What is Legitimate Interest?

Legitimate interest is GDPR's flexible basis: no consent required, no contract needed, but a burden of justification instead. Reliance on it requires the three-part test regulators formalized as the Legitimate Interests Assessment (LIA). Purpose: is the interest real and lawful — fraud prevention, network security, direct marketing to existing customers, internal administration? Necessity: does achieving it genuinely require this processing, or would something less intrusive work? Balancing: do the individual's interests, rights, and reasonable expectations override — considering the relationship, the data's nature, and what the person would expect at collection?

Reasonable expectations do heavy lifting in the balance. GDPR's recitals note that direct marketing 'may be regarded as' a legitimate interest, and an existing customer plausibly expects the brand they bought from to email them (with an opt-out always available under Article 21's absolute objection right for marketing). A stranger being profiled across the web has no such expectation, which is why regulators and courts have rejected legitimate interest as a basis for third-party behavioral advertising — most prominently in EU decisions against Meta's ad processing.

The critical boundary for web tracking: legitimate interest cannot substitute for ePrivacy consent. Storing or reading cookies and similar identifiers requires consent under Article 5(3) of the ePrivacy Directive regardless of GDPR basis — 'we process analytics cookies under legitimate interest' is a category error that appears in many non-compliant banners, including TCF-based ones regulators have struck down.

Used honestly, legitimate interest requires paperwork: a written LIA before processing begins, disclosure of the interest in the privacy notice, and a working objection route. It is a justification you must be able to produce, not a label you apply.