Legitimate interest sits at the centre of modern European data protection because it is the one lawful basis that allows a company to process personal data without first asking for permission, provided it can justify why the processing is needed and why the individual’s rights do not outweigh that need. Under the GDPR, it is meant to keep ordinary business functions workable, from fraud checks and security monitoring to postal marketing, while still imposing real accountability on the controller. In advertising, however, that flexibility has made it the most disputed legal ground in the regime.

The legal test is not open-ended. European case law and guidance require a controller to identify a genuine interest, show that the processing is necessary to achieve it, and then carry out a balancing exercise against the rights and freedoms of the person whose data is being used. Regulators have repeatedly stressed that this assessment must be documented before processing starts, usually in the form of a legitimate interest assessment, and that transparency is essential: the privacy notice must say what interest is being pursued. The individual also has a right to object, and in direct marketing that objection right is absolute.

For advertisers, the key limitation is that legitimate interest is not a substitute for consent everywhere in the stack. It cannot justify setting an advertising cookie on a device, because that is governed separately by the ePrivacy rules on storing or reading information on terminal equipment. Nor does it provide a free pass for cross-site profiling simply because the end goal is commercial. Regulators have consistently read Recital 47 narrowly once behavioural advertising is involved, even though the recital does acknowledge that direct marketing may, in principle, rely on legitimate interest.

The boundaries of the concept have been shaped by a long line of cases and guidance. The Court of Justice first set out the familiar three-part framework in Rigas satiksme, and later confirmed in a 2024 ruling that a commercial interest can qualify so long as it is lawful, sufficiently defined and not overridden by the data subject’s interests. That same year, the European Data Protection Board restated the test in updated guidance. Earlier case law had already rejected attempts by member states to add extra hurdles, while the Article 29 Working Party had insisted years ago that controllers must not treat legitimate interest as a last resort.

In practice, the debate has been sharpest in online advertising. IAB Europe’s Transparency and Consent Framework encodes legitimate interest as one of the signals in the consent string used by consent management platforms, but the signal only indicates that a vendor has declared the basis and the user has not objected; it does not mean a regulator has approved the processing. Later revisions to the framework narrowed the use of legitimate interest for some ad-tech purposes, reflecting the broader tightening of the regime. Google’s own implementation has continued to treat certain purposes as flexible, but not those most closely associated with personalised advertising.

Major enforcement actions show how risky the basis can be when used too broadly. Meta moved behavioural advertising in the EU to legitimate interest after its contractual-necessity argument was rejected, but regulators pushed back. Norway imposed a temporary ban, the European Data Protection Board later extended that restriction across the EEA, and the Court of Justice ruled that personalised advertising could not be justified on legitimate-interest grounds in the absence of consent where the users could not reasonably expect it. LinkedIn has also been fined for relying improperly on legitimate interests for behavioural analysis and targeted advertising, while a Madrid court recently ordered Meta to pay substantial damages to Spanish publishers over the competitive advantage it gained from an unlawful basis.

Even so, the basis remains available for narrower uses. Basic ad selection, measurement, fraud prevention and some forms of postal marketing are still routinely argued under legitimate interest, and recent guidance suggests the same logic may extend to some AI-related development activities if the assessment is properly done. That wider debate is now live in Brussels, where proposals have sought to clarify whether AI development and operation can rest on this ground, while some jurisdictions outside the EU are moving in different directions. The result is a legal basis that remains indispensable to day-to-day processing, but one whose use in advertising and profiling has become far more constrained than many businesses once assumed.

Source Reference Map

Inspired by headline at: [1]

Sources by paragraph:

Source: Noah Wire Services