Assessing Legitimate Interest vs Consent

Overview

GDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.

Decision Framework: When to Use Each Basis

Use Consent When:

1. Regulatory requirement: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)
2. Special category data: Processing sensitive data under Article 9(2)(a) requires explicit consent
3. Automated decision-making: Processing under Article 22(2)(c) requires explicit consent
4. International transfers: Article 49(1)(a) explicit consent for transfers without adequacy/safeguards
5. User control priority: The processing is entirely optional and the data subject should have full control

Use Legitimate Interest When: