Legitimate interest survives in GDPR, but behavioural advertising is running out of room

Tue, 13 Oct 2026 15:05:07 +0000

European law still permits businesses to process personal data without consent in defined circumstances, but enforcement and court rulings are sharply narrowing legitimate interest as a basis for behavioural advertising and cross-site profiling.

Legitimate interest sits at the centre of modern European data protection because it is the one lawful basis that allows a company to process personal data without first asking for permission, provided it can justify why the processing is needed and why the individual’s rights do not outweigh that need. Under the GDPR, it is meant to keep ordinary business functions workable, from fraud checks and security monitoring to postal marketing, while still imposing real accountability on the controller. In advertising, however, that flexibility has made it the most disputed legal ground in the regime.

The legal test is not open-ended. European case law and guidance require a controller to identify a genuine interest, show that the processing is necessary to achieve it, and then carry out a balancing exercise against the rights and freedoms of the person whose data is being used. Regulators have repeatedly stressed that this assessment must be documented before processing starts, usually in the form of a legitimate interest assessment, and that transparency is essential: the privacy notice must say what interest is being pursued. The individual also has a right to object, and in direct marketing that objection right is absolute.

For advertisers, the key limitation is that legitimate interest is not a substitute for consent everywhere in the stack. It cannot justify setting an advertising cookie on a device, because that is governed separately by the ePrivacy rules on storing or reading information on terminal equipment. Nor does it provide a free pass for cross-site profiling simply because the end goal is commercial. Regulators have consistently read Recital 47 narrowly once behavioural advertising is involved, even though the recital does acknowledge that direct marketing may, in principle, rely on legitimate interest.

The boundaries of the concept have been shaped by a long line of cases and guidance. The Court of Justice first set out the familiar three-part framework in Rigas satiksme, and later confirmed in a 2024 ruling that a commercial interest can qualify so long as it is lawful, sufficiently defined and not overridden by the data subject’s interests. That same year, the European Data Protection Board restated the test in updated guidance. Earlier case law had already rejected attempts by member states to add extra hurdles, while the Article 29 Working Party had insisted years ago that controllers must not treat legitimate interest as a last resort.

In practice, the debate has been sharpest in online advertising. IAB Europe’s Transparency and Consent Framework encodes legitimate interest as one of the signals in the consent string used by consent management platforms, but the signal only indicates that a vendor has declared the basis and the user has not objected; it does not mean a regulator has approved the processing. Later revisions to the framework narrowed the use of legitimate interest for some ad-tech purposes, reflecting the broader tightening of the regime. Google’s own implementation has continued to treat certain purposes as flexible, but not those most closely associated with personalised advertising.

Major enforcement actions show how risky the basis can be when used too broadly. Meta moved behavioural advertising in the EU to legitimate interest after its contractual-necessity argument was rejected, but regulators pushed back. Norway imposed a temporary ban, the European Data Protection Board later extended that restriction across the EEA, and the Court of Justice ruled that personalised advertising could not be justified on legitimate-interest grounds in the absence of consent where the users could not reasonably expect it. LinkedIn has also been fined for relying improperly on legitimate interests for behavioural analysis and targeted advertising, while a Madrid court recently ordered Meta to pay substantial damages to Spanish publishers over the competitive advantage it gained from an unlawful basis.

Even so, the basis remains available for narrower uses. Basic ad selection, measurement, fraud prevention and some forms of postal marketing are still routinely argued under legitimate interest, and recent guidance suggests the same logic may extend to some AI-related development activities if the assessment is properly done. That wider debate is now live in Brussels, where proposals have sought to clarify whether AI development and operation can rest on this ground, while some jurisdictions outside the EU are moving in different directions. The result is a legal basis that remains indispensable to day-to-day processing, but one whose use in advertising and profiling has become far more constrained than many businesses once assumed.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph: - Paragraph 1: ^[2], ^[4] - Paragraph 2: ^[2], ^[3], ^[7] - Paragraph 3: ^[1], ^[4] - Paragraph 4: ^[1], ^[3], ^[6] - Paragraph 5: ^[1] - Paragraph 6: ^[1], ^[5], ^[6] - Paragraph 7: ^[1], ^[3], ^[5]

Source: Noah Wire Services

How copyright complaints and fake death claims are being weaponised against journalists

Tue, 13 Oct 2026 08:09:29 +0000

A growing digital-suppression industry is exploiting copyright systems, platform rules and automated moderation to hide investigative reporting and silence journalists.

For many journalists, the mechanics of getting a story published are only part of the battle. A webinar hosted this week by the Global Investigative Journalist Network highlighted a more corrosive problem: bad actors are learning to exploit copyright complaints, platform reporting systems and automated moderation to push legitimate reporting out of view. The point is not simply to remove a story, but to make it harder to find, harder to share and, in some cases, impossible to keep online at all. That broader ecosystem is reflected in the services openly marketed by firms such as Clean Reputation and Erasiq, which promote content removal, suppression and platform-specific enforcement as routine parts of online reputation work.

The tactics described are often low-tech but effective. According to the webinar accounts, hostile actors may copy an investigation, paste it on a separate site or social account and backdate the material so it appears to pre-date the journalist’s original publication. Others dress up stolen material with altered audio or regional markers, then use that counterfeit version to persuade automated systems that the legitimate report is the infringing copy. Companies including WebTrep and The Reputation Management Company openly describe strategies built around formal removal requests, policy-based disputes and search-result suppression, showing how the wider reputation-management industry has normalised the language of takedown and visibility management.

The abuse is not limited to text and video. The webinar also described the misuse of Facebook’s memorialisation process, which can freeze an account after a user is declared dead. In the most serious cases, attackers are said to submit falsified death certificates to trigger that process and disable a journalist’s ability to post. Erasiq and Reputn both advertise discreet, confidential services aimed at removing posts, pages and other content across major platforms, which underlines how sophisticated the market for digital suppression has become. In practice, that means a tool designed for grief can be twisted into a weapon against speech.

A similar pattern appears on the web itself, where copyright complaints can be used to target entire investigative sites. Once hostile actors have cloned material and created a fake paper trail showing it elsewhere first, they can file bogus claims under the US Digital Millennium Copyright Act and seek removal from search results, even when the affected outlet is based outside the United States. Erase.com and similar firms present themselves as specialists in removing harmful articles, reviews and URLs, or in pushing unwanted material down the rankings when deletion is not possible. That commercial ecosystem helps explain why journalists now face not only political pressure and legal threats, but also industrialised forms of digital erasure.

The result is a chilling environment for investigative reporting. What looks like a routine moderation action can, in reality, be a coordinated effort to silence scrutiny and weaken the reach of public-interest journalism. The webinar’s message was that reporters and digital-rights advocates need to treat these attacks as a structural problem rather than isolated abuse: by tracing the networks behind them, pressing platforms to review claims with human oversight, and challenging a system that too often lets machines do the censoring for them.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph: - Paragraph 1: ^[2], ^[3] - Paragraph 2: ^[4], ^[5] - Paragraph 3: ^[3], ^[6], ^[7] - Paragraph 4: ^[4], ^[5], ^[7] - Paragraph 5: ^[2], ^[3], ^[6]

Source: Noah Wire Services

Tomorrow's Publisher 2 Policy & Rights

Legitimate interest survives in GDPR, but behavioural advertising is running out of room

Source Reference Map

How copyright complaints and fake death claims are being weaponised against journalists

Source Reference Map