A lawful basis is the legal justification an organisation must have before it processes personal data. Under Article 6 of the General Data Protection Regulation (GDPR), processing is lawful "only if and to the extent that" at least one of six conditions applies: consent, contract, legal obligation, vital interests, public task or legitimate interests. It exists because European law treats data protection as a fundamental right, so personal data may not be used by default. Each basis is an exception with its own conditions. The UK Information Commissioner's Office (ICO) says "lawful basis"; the European Data Protection Board (EDPB) and the Court of Justice of the European Union (CJEU) say "legal basis". They mean the same thing.

How the six bases work

The bases are not ranked. The controller - the organisation deciding why and how data is processed - must pick one per purpose before processing begins. One retailer may use contract to deliver an order, legal obligation to keep tax records, legitimate interests for fraud screening and consent for ad targeting.

Consent, under Article 6(1)(a), must be freely given, specific, informed and unambiguous, expressed through a clear affirmative act. Article 7 adds that withdrawing it must be as easy as giving it, and that the controller must be able to prove it was obtained.

Contract, under Article 6(1)(b), covers processing necessary to perform a contract with the individual or to take steps at their request before entering one. The EDPB's Guidelines 2/2019, adopted on October 8, 2019, read "necessary" as objectively necessary for the core service, not merely written into the terms.

Legal obligation (Article 6(1)(c)) and public task (Article 6(1)(e)) must rest on a law of the EU or a member state, under Article 6(3). Vital interests (Article 6(1)(d)) covers life-or-death emergencies.

Legitimate interests, under Article 6(1)(f), allows processing for the controller's or a third party's interests unless they are overridden by the individual's rights. It requires a three-part test of interest, necessity and balancing, covered in PPC Land's explainer on legitimate interest.

The choice has consequences. The privacy notice must name the basis under Article 13(1)(c). The right to data portability applies only to consent and contract. The right to object attaches to legitimate interests and public task, and for direct marketing it is absolute. The EDPB's Guidelines 05/2020 on consent, adopted on May 4, 2020, state that a controller cannot swap to another basis after the fact to keep processing data once consent is refused or withdrawn. An Article 6 breach sits in the higher fine tier of Article 83(5): up to 20 million euros or 4% of worldwide turnover.

Two further layers sit beside Article 6. Special category data, such as health, political opinion or sexual orientation, also needs one of the conditions in Article 9(2), which for advertising usually means explicit consent. And where data is stored on or read from a device, Article 5(3) of the ePrivacy Directive applies first.

Where it sits in the ad stack

The ePrivacy rule is why consent dominates online advertising. Placing or reading a cookie, pixel or device identifier requires consent unless it is strictly necessary for a service the user asked for. The CJEU held in Planet49, on October 1, 2019, that a pre-ticked box is not valid consent. Only later processing can rest on a GDPR basis, as PPC Land's explainer on the ePrivacy Directive sets out.

In programmatic trading the basis travels as a signal. IAB Europe's Transparency and Consent Framework (TCF) encodes, in a string generated by a consent management platform (CMP), whether each vendor relies on consent or legitimate interests for each of its declared purposes. Purpose 1, storing or accessing information on a device, can only be consent. Since TCF v2.2 launched on May 16, 2023, purposes 3 to 6, which cover building and using profiles for personalised ads and content, can no longer be declared on legitimate interests. Google's registration, documented in PPC Land's coverage of the TCF v2.3 migration, relies on legitimate interests for basic ad selection and measurement unless publishers configure otherwise, while requiring consent for profiling purposes.

A TC string tells buyers which basis the CMP recorded. It does not prove the basis is valid.

Origin and evolution

The structure is older than the GDPR. Article 7 of Data Protection Directive 95/46/EC, adopted on October 24, 1995, listed six "criteria for making data processing legitimate" that map almost exactly onto today's list. The Charter of Fundamental Rights, binding since December 1, 2009, wrote the principle into Article 8(2): personal data must be processed "on the basis of the consent of the person concerned or some other legitimate basis laid down by law."

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, kept the six grounds but tightened consent, added the Article 6(4) compatibility test for reusing data for new purposes and made the basis a disclosure obligation.

For advertising, the years since 2018 have been a contest over which basis behavioural targeting can use. In May 2018 Meta made personalised ads part of its contract with users. The Irish Data Protection Commission (DPC), bound by EDPB decisions of December 5, 2022, fined Meta 390 million euros on January 4, 2023, ruling that Meta "is not entitled to rely on the 'contract' legal basis". Meta moved to legitimate interests on April 5, 2023.

The CJEU then closed that route. In Meta Platforms v Bundeskartellamt (C-252/21), decided on July 4, 2023, the Court held that personalised advertising could not justify the processing without consent. The case began with the German Federal Cartel Office's decision of February 6, 2019 against Facebook's combination of off-platform data, and the Court confirmed that a competition authority may assess GDPR compliance. Meta announced a shift to consent on August 1, 2023; on October 27, 2023 the EDPB ordered a ban on behavioural advertising based on contract or legitimate interests across the European Economic Area (EEA).

Why it matters for marketers

The basis decides how large an addressable audience is by default. Consent puts the decision with the individual, and consent rates under subscription alternatives became the next battleground. The EDPB's Opinion 08/2024, adopted on April 17, 2024, said large platforms offering only "consent or pay" will in most cases not obtain valid consent. The European Commission fined Meta 200 million euros under the Digital Markets Act (DMA) in April 2025, because Article 5(2) of that law requires consent before combining personal data across a gatekeeper's services. The subscription model itself, covered in PPC Land's explainer on pay or okay, grew from one phrase in the Bundeskartellamt judgment.

The financial exposure now extends beyond regulators. A Madrid court ordered Meta to pay 479 million euros to 87 Spanish publishers on November 19, 2025, treating its reliance on an invalid basis as an unfair competitive advantage. LinkedIn's 310 million euro fine from the DPC on October 24, 2024 rested partly on its reliance on legitimate interests for behavioural analysis and targeted advertising.

Limitations and disputes

Industry groups argue that consent has become a ritual of banners clicked through out of fatigue. Privacy advocates say the problem is design. In a report published on March 17, 2026, the European consumer organisation BEUC said Meta's model rolled out in January 2026 "still fails to offer consumers the possibility to give free, specific, informed and unambiguous consent", with Agustín Reyna saying that "Meta continues to roll out only minor adjustments rather than solve the problem once and for all."

Necessity is a second fault line, since contract and legitimate interests both turn on the word. And in October 2024 the CJEU held that data minimisation applies whatever the basis.

Enforcement is also split: the GDPR's one-stop-shop routes cross-border cases to a lead authority, often the DPC, while ePrivacy enforcement stays national.

Not the same as

Consent is one lawful basis, not a synonym for it.

An Article 9 condition is a second permission needed for special category data. It supplements a lawful basis and never replaces one.

ePrivacy consent governs access to a device. It is separate from the GDPR basis for later processing, though one banner usually collects both.

A transfer mechanism, such as standard contractual clauses or an adequacy decision, authorises sending data outside the EEA under Chapter V. It does not make the underlying processing lawful.

Recent developments

The United Kingdom has diverged. The Data (Use and Access) Act, given Royal Assent on June 19, 2025, inserted a seventh basis into the UK GDPR, recognised legitimate interests at Article 6(1)(ea), covering listed purposes such as crime prevention, safeguarding and emergencies without a balancing test. Most of the Act's data protection provisions commenced on February 5, 2026, according to the ICO, which published guidance on the new basis in June 2026. Direct marketing appears only as an example of an ordinary legitimate interest.

In the EU, the Digital Omnibus proposed on November 19, 2025 would move device access rules into the GDPR and add a provision confirming that artificial intelligence (AI) development may rest on legitimate interests. A Council compromise text of September 3, 2026 dropped the unconditional right to object from that AI clause. Member states agreed their negotiating mandate on October 21, 2026, including a four-month wait before a refused consent can be asked for again. As of November 2026, the European Parliament has no position, with a committee vote expected in the first quarter of 2027, according to TruePrivacy. Consent for third-party advertising cookies and profile-based targeting remains in the Council text.

Meta's 2026 DMA compliance report describes its January 2026 choice between fully personalised ads on consent and a less personalised option.

Timeline

  • October 24, 1995: Data Protection Directive 95/46/EC adopted, with six grounds in Article 7
  • December 7, 2000: Charter of Fundamental Rights proclaimed, Article 8(2) requiring consent or another legitimate basis
  • December 1, 2009: Charter becomes binding with the Lisbon Treaty
  • April 27, 2016: GDPR adopted
  • May 25, 2018: GDPR applies; Meta moves personalised ads to contractual necessity
  • February 6, 2019: Bundeskartellamt decision against Facebook's data combination
  • October 1, 2019: CJEU rules in Planet49 that pre-ticked boxes are not consent
  • October 8, 2019: EDPB adopts Guidelines 2/2019 on Article 6(1)(b)
  • May 4, 2020: EDPB adopts Guidelines 05/2020 on consent
  • January 1, 2021: UK GDPR takes effect
  • December 5, 2022: EDPB binding decisions on Meta's contract basis
  • January 4, 2023: DPC fines Meta 390 million euros
  • April 5, 2023: Meta switches to legitimate interests for behavioural ads
  • May 16, 2023: TCF v2.2 removes legitimate interests for profiling purposes
  • July 4, 2023: CJEU judgment in Meta Platforms v Bundeskartellamt (C-252/21)
  • October 27, 2023: EDPB urgent binding decision bans Meta's non-consent behavioural ads in the EEA
  • April 17, 2024: EDPB Opinion 08/2024 on consent or pay
  • October 10, 2024: Bundeskartellamt closes Facebook proceeding
  • October 24, 2024: DPC fines LinkedIn 310 million euros
  • April 2025: European Commission fines Meta 200 million euros under DMA Article 5(2)
  • June 19, 2025: UK Data (Use and Access) Act receives Royal Assent
  • November 19, 2025: Digital Omnibus proposed; Madrid court orders Meta to pay 479 million euros
  • January 2026: Meta rolls out revised consent choice in the EU
  • February 5, 2026: Most DUAA data protection provisions commence
  • March 17, 2026: BEUC says Meta's revised model remains unlawful
  • September 3, 2026: Council compromise text drops unconditional objection right from AI clause
  • October 21, 2026: Council agrees Digital Omnibus negotiating mandate

Summary

Who. Data controllers, from publishers and ad tech vendors to platforms such as Meta and LinkedIn, must choose and document a basis. National data protection authorities and the EDPB supervise the choice, the CJEU interprets it, and in the UK the ICO enforces its own version.

What. A lawful basis is one of six conditions in Article 6(1) of the GDPR (consent, contract, legal obligation, vital interests, public task, legitimate interests) at least one of which must apply before personal data can be processed. The chosen basis determines which rights individuals hold.

When. The six grounds date from Directive 95/46/EC in 1995 and carried into the GDPR, applicable since May 25, 2018. Between 2023 and 2025, regulators and courts pushed behavioural advertising onto consent. The UK added a seventh basis in force from February 5, 2026, and the EU's Digital Omnibus remains under negotiation as of November 2026.

Where. Across the EEA under the GDPR, in the UK under the UK GDPR as amended, and in ad tech through the consent and legitimate interest fields of the TCF string.

Why. EU law treats personal data processing as prohibited unless justified. The basis is that justification, and for advertising it decides whether data can be used by default or only with each person's agreement.