Consent vs Legitimate Interests Under the GDPR
Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Consent under Article 6(1)(a) is the individual's own freely given, specific, informed and unambiguous agreement, which they can withdraw at any time and as easily as they gave it. Legitimate interests under Article 6(1)(f) is a controller-side judgement: the processing must be necessary for an interest of the controller or a third party, and that interest must not be overridden by the individual's interests, rights and freedoms. Consent hands control to the individual but collapses if the choice is not genuinely free; legitimate interests keeps control with the controller but demands a documented three-part assessment and gives the individual a right to object. Neither basis is inherently better, and you must choose before processing starts - you cannot fall back on the other one when the first fails.
Consent vs legitimate interests at a glance
| Feature | Consent - Art 6(1)(a) | Legitimate interests - Art 6(1)(f) |
|---|---|---|
| Who makes the decision | The data subject | The controller |
| Test to satisfy | Freely given, specific, informed, unambiguous; by a statement or clear affirmative action | Purpose test, necessity test, balancing test |
| Evidence needed | Records demonstrating consent was given (Art 7(1)) | A documented assessment; the interest must also be disclosed in the notice |
| How it ends | Withdrawal at any time, as easy as giving it (Art 7(3)) | Right to object on grounds relating to the person's situation (Art 21(1)) |
| Direct marketing | Often required by ePrivacy for electronic mail | Recognised as a possible legitimate interest (Recital 47), but the objection right is absolute (Art 21(2)-(3)) |
| Public authorities | Available, but imbalance makes it fragile | Not available for processing in the performance of their tasks |
| Special category data | Explicit consent can satisfy Art 9(2)(a) | Not an Article 9 condition - a separate condition is still needed |
| Effect of failure | Processing has no lawful basis from the outset | Processing has no lawful basis from the outset |
When can you not rely on legitimate interests?
Legitimate interests is the most flexible basis, which is exactly why the GDPR fences it in.
- Public authorities cannot use it for processing carried out in the performance of their tasks - the final subparagraph of Article 6(1) removes it. They can still use it for activities outside those tasks.
- Special category data needs an Article 9(2) condition on top of the Article 6 basis, and legitimate interests is not one of them. See special-category data.
- Cookies and similar technologies: where Article 5(3) of the ePrivacy Directive requires consent to store or access information on a device, legitimate interests cannot replace that consent for the storage and access step, whatever basis you use for the later processing.
- Solely automated decisions with legal or similarly significant effects under Article 22 require explicit consent, contractual necessity or authorisation in Union or member state law - legitimate interests is not available.
- Children: Recital 38 flags children as deserving specific protection, which weighs heavily in the balancing test, particularly for marketing and profiling.
What makes consent invalid?
Article 4(11) sets four conditions and Article 7 adds the operational rules. Consent fails most often on 'freely given'.
- Bundling and conditionality - Article 7(4) says you must take utmost account of whether performance of a contract is made conditional on consent to processing that is not necessary for that contract.
- Imbalance of power - Recital 43 says consent is presumed not to be freely given where there is a clear imbalance, notably where the controller is a public authority. The same reasoning makes employee consent unreliable.
- Silence, inactivity or pre-ticked boxes - confirmed as invalid by the CJEU in Planet49 (C-673/17), which also held that the consent requirement applies whether or not the information stored on the device is personal data.
- Vagueness - consent must be specific to each purpose, so a single tick covering analytics, advertising and profiling is not specific.
- Friction on withdrawal - Article 7(3) requires withdrawal to be as easy as giving consent, which is why a one-click 'accept' next to a three-click 'reject' attracts enforcement.
The controller must be able to demonstrate consent was obtained (Article 7(1)), so an unevidenced consent is functionally no consent.
How do you run and document a legitimate interests assessment?
The three-part test is not set out in Article 6(1)(f) as a numbered list, but it is the structure regulators and the EDPB use, and it is the structure examiners expect.
- Purpose test - identify a real, present and lawful interest. It can be your own interest or a third party's, and commercial interests count.
- Necessity test - the processing must be necessary for that interest, meaning there is no less intrusive way to achieve it. 'Useful' is not 'necessary'.
- Balancing test - weigh the interest against the individual's interests, rights and freedoms, taking account of the relationship between you and their reasonable expectations (Recital 47), the sensitivity of the data, the intrusiveness of the processing and the safeguards you apply.
Safeguards move the balance: pseudonymisation, tight retention, granular transparency and a straightforward opt-out can rescue an assessment that would otherwise tip against you. Record the assessment, and remember that Articles 13(1)(d) and 14(2)(b) require you to tell people which legitimate interests you are pursuing - a legitimate interest you have not disclosed is hard to defend.
The full working is in the notes on legitimate interests and the balancing test.
Related study notes
- Consent vs legitimate interests - choosing correctly
- Consent - definition and the four conditions
- Legitimate interests & the balancing test
- Freely given consent - bundling, imbalance, cookie walls
- Module 4 · The six Article 6 lawful bases
Frequently asked questions
Can you switch to legitimate interests when someone withdraws consent?
No. The lawful basis must be identified before processing begins and disclosed in the privacy notice. Swapping to legitimate interests after a withdrawal would make the promised right to withdraw meaningless, and regulators treat it as unfair processing. If consent is genuinely the wrong basis, stop, reassess, tell people and start again on the correct footing.
Is consent always needed for marketing emails?
Not always for the GDPR basis, but usually for the sending. Recital 47 accepts that direct marketing may be a legitimate interest under the GDPR, while Article 13 of the ePrivacy Directive separately requires prior consent for unsolicited electronic mail unless the soft opt-in applies to an existing customer for similar products or services.
Does legitimate interests work for special category data?
No. Article 6 and Article 9 operate as two separate gates. You still need an Article 6 basis, which can be legitimate interests, but you also need one of the Article 9(2) conditions - typically explicit consent, employment or social security law, or a substantial public interest laid down in law.
Which basis is stronger if you are audited?
The one you can evidence. Consent is strong if you hold clean, granular, timestamped records and an easy withdrawal route; legitimate interests is strong if you hold a written assessment that shows genuine necessity, real safeguards and a considered balance. Both fail in exactly the same way, which is an assertion with nothing behind it.
Test yourself
Try the free CIPP/E practice questions, or read the full CIPP/E study guide - free.