What is Legitimate interest?
Legitimate interest is one of six lawful bases for processing personal data under the GDPR. It permits processing necessary for interests of the controller or a third party, provided those interests are not overridden by the individual's rights. It requires a documented balancing test, and it does not exempt anything from the separate ePrivacy consent requirement.
Explanatory, not legal advice. A balancing assessment is specific to your processing and should be reviewed by someone qualified.
The three-part test
A legitimate interests assessment has to answer all three, in writing, before the processing starts:
- Purpose — is there a real, articulable interest? “Understanding which pages our audience reads” qualifies. “It might be useful later” does not.
- Necessity — is the processing actually needed for that purpose, and is there no less intrusive way to achieve it? If aggregate counts would answer the question, per-person tracking is not necessary.
- Balancing — do the individual’s rights and reasonable expectations override the interest? Visitors do not expect to be profiled across sites; they may reasonably expect a site to count its own traffic.
Necessity is where most analytics arguments fail. It is hard to argue a durable cross-visit identifier is necessary to know how many people read an article.
The mistake that matters
Legitimate interest is frequently offered as the reason a site needs no cookie banner. It is not, and the two rules operate independently:
| Governs | Legitimate interest helps? | |
|---|---|---|
| GDPR | Processing personal data | Yes — it can be the lawful basis |
| ePrivacy / PECR | Storing or reading data on a device | No — that rule requires consent |
So a site can have a perfectly sound legitimate interests assessment for its analytics processing and still be required to show a banner, because it sets a cookie. The lawful basis and the storage permission are separate questions.
When it becomes straightforward
If nothing is stored on the device, the ePrivacy trigger never fires. And if no personal data is processed, there is nothing for a lawful basis to apply to. Both questions dissolve rather than being answered — which is a more comfortable position than winning either argument.