Legitimate Interest vs Consent: The Essential 2026 Guide to Choosing Your Lawful Basis

Legitimate interest vs consent is the choice many organizations face when they need a lawful basis for processing personal data under the GDPR. Consent puts the person in control. Legitimate interest lets you process without asking, but only after you have weighed your needs against the person’s rights and can show the balance favors you.

Neither is better in general. Each fits different situations, and choosing the wrong one creates problems: consent that is not truly free is invalid, and a legitimate interest claim without a documented assessment will not stand up to a complaint.

This guide compares the two, explains when the law forces the choice for you, and shows how to record your decision. It is general information rather than legal advice, so check your national rules for edge cases.

How legitimate interest vs consent differ

Consent is an agreement. For it to be valid under the GDPR it must be freely given, specific, informed and unambiguous, and the person must be able to withdraw it as easily as they gave it. If the person cannot say no without penalty, the consent is not free.

Legitimate interest is a judgment. The organization identifies a real interest, shows the processing is necessary for it, and balances it against the person’s rights, freedoms and reasonable expectations. The text of the lawful bases is on the GDPR Article 6 text page, and the legitimate interest wording sits in Article 6(1)(f).

The practical difference is control and risk. Consent gives the individual control but can be withdrawn, leaving you without a basis. Legitimate interest gives you stability but puts the burden on you to justify the decision.

When to choose consent in the legitimate interest vs consent decision

Choose consent where the processing is optional and the person has a real choice. Examples include a newsletter for people who are not customers, sharing data with partners for their own marketing, and using sensitive data for a purpose beyond the service. Consent is also the natural basis where the processing is unexpected or intrusive.

Sometimes the law decides. Under the ePrivacy rules, storing or reading information on a device, such as most advertising and analytics cookies, generally needs consent, and the GDPR lawful basis cannot replace that. Email marketing to individuals often needs consent too, although some countries allow a soft opt-in for existing customers.

Special category data needs an Article 9 condition in addition to an Article 6 basis, and explicit consent is one of those conditions. Do not assume legitimate interest alone can cover health or biometric data.

Point	Consent	Legitimate interest
GDPR reference	Article 6(1)(a)	Article 6(1)(f)
Who decides	The individual	The organization, after a balancing test
Withdrawal	Anytime, as easily as given	Right to object under Article 21
Paperwork	Proof of valid consent	Documented legitimate interests assessment
Best fit	Optional, intrusive or ePrivacy-controlled uses	Expected, low-intrusion, necessary uses

When legitimate interest works better

Legitimate interest suits processing that people would expect and that has limited impact. Common cases are fraud prevention, network and information security, internal administration, direct B2B marketing in some contexts and debt recovery. Examples are covered in legitimate interests and fraud prevention, legitimate interests in B2B and legitimate interests in debt recovery.

It also fits situations where consent would not be free, such as employment, where an imbalance of power makes consent unreliable. Employers relying on legitimate interest must still be careful, as legitimate interests and employee monitoring explains.

Public authorities cannot rely on legitimate interest for tasks they perform as public authorities, so they need another basis such as a public task.

The three-part test for legitimate interest

Regulators describe a three-part test. First, the purpose: is there a legitimate interest, meaning lawful, clearly articulated and real, not speculative? Second, necessity: is the processing needed, and is there a less intrusive way to reach the same goal? Third, balancing: do the individual’s interests, rights and freedoms override yours, taking account of the nature of the data, their expectations and the safeguards you apply?

Write the result down. The record is called a legitimate interests assessment, and it should say what you decided and why. The method in the legitimate interests balancing test shows how to weigh the factors.

Factors that tip the balance include the sensitivity of the data, the age and vulnerability of the people, the scale of processing, whether the data is combined or profiled, and whether people would be surprised.

Rights and obligations that follow your choice

Your choice changes what people can do. With consent, people can withdraw at any time and you must stop processing for that purpose. With legitimate interest, people have the right to object under Article 21, and you must stop unless you can show compelling grounds that override their interests. For direct marketing the right to object is absolute.

Transparency is required either way. Your privacy notice must state the lawful basis for each purpose, and where you use legitimate interest it must describe the interest. Handling objections is covered in legitimate interests and the right to object.

Do not switch bases midstream. If consent was requested and withdrawn, you generally cannot fall back on legitimate interest for the same purpose, because that would make the original choice misleading.

Practical examples of legitimate interest vs consent

A retailer sending order updates to customers relies on contract, not either option. The same retailer emailing offers to past customers may use a soft opt-in where national law permits, or consent where it does not. A retailer building a profile to show personalized ads on third-party sites should seek consent, because the processing is intrusive and relies on cookies.

A software company analyzing product usage to fix bugs may use legitimate interest if the analysis is limited and expected, while tracking individual browsing behavior across sites would call for consent. A website using CCTV in its office might rely on legitimate interest, as legitimate interests and CCTV explains.

The examples are simplified and the answer depends on facts and local law. The exercise is to ask the same questions each time.

Documenting the legitimate interest vs consent decision

For each purpose, record the chosen basis, the reasoning and the date. If you rely on consent, keep evidence of who agreed, when, to what wording and how to withdraw. If you rely on legitimate interest, keep the completed assessment and review it when circumstances change.

Use a simple decision path: does another law, such as ePrivacy, require consent? If yes, use consent. Is the processing optional, unexpected or intrusive? Lean towards consent. Is it expected, necessary and low-impact? Test legitimate interest and document it.

The Legitimate Interests Assessment Report provides screening, purpose, necessity and balancing tests, safeguards and a live workbook, so you can complete the assessment in a consistent format. Whichever route you take, involve your privacy lead or counsel for contested cases.

A quick legitimate interest vs consent checklist

Before you pick a basis, run five quick checks. Does ePrivacy or another law require consent for this activity? Is the processing optional for the person? Would they expect it? Is there a less intrusive way to reach the same goal? Can you explain the decision in plain words in your privacy notice?

If the answers point in different directions, go with the more protective option and document why. The legitimate interest vs consent decision is not a one-time event, so set a review date and revisit it when you change the purpose, the data or the audience. Keep the record with the processing inventory, so the lawful basis, the evidence and the owner sit together and can be shown quickly to a regulator, a customer or an auditor.

When the legitimate interest vs consent answer changes

Revisit your choice whenever the facts move. A new data source, a new recipient, a change of audience to include children, or a switch from internal use to sharing with partners can all tip the balance towards consent. Regulators also update their guidance, and the European Data Protection Board has published guidelines on legitimate interest, so check for current positions.

Common mistakes in the legitimate interest vs consent choice

The first mistake is using consent when it is not truly free, for example bundling it with a service. The second is claiming legitimate interest without a written assessment. The third is ignoring ePrivacy rules that override the GDPR choice.

Others include forgetting to mention the interest in the privacy notice, failing to honor objections and treating the assessment as permanent rather than reviewing it when the processing changes. See also legitimate interests in B2C for consumer contexts where expectations are higher.

Ask the same question each time: would the person be surprised, and could I explain my choice to them in one paragraph?

Legitimate interest vs consent FAQ

Is legitimate interest or consent better?

Neither is better in general. Use consent for optional, intrusive or ePrivacy-controlled processing, and legitimate interest for expected, necessary, low-impact processing you can justify.

Can I switch from consent to legitimate interest?

Generally not for the same purpose. If you asked for consent and it was refused or withdrawn, falling back on legitimate interest would be misleading.

Do I need to document legitimate interest?

Yes. A written legitimate interests assessment showing the purpose, necessity and balancing is how you demonstrate accountability.

Does legitimate interest apply to marketing?

It can for some direct marketing, but ePrivacy rules often require consent for electronic marketing to individuals, so check national law.

Can public authorities use legitimate interest?

Not for tasks they perform as public authorities. They generally rely on a public task or legal obligation.