Legitimate Interest vs Consent: Choosing the Right Legal Basis for Ads

Legal basis is the first decision in any GDPR compliance analysis, and marketing teams often default to whichever one seems most convenient rather than the one that actually fits the activity. This guide is a practical framework for choosing between the two bases that come up most often in marketing: consent and legitimate interest.

1. The two bases are not interchangeable

Consent and legitimate interest solve different problems, and switching between them retroactively (relying on legitimate interest because consent wasn't obtained, or vice versa) is a compliance red flag, not a fallback option. The choice has to be made deliberately, before processing starts, and documented.

2. When consent is the right (or only) basis

Consent is required, not just preferred, for:

• Cookie-based tracking and similar technologies, under the ePrivacy rules. This sits alongside GDPR and can't be replaced with legitimate interest. See the cookie consent guide.
• Marketing email and SMS to individuals, unless the "soft opt-in" in Article 13(2) of the ePrivacy Directive applies: existing customers, similar products, and an easy opt-out offered at collection and in every message.
• Special category data, or profiling with legal or similarly significant effects: this usually needs explicit consent (Articles 9(2)(a) and 22(2)(c)), because the other exceptions rarely fit advertising.

Consent's advantage is clarity: if properly obtained, it's hard to challenge. Its cost is friction: opt-in rates are lower than assumed reach, and consent has to be genuinely revocable at any time.

3. When legitimate interest can apply

GDPR Recital 47 explicitly names direct marketing as a potential legitimate interest, particularly relevant for:

• B2B outreach to existing business contacts, where the relationship creates a reasonable expectation of continued communication.
• Postal or other non-electronic direct marketing (email and SMS still follow the ePrivacy rules above, whatever GDPR legal basis you choose).
• Personalization based on a genuine existing customer relationship, where the individual would reasonably expect it and no tracking cookies are involved.

Legitimate interest is not a shortcut around consent requirements that exist for other reasons, like the cookie consent rule. It only ever answers the GDPR legal-basis question, never ePrivacy's separate consent requirement for tracking technology, so cookie-based retargeting always needs consent for the cookie itself.

Regulators and courts have also narrowed how far legitimate interest goes for ad targeting. In Meta v Bundeskartellamt (C-252/21, July 2023), the EU Court of Justice held that personalized advertising based on extensive tracking can't generally be justified by legitimate interest without the user's consent. In March 2026, Luxembourg's Administrative Court agreed that Amazon could not rely on legitimate interest for its cross-service ad profiling, while annulling the €746 million fine because the regulator had not assessed whether Amazon acted intentionally or negligently.

4. The three-part test behind "legitimate interest"

Relying on legitimate interest isn't just asserting it. Article 6(1)(f) and the EDPB's Guidelines 1/2024 on legitimate interest describe a three-part test:

• Purpose test: is there a genuine, specific, legitimate interest being pursued (not just "because it benefits us")?
• Necessity test: is this processing actually necessary to achieve that interest, and is there a less intrusive way to achieve the same goal?
• Balancing test: do the individual's interests, rights and reasonable expectations override your interest? This is where the individual's relationship to you, whether they'd reasonably expect this use, and the potential impact on them all get weighed.

5. Documenting a Legitimate Interest Assessment (LIA)

If you rely on legitimate interest, write the three-part test down: a short, specific document for each distinct processing activity, not a generic template reused unchanged across every campaign. A real LIA names the specific interest, explains why the processing is necessary, and honestly weighs the individual's perspective, including what would change the balance (for example, a much more sensitive data category, or a person who has never had a relationship with you). This document is what you'd need to produce if a regulator or the individual challenges your basis.

6. The right to object always applies

Unlike consent (which the individual grants or withholds up front), legitimate interest comes with a standing right to object at any time (Article 21), and for direct marketing specifically that objection must be honored absolutely, with no balancing test on your side. Your process needs a clear, easy opt-out mechanism, and honoring an objection has to actually stop the processing, not just log the request.

7. A practical decision framework

• Does the activity involve cookies or similar tracking technology, including retargeting pixels? → Consent for the tracking, no exceptions.
• Is it email or SMS marketing to someone outside the soft opt-in? → Consent.
• Is it B2B outreach to an existing business contact, non-electronic, or based on a genuine prior relationship with no tracking involved? → Legitimate interest may apply. Complete and document an LIA.
• Does it involve special category data or high-risk profiling? → Explicit consent (or another Article 9 condition), not legitimate interest.
• Whichever basis applies, is the opt-out or right-to-object mechanism actually easy to use and honored promptly?

This guide is general information, not legal advice. Legitimate interest is one of the most fact-specific areas of GDPR, so have a qualified data protection professional review your LIA before relying on it for anything with real scale or risk.

See how legal basis plays out on specific platforms in our articles on LinkedIn Ads and Facebook and Instagram ads.