Legitimate interest is one of six legal bases the General Data Protection Regulation (GDPR) provides for processing personal data, and the only one that lets a company decide for itself, without asking anyone, that its reasons are good enough. Article 6(1)(f) permits processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject." It exists because routine data handling, from fraud screening to network security to mailing a catalogue, could not function if every step waited on a click. The price is accountability: the company, not the individual, makes the call and must be able to defend it. In advertising, that makes it the most contested ground in European data protection law.

The three-part test

The Court of Justice of the European Union (CJEU) set out three cumulative conditions in Rigas satiksme on May 4, 2017, and the European Data Protection Board (EDPB) restated them in Guidelines 1/2024, adopted on October 8, 2024.

The first is the interest, which must be lawful, clearly articulated and present rather than speculative. On October 4, 2024 the CJEU held that a purely commercial interest can qualify if it is not contrary to law, in a case over the Royal Dutch Lawn Tennis Association's sale of member data to a sports retailer and a lottery operator. The Dutch regulator had fined the association 525,000 euros.

The second is necessity: no less intrusive means would achieve the same end. In the tennis case, the Court named asking members for consent as one such alternative.

The third is the balancing test, weighing the interest against the individual's rights through the nature of the data, the scale of processing, the presence of children and, above all, what the person could reasonably expect. Recital 47 anchors that last factor and adds the sentence advertisers cite most: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." Regulators read it narrowly once cross-site profiling is involved.

The assessment, usually written up as a legitimate interest assessment (LIA), must be completed before processing starts, according to the EDPB, and the privacy notice must name the interest. Article 21 then gives individuals a right to object. The controller must stop unless it demonstrates "compelling legitimate grounds", and for direct marketing the right is absolute.

Article 5(3) of the ePrivacy Directive adds a limit from outside the GDPR: storing or reading information on a device requires consent unless strictly necessary for a requested service. Legitimate interest can never cover setting an advertising cookie, only what happens to the data afterwards.

Where it sits in the ad stack

Programmatic advertising carries the choice as a signal. IAB Europe's Transparency and Consent Framework (TCF) encodes it in a string produced by a consent management platform (CMP), with separate consent and legitimate interest fields for each purpose and vendor. Version 2.0, announced on August 21, 2019 and enforced from August 15, 2020, added the right-to-object signal, usually a toggle on a CMP's second screen.

Version 2.2, launched on May 16, 2023, withdrew legitimate interest for purposes 3 to 6, which cover building and using profiles for personalised ads and content. Google registers purposes 2 (basic ad selection), 7 (ad performance measurement), 9 (market research) and 10 (product development) as flexible, defaulting to legitimate interest unless a publisher configures otherwise, while requiring consent for purposes 1, 3 and 4.

Version 2.3 closed a gap specific to this basis. Vendors relying on legitimate interest could not tell whether a user had even seen them listed, so a mandatory disclosed vendors segment now records it. Google's migration deadline was February 28, 2026.

Origin and evolution

The concept predates the GDPR by two decades. Article 7(f) of Data Protection Directive 95/46/EC, adopted on October 24, 1995, used almost identical wording. In ASNEF, on November 24, 2011, the CJEU barred Spain from adding conditions such as requiring data to come from public sources. The Article 29 Working Party's Opinion 06/2014, adopted on April 9, 2014, rejected treating the ground as a last resort and told controllers to document their balancing.

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, kept the core text, excluded public authorities performing their tasks, added the direct marketing sentence to Recital 47 and hardened the objection right.

Case law then narrowed the ground for advertising. On July 4, 2023, in Meta Platforms v Bundeskartellamt (C-252/21), the CJEU accepted that direct marketing can in principle be a legitimate interest. It nonetheless held that personalised advertising "cannot justify, as a legitimate interest pursued by Meta Platforms Ireland, the processing of the data at issue, in the absence of the data subject's consent", according to the Court's press release. Facebook users, the Court reasoned, could not reasonably expect such processing without agreeing to it. A second ruling against Meta, on October 4, 2024, added that data minimisation applies whatever the legal basis.

Why it matters for marketers

The basis determines which audience signal is lawful by default, and Meta's experience set the template. After the Irish Data Protection Commission (DPC) rejected contractual necessity with fines totalling 390 million euros in January 2023, Meta moved behavioural advertising to legitimate interest on April 5, 2023. Norway's Datatilsynet answered with a temporary ban from August 4, 2023, backed by fines of up to 1 million Norwegian kroner a day. Meta had already announced a move to consent on August 1. On October 27, 2023 the EDPB ordered a ban on the processing across the European Economic Area (EEA), with chair Anu Talus saying "it is high time for Meta to bring its processing into compliance."

The choice carries commercial liability too. A Madrid court ordered Meta to pay 479 million euros to 87 Spanish publishers on November 19, 2025, finding that an unlawful basis had given the company an unfair competitive advantage.

Others hit the same wall. TikTok planned to move personalised ads to legitimate interest on July 13, 2022 and paused a day earlier after a warning from Italy's Garante. The DPC fined LinkedIn 310 million euros on October 24, 2024, finding it had inappropriately relied on legitimate interests for behavioural analysis and targeted advertising.

What remains on this basis is narrower: basic ad selection, measurement, fraud prevention and postal marketing. Email is tightening too, after France's CNIL recommended on March 12, 2026 that open-rate tracking and profiling in campaigns require prior consent.

Limitations and disputes

The basis fails most often in execution. A digest for the EDPB by TJ McIntyre, covering 67 decisions from December 2018 to June 2025, found controllers routinely running the balancing test after processing had begun, with reasonable expectations the most common failure point.

Italian decisions show the pattern. The Garante fined Intesa Sanpaolo 17.6 million euros in March 2026, calling the bank's profiling assessment "a tautological statement". When customers were later asked for consent, only 76,000 of about 2.1 million agreed. Contact data provider Lusha was fined 2 million euros on July 14, 2026, the authority holding that "an interest whose realisation requires a breach of national law cannot be legitimate."

Some companies avoid the basis entirely. Norway's regulator found in July 2026 that gym chain SATS had claimed contractual necessity for check-in photos because, in the company's own words, legitimate interest "would create...legal uncertainty, as data subjects would then be able to exercise their right to object."

The sharpest current dispute concerns artificial intelligence (AI). EDPB Opinion 28/2024, adopted in December 2024, accepted that model development can rest on legitimate interest, subject to the test. Meta began training on EU users' public content on May 27, 2025, after the Higher Regional Court of Cologne declined on May 23 to stop it. Privacy group noyb had sent a cease and desist letter on May 14, with chair Max Schrems arguing that "the law requires Meta to get opt-in consent, not to provide a hidden and misleading opt-out form." A noyb-commissioned survey of 1,000 German users found only 7% wanted their data used that way.

Not the same as

Consent, under Article 6(1)(a), is an opt-in the individual gives and can withdraw. Legitimate interest requires no action, only a chance to object.

Contractual necessity, under Article 6(1)(b), covers processing objectively required to deliver a requested service. The Meta decisions placed behavioural advertising outside it.

The TCF legitimate interest signal is a bit in a string recording that a vendor declared the basis and the user did not object. It is not a regulator's finding that the test was passed.

Recognised legitimate interests exist only in UK law. The Data (Use and Access) Act, given Royal Assent on June 19, 2025, created a basis with no balancing test for listed purposes such as public security. Direct marketing appears only as an example of an ordinary legitimate interest.

Recent developments

The Digital Omnibus, proposed by the European Commission on November 19, 2025, would add an Article 88c confirming that AI development and operation may rest on legitimate interest. The Council's compromise text of September 3, 2026, renumbering it Article 88bis, deleted the proposed unconditional right to object, while Germany had proposed that AI training be "presumed as a legitimate interest." Schrems called the draft "a digital expropriation of Europeans" as noyb published the documents on September 21.

Canada's Bill C-36, tabled on June 15, 2026, includes a legitimate interest exception that excludes use "to influence the individual's behaviour or decisions", keeping advertising out by design.

Timeline

  • October 24, 1995: Data Protection Directive 95/46/EC adopted, with legitimate interests at Article 7(f)
  • November 24, 2011: CJEU rules in ASNEF that member states cannot add conditions to the ground
  • April 9, 2014: Article 29 Working Party adopts Opinion 06/2014 on legitimate interests
  • April 27, 2016: GDPR adopted, carrying the basis into Article 6(1)(f)
  • May 4, 2017: CJEU sets out three cumulative conditions in Rigas satiksme
  • May 25, 2018: GDPR becomes applicable
  • August 21, 2019: IAB Europe announces TCF v2.0 with legitimate interest and right-to-object signals
  • August 15, 2020: TCF v2.0 switchover completed
  • February 2, 2022: Belgian data protection authority fines IAB Europe 250,000 euros and orders changes to legitimate interest use in the TCF
  • July 12, 2022: TikTok pauses plan to move personalised ads to legitimate interest
  • January 2023: Irish DPC fines Meta 390 million euros over contractual necessity for advertising
  • April 5, 2023: Meta moves behavioural advertising in the EU to legitimate interest
  • May 16, 2023: TCF v2.2 removes legitimate interest for purposes 3 to 6
  • July 4, 2023: CJEU judgment in Meta Platforms v Bundeskartellamt (C-252/21)
  • August 4, 2023: Norway's temporary ban on Meta behavioural advertising takes effect
  • October 27, 2023: EDPB urgent binding decision extends the ban across the EEA
  • October 4, 2024: CJEU confirms commercial interests can qualify, in the Royal Dutch Lawn Tennis Association case (C-621/22)
  • October 8, 2024: EDPB adopts Guidelines 1/2024 on Article 6(1)(f)
  • October 24, 2024: DPC fines LinkedIn 310 million euros
  • December 2024: EDPB adopts Opinion 28/2024 on AI models
  • May 27, 2025: Meta begins AI training on EU user data under legitimate interest
  • June 19, 2025: UK Data (Use and Access) Act receives Royal Assent
  • November 19, 2025: European Commission proposes the Digital Omnibus; Madrid court orders Meta to pay 479 million euros to Spanish publishers
  • February 28, 2026: Google's TCF v2.3 migration deadline
  • March 12, 2026: CNIL recommends consent for email open-rate tracking; Garante order fining Intesa Sanpaolo 17.6 million euros
  • June 15, 2026: Canada's Bill C-36 receives first reading
  • July 14, 2026: Garante fines Lusha 2 million euros
  • September 3, 2026: EU Council compromise text drops the unconditional right to object from the AI clause

Summary

Who. Data controllers invoke the basis, from platforms such as Meta and LinkedIn to banks, data brokers and ad tech vendors registered in the TCF. National data protection authorities and the EDPB supervise its use, the CJEU interprets it, and individuals hold the right to object.

What. A legal basis under Article 6(1)(f) of the GDPR allowing personal data to be processed without consent where the processing is necessary for a lawful interest and that interest is not overridden by the individual's rights. It requires a documented three-part assessment, transparency about the interest pursued and respect for objections.

When. It first appeared in Directive 95/46/EC in 1995 and carried into the GDPR, applicable since May 25, 2018. Its scope for advertising narrowed sharply between 2022 and 2024 through regulatory decisions, TCF v2.2 and CJEU rulings, while the Digital Omnibus negotiations in 2025 and 2026 turned it toward AI.

Where. Across the European Economic Area, with a modified version in UK law and a restricted variant proposed in Canada. In advertising, it lives in the TC string's legitimate interest fields and the right-to-object controls of CMPs.

Why. It exists so that necessary processing does not depend on individual permission, but the flexibility makes it attractive for purposes users would refuse if asked. Whether behavioural advertising, customer profiling and AI training can rest on it determines how much data the industry can use by default in Europe.