Legitimate interest
Legitimate interest is the legal basis in Article 6(1)(f) of the GDPR that allows processing necessary for a controller's or third party's interests, unless the interests or rights of the data subject override them.Legitimate interest is the most flexible of the six legal bases and the most contested. The EDPB's Guidelines 1/2024 (October 2024) restate the three-step test: identify a legitimate interest, show that the processing is necessary for it, and balance it against the data subject's interests, rights and reasonable expectations, taking safeguards into account. The data subject can object at any time under Article 21, and the controller must then stop unless it shows compelling grounds.
For cookies, legitimate interest has a hard limit. The storage of or access to information on the device is governed by Article 5(3) of the ePrivacy Directive, which only knows consent and the two exemptions; the EDPB's cookie banner task force wrote in 2023 that legitimate interest cannot be the legal basis for setting or reading cookies. Banners that list "legitimate interest" purposes under the TCF have been criticized for exactly this, and for making users refuse twice.
Legitimate interest remains relevant for what happens after a lawful, exempt cookie: first-party analytics configured within a national exemption, fraud prevention, or security logging. Brazil's ANPD accepts it for strictly necessary cookies and simple audience measurement; the UK's statistical purposes exception, in force since 5 February 2026 under the UK rules, is a legislated version of the same idea. See analytics without consent for when it works and when it does not.