Glossary
Legitimate interest
Published · Last updated
Next scheduled review:
Legitimate interest is a legal basis under GDPR Article 6(1)(f) that allows processing needed for a legitimate interest of the controller or a third party, unless the individual's rights override it.
It is one of six legal bases in Article 6(1), and point (f) sets three conditions. The interest must be legitimate, the processing must be necessary for it, and a balancing test must show that the individual's rights do not override it (GDPR, EUR-Lex). The European Data Protection Board (EDPB) explained how to apply each step in its Guidelines 1/2024, which were open for public comment until 20 November 2024 (EDPB, 2024).
In advertising the basis has narrowed. Since TCF v2.2 became mandatory on 20 November 2023, vendors in the IAB Europe framework can choose only consent, not legitimate interest, for purposes 3 to 6 (IAB Europe, TCF v2.2). Those purposes cover building and using profiles for personalised ads and content. In Meta v Bundeskartellamt (C-252/21, 4 July 2023), the CJEU read the Article 6(1) bases narrowly. Within the TCF, legitimate interest remains available for some other purposes, such as measurement, subject to the balancing test and publisher restrictions.
Cookie rules are separate. Storing or reading information on a device falls under the ePrivacy Directive, which generally requires consent unless the access is strictly necessary, whatever basis covers the later processing.
Example: A publisher's CMP lists a measurement vendor under legitimate interest for purpose 7, measuring ad performance. The vendor may process data for that purpose unless the user objects. It may not rely on legitimate interest to build an ad profile under purpose 3.
Related terms: TCF, CMP, consent string, joint controller, data processing agreement.