights would override a controller's interest in avoiding foreign sanctions in those circumstances.

What did not change

The consultation responses that the EDPB published show what industry wanted and did not get. IAB Europe asked for the guidance to reflect what it called the parity of all legal bases, for "strictly necessary" to go, and for more positive examples, including product improvement and ePrivacy consent exemptions for ad spaces and audience measurement, according to its submission. FEDMA asked for a list of presumptively legitimate activities, a balancing-test template, guidance on acquiring new customers and recognition that transparency can shape expectations, according to its own submission.

The final text keeps strict necessity, keeps the position that common sector practice does not create reasonable expectations, keeps the tracking passage and contains no dedicated guidance on acquiring new customers. The only reference to prospects is a line noting that "a regular customer will have different reasonable expectations from a mere prospective customer who has only subscribed to a newsletter." Product improvement appears as a recognised interest, citing the Meta judgment, but Example 5 says users of an ad-funded social network cannot expect their data to be used even for that purpose without consent.

One question is left for later. A footnote states that "with regard to the scope of Article 10 GDPR, the EDPB plans to adopt an Opinion following a request made under Article 64(2) GDPR," covering data on criminal convictions and offences.

Why this matters for marketing

Regulators have tested the advertising industry's reliance on legitimate interest repeatedly. Ireland's Data Protection Commission fined LinkedIn €310 million on October 24, 2024, after an inquiry into the processing of members' data for behavioural analysis and targeted advertising, finding among other things improper reliance on legitimate interests for first-party data. In 2023, the EDPB ordered Meta to stop processing data for behavioural advertising on the basis of contract and legitimate interest across the EEA.

The guidelines themselves point to the evidence base. Footnote 3 refers to a case digest commissioned under the EDPB's Support Pool of Experts on one-stop-shop decisions concerning Article 6(1)(f). PPC Land reviewed that digest in March 2026: across 62 one-stop-shop decisions and five EDPB binding decisions between December 2018 and June 2025, most controllers failed the balancing test, with reasonable expectations the most common point of failure. The final guidelines put that same element at the centre of the direct marketing analysis.

The political context has moved too. The European Commission's Digital Omnibus would write a legitimate interest for AI development into the GDPR; drafts circulating in November 2025 described it as Article 88c. In February 2026, the EDPB and the EDPS called that provision unnecessary, since Opinion 28/2024 already accepted legitimate interest for AI. On October 21, 2026, EU ambassadors agreed the Council's negotiating mandate, including six cookie purposes that would need no consent; Parliament had not adopted a position at that point. Whatever the legislators decide, the November 10 text is, in the board's words, "the EDPB's adopted position concerning the processing of personal data based on Article 6(1)(f) GDPR."

For advertisers, the practical map the guidelines draw is narrow but clear. Cookie-based and cross-context tracking stays with consent. Profiling children for marketing generally fails. Email, SMS, RCS and messenger campaigns need consent unless the soft opt-in applies, in which case the ePrivacy rule alone is enough. A catalogue sent to past buyers of similar products is the board's own example of what can pass. Between those poles, the outcome depends on a documented test that most controllers in the board's own case digest failed.

Timeline

Summary

Who: The European Data Protection Board, the body of EU and EEA data protection authorities, chaired by Anu Talus. The guidelines address controllers relying on legitimate interest, including advertisers, publishers, ad tech companies, email and messaging marketers, fraud prevention providers and AI developers. IAB Europe and FEDMA were among the trade bodies that responded to the 2024 consultation.

What: Version 2.0 of Guidelines 1/2024 on processing personal data under Article 6(1)(f) GDPR, with a four-page assessment flowchart and a two-page summary. The final text says marketing that involves intrusive profiling or tracking across websites, locations, devices or services is very unlikely to pass the balancing test; covers all profiling of children for marketing rather than only extensive profiling; treats personalised advertising as direct marketing; lists RCS and messenger apps among channels needing prior consent; accepts the ePrivacy soft opt-in as a legal basis on its own; rules out legitimate interest for data the recipient knew or should have known was collected unlawfully; adds a section on AI; and drops data portability from its list of mitigating measures.

When: Adopted on November 10, 2026. The draft was adopted on October 8, 2024, and the consultation closed on November 20, 2024.

Where: The European Union and the European Economic Area, where national data protection authorities apply the GDPR. The ePrivacy rules discussed in the guidelines also depend on national implementing laws.

Why: The board says controllers must assess and document three cumulative conditions before relying on legitimate interest, and that the provision is neither a last resort nor a default. The final version brings the guidance in line with CJEU judgments issued since the draft, including Mousse, Inteligo Media and NTH Haustechnik. For the marketing sector, it points tracking-based and child-targeted advertising toward consent, while narrower uses of customer data remain open to a documented case-by-case test.