Legitimate Interests for B2C Marketing: 2026 Guide

Legitimate interests for B2C marketing is one of the most debated uses of the basis, because it sits where data protection law meets the rules on electronic marketing. Recital 47 of the GDPR says processing for direct marketing purposes may be regarded as carried out for a legitimate interest, yet that statement does not make every campaign lawful. The channel, the audience and the way people were told all matter.

This guide explains when legitimate interests can support consumer marketing, how the three-part test applies, where ePrivacy rules require consent instead and how to handle opt-outs and objections. It is general information, not legal advice, and national rules differ, so confirm your position with counsel.

Where legitimate interests fits in consumer marketing

The GDPR lets you rely on legitimate interests for marketing if you can show that the interest is real, the processing is needed and the impact on people does not override it. A company promoting its own products to people who already bought from it has a clear interest, and customers can reasonably expect some follow-up communication.

But the GDPR is only half of the picture. The ePrivacy rules, implemented differently in each country, control the channel. For electronic mail, SMS and calls, many jurisdictions require consent, with a narrow exception for existing customers. Legitimate interests can be the basis for the data protection side, but it does not remove the channel-specific requirement. Our overview of legitimate interests vs consent explains how the two interact.

Applying the three-part test to marketing

Start with the purpose: what do you want to achieve and why is it legitimate? Then necessity: is the processing needed for that aim, or could you reach your goal with less data? Finally balance: would a typical customer expect this, and would it harm or annoy them out of proportion?

Write it down using a structured record such as the one in our legitimate interests assessment example. Include the segments you target, the data used, the channel and the safeguards. A short assessment per campaign type is better than one vague statement covering everything.

Marketing activity	Usual position	Watch out for
Postal marketing to existing customers	Legitimate interests often workable	Clear opt-out and prompt suppression
Email or SMS to existing customers	Often a soft opt-in under national ePrivacy law	Similar products only, opt-out at collection and in every message
Email or SMS to prospects	Usually needs consent	Bought lists and scraped data
Online targeting with cookies or pixels	Consent for tracking under ePrivacy	Legitimate interests cannot replace consent for the tracking itself
Profiling for personalised offers	Depends on impact	May need a DPIA if intrusive

Channel rules that limit legitimate interests for B2C marketing

The safest way to think about channels is to check ePrivacy first. If the law requires consent for the channel, legitimate interests will not fix that. If the law allows a soft opt-in for existing customers, you must still meet its conditions: you obtained the contact details in the course of a sale, you market only similar products or services, and you gave a clear chance to opt out at collection and in each message.

Online advertising is a special case. Placing tracking technologies on a device generally needs consent under the ePrivacy rules, as covered in cookie consent. Legitimate interests cannot substitute for that consent, even if it supports later processing of the data collected.

• Postal mail: legitimate interests is often workable with an easy opt-out
• Email and SMS: check national rules and the soft opt-in conditions
• Telephone: check do-not-call lists and national rules
• Tracking pixels and cookies: consent is usually required

Consumer expectations and the balancing test

Ask what a reasonable customer would expect. Someone who bought running shoes probably expects an email about new running shoes, but not a message about insurance based on inferences from their browsing. The more surprising or invasive the use, the harder the balance becomes.

Consider the data involved. Basic contact and purchase history are low impact. Profiling that predicts health, financial difficulty or family status is high impact and may cross into special category data or require consent. Vulnerable people, such as children, need extra care, and marketing to them needs particular scrutiny.

Transparency: tell people up front

Your privacy notice must state that you use legitimate interests, describe the interest and explain the right to object to marketing. Give this information at the point of collection, not buried in a policy. Layered notices and just-in-time explanations work well.

Under Article 21(2) and (3), people have an absolute right to object to direct marketing, and you must stop when they do. That is different from other uses of legitimate interests, where you can sometimes continue if you have compelling grounds. Our guide to legitimate interests and the right to object covers this in detail.

Suppression lists for legitimate interests for B2C marketing

An opt-out only works if it is honoured everywhere. Keep a suppression list that records who opted out, and make sure every system and every agency respects it before each campaign. Process opt-outs immediately, or as close to immediately as your systems allow, and confirm them to the person.

Avoid making people log in, write a letter or jump through hoops to opt out. A one-click link and a simple reply address are the norm. Regulators regularly take action against organizations that keep marketing after an opt-out.

Profiling and segmentation under legitimate interests for B2C marketing

Segmentation by purchase history is common and usually low risk. More elaborate profiling, such as scoring customers by predicted spend or inferring life events, raises the impact and can trigger DPIA requirements. Consider whether the profiling produces legal or similarly significant effects; marketing rarely does, but pricing and eligibility decisions may.

If you profile, say so in the notice and give an easy way to object. Check the outputs for unfair or discriminatory patterns, especially when models use proxies for protected characteristics. See when a DPIA is required for the triggers.

Keeping records that stand up to review

Keep a simple file for each campaign type: the assessment, the data source, the channel rule relied on, the notice wording, the suppression check and the results. When a complaint arrives, this file lets you answer quickly and shows that the decision was considered. Review it whenever the audience, data or channel changes, and at least once a year.

Remember that legitimate interests for B2C marketing is a basis you must keep justifying, not a one-off decision, so record why it still applies at each review.

Train marketing staff and agencies on the basics too. Most problems with legitimate interests for B2C marketing come from people who never learned that the channel rules and the opt-out obligations apply to them.

Common mistakes

The usual errors are assuming legitimate interests removes the need for ePrivacy consent, relying on it for bought or scraped lists, having no written assessment, ignoring opt-outs across channels, using data collected for one purpose in a surprising way and failing to update the notice. Another is applying the same assessment to every campaign without checking whether the audience or data has changed.

Also watch for joint marketing with partners. If another company sends messages on your behalf or uses your data, roles and responsibilities must be clear and contracts in place. Refer to our legitimate interests examples for how other scenarios are assessed.

A short worked example

An online homeware retailer wants to email past customers about new ranges. It checks the ePrivacy position in its main markets, relies on the soft opt-in where it applies and obtains consent elsewhere. Its assessment records the interest, the limited data used and safeguards such as clear opt-out links, frequency limits and a shared suppression list.

It excludes customers who have complained, does not profile by sensitive categories and reviews open and unsubscribe rates each quarter. When a customer objects, the request is actioned within a day. The assessment is filed, dated and reviewed annually.

Getting a structured assessment

If you want a repeatable format for the three-part test and the safeguards you rely on, the Legitimate Interests Assessment Report and Workbook provides a report and workbook that follow the recognised structure, consistent with the ICO guidance on legitimate interests. Whatever tool you use, sound legitimate interests for B2C marketing depends on checking the channel first, documenting the balance and honouring objections without delay.

Legitimate interests for B2C marketing FAQ

Can we use legitimate interests for email marketing to consumers?

Sometimes. The data protection basis may be legitimate interests, but ePrivacy rules often require consent, with a limited soft opt-in for existing customers. Check the rules in each country.

Do people have to be able to opt out?

Yes. The right to object to direct marketing is absolute. You must stop when someone objects and make opting out easy.

Can we buy a marketing list and rely on legitimate interests?

This is high risk. The list must be lawfully obtained, people must be told and ePrivacy rules for the channel must be met. Many organizations avoid bought lists for electronic marketing.

Do we need a written assessment?

Yes. Recording the purpose, necessity and balance shows accountability and helps you review the position as campaigns change.

Does profiling change the analysis?

Yes. More intrusive profiling raises the impact on individuals, may need a DPIA and can require consent if it involves sensitive inferences.