A legitimate interests assessment (LIA) is the written record a company produces to show that it may process personal data under Article 6(1)(f) of the General Data Protection Regulation (GDPR) without asking for consent. It answers three questions in a fixed order: is the interest legitimate, is the processing necessary to achieve it, and do the rights of the people affected override it. The document exists because the legitimate interests basis lets the company decide for itself. Nobody signs off in advance, so the assessment is the only evidence the judgement was made, and the first thing a regulator asks to see.

The UK Information Commissioner's Office (ICO) calls it "a type of light-touch risk assessment based on the specific context and circumstances of the processing."

The three tests

The Court of Justice of the European Union (CJEU) set out three cumulative conditions in Rigas satiksme (C-13/16) on May 4, 2017. The European Data Protection Board (EDPB) restated them in Guidelines 1/2024, adopted on October 8, 2024, and the UK uses the same skeleton.

The purpose test identifies the interest. According to the EDPB, it must be "lawful", "clearly and precisely articulated", and "real and present, and not speculative". The ICO's version runs to ten questions, from "Why do you want to process the data?" to "Are there any ethical issues with the processing?" Commercial interests can pass. On October 4, 2024, in a case involving the Royal Dutch Lawn Tennis Association (KNLTB, C-621/22), the CJEU held that selling member data to sponsors could be a legitimate interest if not contrary to law. The Dutch regulator had fined the association 525,000 euros.

The necessity test asks whether the aim can be achieved "just as effectively by other means less restrictive of the fundamental rights and freedoms", in the EDPB's words. The ICO asks whether the processing "could be seen as using a sledgehammer to crack a nut". In the tennis case the Court named asking members for consent as one less intrusive alternative, a recurring trap: where consent is realistic, necessity can fail.

The balancing test weighs the interest against the individual's rights. The ICO lists at a minimum the nature of the data, reasonable expectations and likely impact, and calls it "an objective test." Recital 47 says direct marketing "may be regarded as" a legitimate interest, but in Meta Platforms v Bundeskartellamt (C-252/21) on July 4, 2023, the CJEU found Facebook users could not reasonably expect personalised advertising without consent.

Safeguards can tip the balance, but the EDPB says they "must go beyond what is already necessary" under the GDPR, after which the balancing is performed "anew".

Who writes it and when

The controller owns it. The EDPB says the assessment "should be made at the outset of the processing, with the involvement of the Data Protection Officer (DPO) (if designated)" and documented under the accountability principle in Article 5(2). The ICO says it must precede processing and be kept "under regular review".

There is no prescribed format. The ICO publishes a sample Word template with a section for each test. IAB Europe's guide uses frequency capping as a worked example: a completed LIA would state the interest (limiting repeat exposures), list the identifiers read and their retention, test whether a less intrusive method would work, record what a site visitor would expect, and end with a decision, an owner and a review date.

When someone objects under Article 21, a second balancing applies. Processing stops unless the controller shows "compelling legitimate grounds", an assessment the EDPB says "needs to be duly documented". For direct marketing the objection is absolute.

Where it sits in the ad stack

IAB Europe's Transparency and Consent Framework (TCF) encodes the legal basis as consent and legitimate interest flags for each purpose and vendor. Declaring legitimate interest on the Global Vendor List proves little. According to IAB Europe's March 2021 guide, the TCF "requires companies declaring legitimate interests as their legal basis for particular processing purposes to attest that they have completed legitimate interest assessments for each purpose", while a declaration "should not be taken as an indication or guarantee" of lawfulness.

TCF v2.2 withdrew legitimate interest for purposes 3 to 6, the personalisation purposes, in May 2023. Google treats measurement and product development as flexible, defaulting to legitimate interest unless a publisher configures otherwise. TCF v2.3 added a mandatory disclosed vendors segment because legitimate interest vendors could not show users had seen them.

No LIA reaches the cookie itself. Article 5(3) of the ePrivacy Directive requires consent to store or read information on a device unless strictly necessary.

Origin and evolution

Article 7(f) of Data Protection Directive 95/46/EC, adopted on October 24, 1995, carried near-identical wording. The Article 29 Working Party's Opinion 06/2014 of April 9, 2014 set out a step-by-step balancing method and told controllers to document it.

The Data Protection Network (DPN) published guidance on July 10, 2017, with contributions from the Direct Marketing Association (DMA) and the Incorporated Society of British Advertisers (ISBA), including a template LIA. The ICO followed in March 2018 with its own guidance and sample template, two months before the GDPR applied on May 25, 2018.

Ad tech got its warning on June 20, 2019. The ICO's report on adtech and real-time bidding (RTB) found "the nature of the processing within RTB makes it impossible to meet the legitimate interests lawful basis requirements", adding that "legitimate interests cannot be used for the main bid request processing" and that participants "are unable to demonstrate that they have properly carried out the legitimate interests tests". IAB UK published LIA guidance on March 17, 2021, as part of its response, and IAB Europe released a guide developed with IAB UK on March 25, 2021.

Why it matters for marketers

The assessment is where enforcement starts. A digest written for the EDPB by TJ McIntyre, covering 67 decisions from December 2018 to June 2025, found controllers routinely running the balancing test after processing had begun. One Swedish decision held that a media company "cannot disclaim the responsibility" by pointing to its cookie supplier's recommendations.

Advertising cases show where tests fail. The EDPB banned Meta's behavioural advertising processing across the European Economic Area on October 27, 2023, citing "realistic, less intrusive alternatives". Ireland's Data Protection Commission (DPC) fined LinkedIn 310 million euros on October 24, 2024 for having inappropriately relied on legitimate interests for behavioural analysis and targeted advertising.

Italy's Garante fined Intesa Sanpaolo 17,628,000 euros in an order adopted on March 12, 2026, finding its balancing test amounted to a tautological statement that the processing served customers. Asked later for consent, only 76,000 of about 2.1 million customers agreed.

Limitations and disputes

Whether an LIA is mandatory is disputed. The ICO says "there is no obligation in the UK GDPR to do an LIA, but it is best practice", while IAB UK calls it "a legal requirement if you want to rely on legitimate interests". The EDPB ties documentation to accountability. Ecuador ended the ambiguity with a resolution signed on November 7, 2025 that requires a prior written balancing assessment, reviewed within a year.

Courts and regulators also disagree on the balance. On December 17, 2025 the Brussels Market Court annulled a Belgian reprimand over unsolicited postal health-screening offers, holding that absent expectations were "insufficient to ensure data subject interests automatically outweigh controller interests." A Dutch ruling of January 9, 2025 upheld findings that a village livestream failed necessity and balancing despite a legitimate promotional interest. PPC Land's report names an Amsterdam court; the cited case identifier points to Noord-Nederland.

The deeper criticism is self-assessment. The controller defines the interest, judges necessity and scores the balance, and affected people rarely see the result. A TCF attestation records that an LIA exists, not that it is sound.

Not the same as

Legitimate interest is the legal basis in Article 6(1)(f); the LIA is the evidence that it applies.

A data protection impact assessment (DPIA) under Article 35 is required for likely high-risk processing whatever the basis. According to the ICO, a DPIA "covers the same ground in more detail", making a separate LIA unnecessary, and an LIA that finds high risk is "a potential trigger for a DPIA."

The TCF legitimate interest signal records that a vendor declared the basis and the user did not object. It is not an assessment.

Recognised legitimate interests exist only in UK law. The Data (Use and Access) Act 2025, given Royal Assent on June 19, 2025, added Article 6(1)(ea), in force from February 5, 2026, for listed purposes such as crime prevention and safeguarding that need no balancing test.

Recent developments

The ICO revised its legitimate interests guidance on March 23, 2026, according to the DMA, calling the basis "the most flexible lawful basis". Its detailed "how do we apply" page still carried an under-review notice as of November 2026. EDPB Guidelines 1/2024 remain at version 1.0; consultation closed on November 20, 2024 and no final text had appeared by November 2026.

AI is now the main test case. EDPB Opinion 28/2024, adopted on December 17, 2024, applied the three-step test to model development. The Digital Omnibus would write legitimate interest for AI into the GDPR; the Council's compromise text of September 3, 2026 dropped the proposed unconditional right to object, and the Council agreed its mandate on October 21, 2026. The Garante's 2 million euro fine on contact data provider Lusha in July 2026 rejected its legitimate interest claim step by step.

Timeline

  • October 24, 1995: Data Protection Directive 95/46/EC adopted, with the balancing ground at Article 7(f)
  • April 9, 2014: Article 29 Working Party adopts Opinion 06/2014 on legitimate interests
  • April 27, 2016: GDPR adopted, carrying the ground into Article 6(1)(f)
  • May 4, 2017: CJEU sets out three cumulative conditions in Rigas satiksme (C-13/16)
  • July 10, 2017: Data Protection Network publishes legitimate interests guidance with a template LIA
  • March 2018: ICO publishes legitimate interests guidance and sample LIA template
  • May 25, 2018: GDPR becomes applicable
  • June 20, 2019: ICO adtech report says legitimate interests cannot be used for main bid request processing
  • March 17, 2021: IAB UK publishes LIA guidance for digital advertising
  • March 25, 2021: IAB Europe publishes its LIA guide for digital advertising
  • May 16, 2023: TCF v2.2 removes legitimate interest for purposes 3 to 6
  • July 4, 2023: CJEU judgment in Meta Platforms v Bundeskartellamt (C-252/21)
  • October 27, 2023: EDPB urgent binding decision bans Meta's behavioural advertising processing across the EEA
  • October 4, 2024: CJEU rules in the KNLTB case (C-621/22) that commercial interests can qualify
  • October 8, 2024: EDPB adopts Guidelines 1/2024 for consultation
  • October 24, 2024: DPC fines LinkedIn 310 million euros
  • November 20, 2024: Consultation on Guidelines 1/2024 closes
  • December 17, 2024: EDPB adopts Opinion 28/2024 on AI models
  • January 9, 2025: Dutch court upholds necessity and balancing failures in village livestream case
  • June 19, 2025: UK Data (Use and Access) Act receives Royal Assent
  • November 7, 2025: Ecuador's data protection superintendency signs mandatory written assessment rules
  • December 17, 2025: Brussels Market Court annuls Belgian direct marketing reprimand
  • February 5, 2026: UK recognised legitimate interests basis comes into force
  • March 12, 2026: Garante adopts Intesa Sanpaolo order
  • March 23, 2026: ICO revises legitimate interests guidance
  • September 3, 2026: EU Council compromise text drops unconditional objection right from the AI clause
  • October 21, 2026: EU Council agrees its Digital Omnibus mandate

Summary

Who. Data controllers write LIAs, ideally with their DPO, from advertisers and publishers to ad tech vendors registered in the TCF. Data protection authorities, the EDPB and the ICO set the method, the CJEU defines the tests, and courts review the results.

What. A documented three-part test of purpose, necessity and balancing that justifies processing personal data on legitimate interests under Article 6(1)(f) of the GDPR or UK GDPR, recording the interest, the alternatives considered, the safeguards and the outcome.

When. It must be done before processing starts and reviewed when circumstances change. The method traces to the 1995 Directive and Opinion 06/2014, the LIA template to UK guidance of 2017 and 2018, and the current EU method to EDPB Guidelines 1/2024.

Where. Across the European Economic Area and the UK, with mandatory written versions in Ecuador. In ad tech, its existence is attested through the TCF Global Vendor List, while the document itself stays with the controller.

Why. The legitimate interests basis lets a company decide for itself that its reasons outweigh individuals' rights, so the LIA is the only proof the decision was made properly. Regulators use it as the starting point of enforcement, and its weaknesses explain why behavioural advertising has largely moved to consent.