Legitimate interest is the legal basis that AdTech platforms have most frequently reached for — and most frequently gotten wrong.
Compared to consent, it requires no banner, no click, and no user action. It covers commercial processing, doesn't expire, and can't be withdrawn. For platforms operating at RTB scale, that operational difference matters — consent flows that don't convert mean data that can't be used, and at bid-stream volumes, the gap compounds quickly.
The problem is that Article 6(1)(f) GDPR was never designed as a blanket alternative to consent. It's a conditional legal basis — one that requires a documented assessment before processing begins, fails automatically in certain contexts regardless of how the assessment is conducted, and is subject to a right to object that must actually work. None of these requirements are optional, and regulators have made clear they know the difference between a genuine balancing exercise and a boilerplate paragraph in a privacy notice.
This article covers what legitimate interest requires under current guidance, where it cannot apply in AdTech contexts, and what documentation needs to look like to hold up under scrutiny.
What the Law Actually Requires
Article 6(1)(f) GDPR permits processing where it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject."
Three conditions follow from this, all cumulative. In October 2024, the CJEU ruled in Case C-621/22 (Koninklijke Nederlandse Lawn Tennisbond), and the EDPB published Guidelines 01/2024 on legitimate interest the following day — replacing the WP29 Opinion 06/2014 that had been the reference document on this topic since before GDPR came into force.
Step 1: The interest must be legitimate.
The EDPB defines legitimate as lawful, clearly and precisely articulated, and real and present — not speculative or hypothetical. The KNLTB ruling confirmed that purely commercial interests can qualify; a profit motive does not disqualify a purpose. But "we want to show relevant ads" is not a legitimate interest as the EDPB describes it. The specific purpose, the specific data, and the specific processing operation need to be identified before the assessment begins.
Step 2: Processing must be necessary.
Necessary means there is no reasonable, equally effective, less intrusive alternative. The EDPB ties this directly to the data minimisation principle: if the same outcome can be achieved with less data, or less granular data, or with a different technical approach, then the processing is not necessary. This step catches a lot of AdTech use cases that assume necessity rather than demonstrate it.
Step 3: The balancing test.
The controller's interest must not be overridden by the data subject's interests, rights, or freedoms. The EDPB identifies several factors relevant to this assessment: the nature of the data, the reasonable expectations of the individuals concerned, the potential consequences of the processing, and the relationship between the controller and the data subject. A person who purchased something from a retailer's website has a different relationship with that retailer than a person whose data was acquired through a third-party data broker. Their reasonable expectations differ accordingly, and the balancing test must reflect that.
If the balance tips against the controller, mitigating measures can be introduced and the test repeated — but if it still tips against after mitigating, the processing cannot proceed on this basis.
Where Legitimate Interest Cannot Apply in AdTech
Some processing activities in AdTech will fail the legitimate interest assessment regardless of how carefully it is conducted. Others are blocked by law independently of GDPR, which means the balancing test is irrelevant.
Behavioural advertising and RTB tracking
The clearest line in AdTech enforcement is this: legitimate interest cannot serve as the legal basis for the tracking and profiling that underpins behavioural advertising via RTB.
The EDPB stated in its Opinion on purpose limitation that legitimate interest does not constitute a sufficient legal basis in the context of direct marketing involving behavioural advertising. The ICO reached the same conclusion in its adtech and real-time bidding update report. These positions were confirmed in enforcement.
In February 2022, the Belgian Data Protection Authority (APD decision) fined IAB Europe €250,000 and ordered legitimate interest removed as an available legal basis within the TCF. The finding was one of several GDPR violations identified in the framework — the APD concluded that the processing of personal data by organisations participating in the TCF could not rely on legitimate interest at all. The decision came after a multi-year investigation with 27 supervisory authorities across Europe involved in the procedure.
The core finding was not a technicality. The APD concluded that the legitimate interests of the organisations participating in the TCF were outweighed by the interests of the data subjects — that the scale, opacity, and invasiveness of RTB data flows failed the balancing test, and that the TCF's interface design did not give users a meaningful way to object. Legitimate interest, as it was being used in the TCF, was a label applied to processing that required consent and was not getting it.
Non-essential cookies and tracking technologies
The ePrivacy Directive requires consent for accessing or storing information on a user's device unless that access is strictly necessary for a service the user has requested. Analytics cookies, advertising pixels, fingerprinting, audience tracking — all of these fall under that requirement. GDPR and ePrivacy run in parallel: what a controller writes into a legitimate interest assessment has no bearing on the ePrivacy consent obligation. The EDPB's Guidelines 01/2024 confirm this.
Special category data
Health data, biometric data, racial or ethnic origin, political opinions, and the other categories listed in Article 9 GDPR are outside the scope of legitimate interest entirely. Article 9 requires either explicit consent or one of the specific exceptions listed in Article 9(2). These data types appear in AdTech contexts more often than platforms acknowledge — inferred health conditions from browsing behaviour, inferred ethnicity from names or location data, inferred political views from content engagement. If the data or reasonable inferences from it fall into Article 9 categories, legitimate interest is not available.
Selling personal data to third parties
Processing for the purpose of selling personal data to third parties will fail the balancing test. The CJEU stated in Case C-252/21 (Meta v. Bundeskartellamt, July 2023) that a user of a free online service cannot reasonably expect their data to be processed for personalised advertising without consent — let alone passed to parties they have never heard of. The balancing test turns partly on what an average data subject would anticipate. A user who visited a publisher site to read an article did not anticipate their data flowing to a hundred DSPs. That gap between what happened and what they would have expected is precisely what the balancing test is designed to catch.
Where Legitimate Interest Can Work in AdTech
There are processing activities within AdTech where legitimate interest can be a valid basis — provided the assessment is conducted properly and documented.
Fraud detection and ad verification
Processing to detect invalid traffic, click fraud, and ad injection is one of the stronger cases for legitimate interest in AdTech. The interest is specific, the necessity is demonstrable — fraud cannot be detected without analysing transaction data — and the impact on data subjects is limited relative to the purpose. The EDPB's Guidelines 01/2024 identify fraud prevention as a context where legitimate interest can apply. The assessment still needs to be conducted and documented, but the balancing test is considerably easier to complete here than in most AdTech contexts.
Frequency capping without cross-site tracking
A publisher capping the number of times a user sees the same ad within a single session, using data held only within that publisher's own environment and not shared with third parties, is a plausible legitimate interest use case. The processing is limited in scope, the purpose is clear, and the impact on the user is low. What does not work is using frequency capping data to build cross-site profiles or sharing it with DSPs and data brokers — at that point the use case has changed and the original assessment no longer covers it.
Internal analytics and performance measurement
Aggregated, non-personalised analytics used to measure campaign performance — where the data stays within the platform, is not used for targeting, and is retained only as long as needed for reporting — can potentially be supported by legitimate interest. The further the processing moves toward individual profiling, targeted segmentation, or data sharing, the harder the balancing test becomes.
Security monitoring and IT system protection
Network security monitoring, access log analysis, and intrusion detection are among the contexts the EDPB identifies as supportable under legitimate interest. The interest is concrete, the necessity is straightforward to demonstrate, and the impact on data subjects is low. The assessment still needs to be documented — but these are not the cases that keep compliance teams up at night.
What Documentation Needs to Look Like
Legitimate Interest Assessments (LIAs) are not a formality. The EDPB's 2024 guidelines describe what a proper assessment contains. Controllers facing scrutiny — during a DSR objection, a DPA inquiry, or litigation — will be asked to produce documentation showing that the assessment was conducted before processing began, not assembled afterward.
A sufficient LIA addresses the following:
The interest being pursued. Not a category (marketing, fraud prevention) but a specific, articulated purpose for a specific processing operation. The EDPB requires that the interest be real and present — meaning it exists at the time of assessment, not as a general aspiration.
Why the processing is necessary. This means documenting the alternatives considered and why they don't achieve the same outcome. Cost and operational convenience are not reasons — if a less intrusive alternative exists and the only objection is that it would take more work, the necessity test fails.
The balancing analysis. This is the most frequently missing element in AdTech LIAs. A genuine balancing analysis identifies: the nature of the data being processed, who the affected data subjects are and what their relationship to the controller is, what they would reasonably expect, what the potential consequences of the processing are (including harms they might not immediately perceive), and what mitigating measures reduce the impact. The analysis should document the conclusion and the reasoning, not just assert that the balance tips in the controller's favour.
Mitigating measures. Where the balancing test is close, measures that reduce the impact on data subjects can shift the outcome. These need to be specific: data minimisation applied to particular fields, retention limits, restrictions on onward sharing, opt-out mechanisms. Describing them in general terms doesn't count. They must be in place before processing begins — not referenced as planned improvements.
The right to object. Under Article 21 GDPR, data subjects can object to processing based on legitimate interest, and processing must stop unless the controller can demonstrate compelling grounds that override the objection. This right must be communicated clearly and the mechanism for exercising it must work. A line in a privacy notice footer linking to a page that does nothing is not a functioning opt-out — and when a DPA looks at it, it won't be treated as one.
One structural note: the LIA must be specific to the processing activity, not generic to the platform or the use case category. A single boilerplate document covering all uses of legitimate interest across a platform does not satisfy the requirement. If there are ten distinct processing activities relying on legitimate interest, there should be ten assessments.
The Reasonable Expectation Problem in AdTech
The EDPB's 2024 guidelines give significant weight to whether processing would be reasonably expected by the data subjects involved. This is where AdTech has the most structural difficulty.
The CJEU stated in Meta v. Bundeskartellamt (C-252/21, July 2023) that a user of a free online social network cannot reasonably expect the operator to process their personal data, without consent, for personalised advertising. The reasoning extends beyond social networks. A user visiting a publisher site does not know which DSPs, DMPs, or data brokers will receive their data. They do not know what inferences will be drawn from their browsing behaviour or who those inferences will be shared with. Reasonable expectation is not a philosophical standard — it tracks what a person would actually anticipate if they stopped to think about what was happening to their data. In most RTB contexts, the answer is: not this.
This does not mean all AdTech processing is incompatible with legitimate interest. It means the reasonable expectations of the specific population of data subjects, in the specific context of the processing, must be assessed and documented honestly. Where those expectations would be surprised by the processing — which is most behavioural targeting — legitimate interest will not hold.
The Relationship Between Legitimate Interest and Consent
A common approach in AdTech has been to use legitimate interest as a fallback when consent is not obtained: present a consent banner, and for users who decline or ignore it, process their data anyway under legitimate interest. This does not work.
The legal bases under GDPR are not a hierarchy with consent at the top and legitimate interest as the backup. They are distinct, each with its own requirements. Processing that requires consent — because the ePrivacy Directive mandates it, because the data is special category data, or because reasonable expectations make consent the appropriate basis — cannot be recharacterised as legitimate interest processing when consent is not given. The refusal of consent is information. It indicates that the data subject does not want the processing to occur. Treating that refusal as an invitation to rely on a different legal basis undermines the consent framework and will not survive regulatory scrutiny.
What This Means Practically
The EDPB's October 2024 guidelines do not fundamentally change the law — they clarify and consolidate positions that regulators and courts have been developing for years. What they do is remove the ambiguity that allowed some platforms to treat legitimate interest as a flexible catch-all.
For AdTech platforms, the practical implications are these:
Legitimate interest cannot be used for behavioural advertising via RTB or for any tracking that requires ePrivacy consent. Attempting to do so was the basis of the TCF enforcement action and remains a clear line in regulatory guidance.
For processing that can legitimately rely on Article 6(1)(f) — fraud detection, frequency capping in limited contexts, security monitoring, internal analytics — the documentation must exist before processing begins, must address all three steps specifically, and must be retrievable when someone asks for it.
The right to object must function. Not as a theoretical right mentioned in a notice, but as an operational mechanism that stops the processing.
And the assessment must be honest. If the conclusion of the balancing test is that the processing serves the controller's interests more than it serves the data subject, a different legal basis is needed — or the processing should not happen.
This article draws on EDPB Guidelines 01/2024 on legitimate interest, CJEU Case C-621/22, CJEU Case C-252/21, and the Belgian DPA decision on IAB Europe's TCF. It is not legal advice. For specific compliance requirements, consult qualified legal counsel.