Purpose limitation is the principle that personal data may be collected only for purposes stated in advance, and may not later be put to uses that are incompatible with those purposes. It is written into Article 5(1)(b) of the General Data Protection Regulation (GDPR), which requires data to be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes." It exists because data, once held, is cheap to reuse: a support chat can become training material, a loyalty card history an advertising segment. The principle forces the organisation holding the data to decide at the outset what it is for, tell people, and stay within those bounds or justify the step outside them.

Two building blocks

The Article 29 Working Party (WP29), the forerunner of today's European Data Protection Board (EDPB), split the principle into two parts in Opinion 03/2013 (WP 203), adopted on April 2, 2013. The first is purpose specification: data must be collected for "specified, explicit and legitimate" purposes. The second is compatible use: data must not be "further processed in a way incompatible" with those purposes.

Each of the three adjectives does separate work. According to the opinion, a purpose is specified when it is "sufficiently defined to enable the implementation of any necessary data protection safeguards, and to delimit the scope of the processing operation." It is explicit when it is "sufficiently unambiguous and clearly expressed." It is legitimate in a sense that "goes beyond the requirement to have a legal ground" and extends to other areas of law. A purpose described only as "future research" typically fails the first test.

Article 5(1)(b) contains one built-in exception. Further processing for archiving in the public interest, scientific or historical research, or statistical purposes is "not considered to be incompatible with the initial purposes", provided the safeguards in Article 89(1), such as pseudonymisation, are in place.

How the compatibility test works

Most commercial disputes turn on the second building block, and on Article 6(4). It applies when a controller - the organisation that decides why and how data is processed - wants to use data for a new purpose without fresh consent and without a specific legal mandate. The controller must weigh, "inter alia", five factors:

  • any link between the original purpose and the new one
  • the context of collection, "in particular regarding the relationship between data subjects and the controller"
  • the nature of the data, especially special categories such as health data, or criminal records
  • the possible consequences of the new processing for the people concerned
  • the existence of safeguards, "which may include encryption or pseudonymisation"

Recital 50 adds the factor that does most of the work in practice: "the reasonable expectations of data subjects based on their relationship with the controller as to their further use." The WP29 opinion put it more bluntly. The more unexpected or surprising the further use, the more likely it is to be incompatible.

Two routes skip the test entirely: fresh consent, or a European Union or member state law serving an objective listed in Article 23(1), such as national security.

The Court of Justice of the European Union (CJEU) applied the test for the first time in detail in Digi Távközlési (C-77/21) on October 20, 2022. Hungarian telecoms company Digi had copied about a third of its customers' data into a test database after a server fault, then left it there for around 18 months. The court held that copying data into a new database "constitutes 'further processing'", that any processing after collection counts as further processing "regardless of the purpose", and that a test database could be compatible with the original purpose under the Article 6(4) criteria.

Where it bites in advertising

The Transparency and Consent Framework (TCF) run by IAB Europe is effectively a purpose specification system. Its standardised purposes, such as building a personalised advertising profile, are encoded in the TC string so that each vendor in a bid stream can see which uses a user permitted.

Combining data across services is the second pressure point. In Meta Platforms v Bundeskartellamt (C-252/21), decided on July 4, 2023, the Grand Chamber restated the purpose principle and found that combining data from other Meta services with Facebook data did not appear necessary for providing the social network. In Schrems v Meta (C-446/21) on October 4, 2024, the court ruled under the neighbouring data minimisation principle that Meta could not use all personal data for targeted advertising without limits on time or data type.

The Criteo case shows how regulators read purpose descriptions. The French Commission nationale de l'informatique et des libertés (CNIL) fined the retargeting company EUR 40 million in June 2023, and France's Conseil d'État upheld the fine on March 4, 2026. Users had been told their data served personalised advertising. They had not been told it would also be used to configure and improve Criteo's targeting algorithms, which the decision treated as a distinct purpose requiring its own disclosure.

AI training as further processing

Most data now proposed for training generative artificial intelligence (AI) models was collected for something else: posts written for friends, emails, customer service logs.

The EDPB's Opinion 28/2024 on AI models, adopted on December 17, 2024, distinguished the development of a model from its deployment and said whether they constitute "separate purposes" must be assessed case by case. It explicitly left Article 6(4) compatibility outside its scope, saying the provision "may be relevant" and its applicability "should be assessed" by national supervisory authorities. The EDPB's Guidelines 03/2026 on web scraping for generative AI, adopted on July 7, 2026, list purpose limitation among the principles requiring "particular attention" and, according to the EDPB's October summary, allow some processing to avoid bias and errors only when "clearly and specifically identified within the purpose." Consultation closed on October 30, 2026.

Platforms have mostly chosen to avoid the compatibility argument by relying on a fresh legal basis. Meta began training on EU user content on May 27, 2025 under legitimate interest, after a Cologne court declined to block it. Google's privacy policy dated October 16, 2026 now says content from Gmail and Photos may shape ads and train generative models when users connect those services to Search, reversing a 2021 pledge that "We don't show you personalized ads based on your content from Drive, Gmail, or Photos."

Limitations and open disputes

The most persistent argument concerns Recital 50, which states that where further processing is compatible, "no legal basis separate from that which allowed the collection of the personal data is required." Some commentators read this as a free pass for compatible reuse. Others, following WP29's 2013 position that a controller "cannot legitimise incompatible processing by simply relying on a new legal ground", insist that compatibility and lawfulness are separate tests and both must be met. The text of Article 6(4) does not settle it. The United Kingdom has, for its own regime: section 71 of the Data (Use and Access) Act 2025, in force from February 5, 2026, inserts a rule that processing "is not lawful by virtue only of" being compatible.

Critics also point to vagueness. Five non-exhaustive factors weighed by the controller itself produce uneven outcomes, and enforcement is rare. Broad purpose statements such as "product improvement" can defeat the principle at the source, and the Criteo ruling remains one of few decisions that turned on the wording of a purpose. From the other direction, industry groups and some member states argue the principle blocks secondary use of data for research and AI.

Commonly confused terms

Data minimisation (Article 5(1)(c)) limits how much data is collected relative to a purpose. Purpose limitation limits what the data is used for. A company can collect exactly the minimum and still misuse it.

Lawful basis (Article 6(1)) is the legal ground for processing, such as consent, contract or legitimate interest. Purpose limitation applies whatever basis is used.

Use limitation, the term in the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines and in many US privacy frameworks, overlaps heavily but lacks the GDPR's formal compatibility test.

Recent developments

The Digital Omnibus, proposed by the European Commission on November 19, 2025, would change how research reuse is treated. Article 5(1)(b) would move from saying such processing is "not considered incompatible" to treating it as compatible independently of Article 6(4), and a new Article 4(38) would define scientific research for the first time, including commercial research. The EDPB and the European Data Protection Supervisor (EDPS) supported the research clarification in a February 10, 2026 joint opinion.

The Council of the EU agreed its negotiating mandate on October 21, 2026. According to an analysis of Council document 14756/26 published on the EU Internet Policy blog, the mandate keeps the Article 5(1)(b) change but makes it "subject to the application of appropriate safeguards", and tightens the research definition. The Council's revised cookie rules also embed purpose limits, listing six purposes that would need no consent while stating such data "shall not be processed for another purpose", as PPC Land reported on October 25. As of late October 2026, the European Parliament had not adopted its position and trilogue talks had not begun.

Elsewhere, the CJEU is considering in case C-804/25 whether the purposes behind the transfer of European banking data to US tax authorities under the Foreign Account Tax Compliance Act (FATCA) are too vague to meet Article 5(1)(b). Meta's revised commercial terms, delayed to November 20, 2026, name a purpose of "advertising and business products" for publisher content, a reminder that the breadth of a stated purpose is now the commercial battleground.

Timeline

  • September 23, 1980: OECD adopts its Privacy Guidelines, including purpose specification and use limitation principles
  • January 28, 1981: Council of Europe Convention 108 opens for signature, barring use of data in a way incompatible with specified purposes
  • October 24, 1995: Directive 95/46/EC adopted; Article 6(1)(b) sets the "specified, explicit and legitimate" formula
  • December 7, 2000: EU Charter of Fundamental Rights proclaimed; Article 8(2) requires processing "for specified purposes"
  • January 25, 2012: European Commission proposes the GDPR
  • April 2, 2013: WP29 adopts Opinion 03/2013 on purpose limitation and recommends deleting the draft Article 6(4)
  • April 27, 2016: GDPR adopted with Article 5(1)(b) and a rewritten Article 6(4)
  • May 25, 2018: GDPR becomes applicable
  • October 20, 2022: CJEU rules in Digi Távközlési (C-77/21) on further processing in a test database
  • June 2023: CNIL fines Criteo EUR 40 million
  • July 4, 2023: CJEU judgment in Meta v Bundeskartellamt (C-252/21)
  • October 4, 2024: CJEU judgment in Schrems v Meta (C-446/21)
  • December 17, 2024: EDPB adopts Opinion 28/2024 on AI models, leaving Article 6(4) to national authorities
  • May 27, 2025: Meta begins training AI on EU user content under legitimate interest
  • June 19, 2025: UK Data (Use and Access) Act receives Royal Assent
  • November 19, 2025: Commission proposes the Digital Omnibus
  • February 5, 2026: UK section 71 changes to purpose limitation take effect
  • February 10, 2026: EDPB-EDPS joint opinion on the Digital Omnibus
  • March 4, 2026: Conseil d'État upholds the Criteo fine
  • July 7, 2026: EDPB adopts Guidelines 03/2026 on web scraping for generative AI
  • October 16, 2026: Google privacy policy allows connected Gmail and Photos data to shape ads
  • October 21, 2026: Council agrees its Digital Omnibus mandate
  • October 30, 2026: EDPB web scraping consultation closes
  • November 20, 2026: Meta's revised commercial terms take effect

Summary

Who. Data controllers, from publishers and ad tech vendors to platforms training AI models, must apply the principle. National data protection authorities and the EDPB supervise it, the CJEU interprets it, and EU legislators are now amending it through the Digital Omnibus.

What. A GDPR principle requiring personal data to be collected for specified, explicit and legitimate purposes and not further processed in an incompatible way. Reuse for a new purpose without consent or a legal mandate must pass a five-factor compatibility test in Article 6(4).

When. The idea dates to the 1980 OECD Guidelines and 1981 Convention 108, entered EU law in 1995 and took its current form when the GDPR applied on May 25, 2018. The CJEU's first detailed reading came in October 2022, and Omnibus negotiations on research reuse continued as of November 2026.

Where. Across the European Economic Area, with a modified version in UK law since February 2026. In advertising, it is expressed through the purposes declared in privacy notices and encoded in TCF consent signals.

Why. It prevents data gathered for one reason from quietly serving another. As advertising and AI businesses seek to reuse data across services and into model training, the breadth of a declared purpose increasingly determines what the industry is allowed to do with data it already holds.