Consent vs Legitimate Interest: GDPR Lawful Basis

Organisations routinely ask for consent they do not need, or claim legitimate interests they cannot defend, because they treat the lawful basis as a form to fill in rather than a commitment that shapes what they can do with the data later. Under the GDPR and UK GDPR, consent (Article 6(1)(a)) and legitimate interests (Article 6(1)(f)) carry different tests, different rights for the individual and different consequences when someone says no. This guide compares the two bases in depth: the legal tests for each, how withdrawal and objection work, the legitimate interests assessment (LIA) steps, how security logging and fraud prevention fit, what courts and regulators have said, and a decision checklist. It is for privacy leads, DPOs and the security, fraud and product teams who depend on the answer. The wider topic of consent in identity systems is covered in the Identity Data Privacy and Consent Guide; this page focuses on the choice between the two bases.

Key takeaways

Choose once, at the start. The ICO says you must identify the most appropriate basis from the outset, and you cannot switch to legitimate interests for the same processing after consent is withdrawn.
Consent is about control, legitimate interests is about accountability. Consent hands the decision to the individual; legitimate interests keeps it with you, but only if you can show a documented purpose, necessity and balancing test.
Do not ask for consent if you would process anyway. Asking for a choice you will not honour, or making it a condition of a service, invalidates consent and damages trust.
Security and fraud processing usually sits on legitimate interests. Recitals 47 and 49 recognise fraud prevention and network and information security as legitimate interests, but only to the extent strictly necessary and proportionate.
Other laws can decide for you. Cookies, device access and most unsolicited electronic marketing need consent under ePrivacy rules (PECR in the UK), whatever your GDPR analysis says.

The short answer

Use consent when you can offer a genuine, free choice, the processing is optional for the individual, you will stop if they say no, and another law (such as PECR or the ePrivacy Directive) requires it. Use legitimate interests when the processing is something people would reasonably expect, it is genuinely necessary for a specific interest, the impact on them is limited or can be reduced by safeguards, and you need it to continue regardless of individual preference (security monitoring, fraud prevention, network protection). Check contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) first. Legitimate interests is not a fallback, and the EDPB says it must not be treated as an open door for processing that fits nowhere else.

What each basis requires

Consent

Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, by a statement or clear affirmative action. Article 7 adds four conditions:

Proof: Article 7(1) says the controller "shall be able to demonstrate that the data subject has consented". The burden is yours.
Separation: Article 7(2) requires a consent request inside a wider document to be clearly distinguishable, intelligible and in plain language.
Withdrawal: Article 7(3) gives a right to withdraw at any time, requires people to be told this before they consent, and says withdrawal must be as easy as giving consent.
Conditionality: Article 7(4) says utmost account must be taken of whether a contract or service is made conditional on consent to processing that is not necessary for it.

The ICO adds that consent requires an active opt-in: pre-ticked boxes, silence, default settings and blanket acceptance of terms do not count, and each purpose needs its own opt-in unless bundling is clearly appropriate. Special category data under Article 9 needs explicit consent (or another Article 9 condition), which means an express statement.

Legitimate interests

Article 6(1)(f) allows processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party", except where those interests are overridden by the interests or fundamental rights of the individual, "in particular where the data subject is a child". It does not apply to public authorities performing their tasks. The EDPB Guidelines 1/2024 (paragraph 6) set three cumulative conditions:

A legitimate interest: lawful, clearly and precisely articulated, and real and present rather than speculative (paragraph 17).
Necessity: more than useful. If the interest can reasonably be achieved just as effectively by less intrusive means, the processing is not necessary (paragraphs 28 to 30), read with data minimisation in Article 5(1)(c).
Balancing: the individual's interests, rights and freedoms do not override yours, considering the nature of the data, context, consequences and reasonable expectations (paragraphs 31 to 60).

The Court of Justice confirmed in Koninklijke Nederlandse Lawn Tennisbond (C-621/22, 4 October 2024) that a purely commercial interest can be legitimate if it is not contrary to law, but it still has to pass necessity and balancing.

Side-by-side comparison

Dimension	Consent (Art. 6(1)(a))	Legitimate interests (Art. 6(1)(f))
Who decides	The individual	The controller, subject to a documented test
Core test	Freely given, specific, informed, unambiguous (Art. 4(11), Art. 7)	Purpose, necessity, balancing (EDPB Guidelines 1/2024 para. 6)
Evidence you keep	Who, when, what they were told, how they consented, withdrawal (ICO)	Written LIA before processing, reviewed on change
Individual's main right	Withdraw at any time, as easily as given (Art. 7(3))	Object on grounds of particular situation (Art. 21(1)); absolute for direct marketing (Art. 21(2))
Effect of saying no	Processing on that basis stops; no switch to another basis for the same purpose	Stop unless you show compelling legitimate grounds or legal claims (Art. 21(1))
Right to erasure	Applies on withdrawal where no other ground exists (Art. 17(1)(b))	A successful objection generally leads to erasure (EDPB para. 78)
Data portability	Applies (Art. 20)	Does not apply
Employees	Rarely valid because of power imbalance (ICO)	Common basis for monitoring and security, with employment law limits (Art. 88)
Transparency	Purposes, controller names, right to withdraw	Name the legitimate interest pursued (Art. 13(1)(d)); EDPB says make the balancing test available on request

Withdrawal and objection rights in practice

Withdrawal of consent

No reason needed: people can withdraw on their own initiative at any time, and the ICO says opt-out by reply alone is not enough. Provide a standing mechanism such as a preference centre.
Speed and no detriment: the ICO expects processing to stop as soon as possible (immediately online), with no penalty for withdrawing.
No switching: withdrawal does not make past processing unlawful, but you cannot continue the same processing on a different basis. If you planned to keep some data (for example, a suppression record so you do not contact the person again), you must have said so at the outset, with its purpose and basis.
Refresh: the ICO suggests refreshing consent every two years if in doubt, and keeping evidence for as long as you process on consent.

Objection to legitimate interests

General objection (Art. 21(1)): the person objects on grounds relating to their particular situation. You must stop unless you demonstrate compelling legitimate grounds that override their interests, or the processing is for legal claims. The EDPB says ordinary interests that are merely beneficial generally do not meet the "compelling" bar, and the assessment must be documented (paragraphs 72 to 75).
Direct marketing (Art. 21(2) and (3)): the right is absolute. Once someone objects, the data can no longer be processed for marketing. The EDPB describes it as unconditional regardless of basis (paragraph 122).
Notice (Art. 21(4)): the right must be brought to the person's attention explicitly, at the latest at first communication, and separately from other information.

The practical consequence: legitimate interests suits processing you can defend even against an objector (security logs needed to investigate an incident), while consent suits processing that should simply stop when the person loses interest (a newsletter, an optional personalisation feature).

Running the legitimate interests assessment

The ICO says the UK GDPR does not specifically require an LIA, but you should complete one before processing and record the outcome. The EDPB treats documentation as part of accountability under Article 5(2). A ready-to-use form is in the Legitimate Interests Assessment Template; the steps below explain the judgement behind each part.

Check the other bases first. If a law requires the processing, use Article 6(1)(c); the EDPB says this applies, for example, where law mandates specific fraud checks (paragraph 107). If it is necessary to deliver the contract, use Article 6(1)(b). If ePrivacy rules require consent, stop here.
Write the interest precisely. "Detecting account takeover on customer logins" passes; "business purposes" or "combating fraud" does not. The EDPB says a generic reference to combating fraud in a privacy notice is insufficient (paragraph 106).
Test necessity against alternatives. List the less intrusive options you considered (aggregated data, shorter retention, pseudonymised identifiers, sampling) and why they would not work as effectively.
Assess impact. Consider data sensitivity, scale, whether data is combined from sources, vulnerable groups including children, and consequences such as financial loss, discrimination or chilling effects (EDPB paragraphs 40 to 46).
Test reasonable expectations. The EDPB notes that a privacy notice alone does not create a reasonable expectation, and nor does common sector practice (paragraphs 52 and 53).
Add safeguards and re-balance. Mitigations count only if they go beyond what the GDPR already requires, such as an unconditional opt-out, and the balancing must be redone once they are in place (paragraphs 56 to 58).
Decide and escalate. If the impact still overrides your interest, you cannot use Article 6(1)(f). If the LIA reveals likely high risk, a DPIA is mandatory: see the DPIA Guide.
Publish and review. Name the interest in your privacy notice, link the LIA to the record of processing, and review when the purpose, data or context changes.

Security logging, monitoring and fraud

Consent cannot work for controls that must run against everyone, including attackers.

Processing activity	Usual basis	Why not consent	Key safeguards
Authentication and access logs	Legitimate interests (Recital 49); sometimes legal obligation where a sector law mandates logging	An attacker or careless user would withdraw; logging must be universal	Defined retention, role-based access to logs, purpose limitation
Endpoint and email security scanning	Legitimate interests	Power imbalance with staff; control fails if optional	Content inspection limited to security purposes, staff notice
Deep packet or TLS inspection	Legitimate interests, with a strong LIA and often a DPIA	As above	EDPB says intrusive techniques such as deep packet inspection weigh heavily (para. 127): exclude categories such as health and banking sites
User behaviour analytics	Legitimate interests, with a DPIA where profiling is systematic	As above	Pseudonymised analytics, human review before action, no automated decisions under Art. 22
Payment and login fraud scoring	Legitimate interests (Recital 47), or legal obligation where law requires the checks	Fraudsters would refuse	Specify fraud types and data needed (EDPB para. 105), accuracy checks, appeal route
Sharing indicators with law enforcement	Legal obligation, or legitimate interests for occasional case-specific reports	Not relevant	EDPB says systematic sharing for a business's economic interest is generally not covered (paras. 129 to 131)

Recital 49 says processing strictly necessary and proportionate for network and information security, such as preventing unauthorised access, malicious code and denial of service attacks, constitutes a legitimate interest. Recital 47 says the same of processing strictly necessary to prevent fraud. Both use "strictly necessary", so the recital is the starting point of the LIA, not its conclusion. The ICO also says IT security "may" be a legitimate interest, not that it always is.

Scope is the control: security logging that captures message content, browsing history or keystrokes needs a much stronger justification than one that captures authentication events. See the Employee Monitoring and Privacy Guide.
Reuse needs its own basis: the EDPB says data collected for another purpose that incidentally reveals fraud must follow the further processing rules (paragraph 108), and Article 6(4) sets the compatibility factors. Security logs repurposed for productivity scoring are a new purpose.

In the UK, the Data (Use and Access) Act 2025 inserted Article 6(1)(ea), "recognised legitimate interest", into the UK GDPR from 5 February 2026. Processing counts only if it meets a condition in Annex 1 (which includes crime, national security, emergencies and safeguarding), and section 70 adds point (ea) to the Article 21(1) right to object. It has no equivalent in the EU GDPR, so multinational controllers still need an Article 6(1)(f) analysis for EU data. See the UK GDPR and Data Protection Act 2018 Guide.

Marketing, cookies and the ePrivacy overlay

Recital 47 says direct marketing "may be regarded as" a legitimate interest, which many controllers read as permission. The EDPB and ICO both say otherwise: it is possible, not automatic. The ePrivacy layer often decides first:

Cookies and device access: non-essential cookies and similar technologies need consent under the ePrivacy Directive (PECR in the UK). Legitimate interests cannot replace it. See the Consent Management Guide.
Electronic marketing: the EDPB says unsolicited electronic marketing generally needs consent, with the soft opt-in for existing customers as the exception (paragraphs 114 to 116). The ICO says that where PECR requires consent, consent is also the right UK GDPR basis.
Profiling for advertising: the EDPB says intrusive profiling or cross-site tracking will rarely pass the balancing test (paragraphs 118 to 121), and the Court of Justice held in Meta Platforms v Bundeskartellamt (C-252/21, 4 July 2023) that personalised advertising could not justify the processing in question as a legitimate interest without consent.

What courts and regulators keep finding

For figures and case lists see GDPR Fines and Enforcement Statistics.

Pattern	Authority	Lesson
Dominant platforms claiming consent	CJEU C-252/21 press release: a dominant position does not prevent valid consent but is an important factor, and the operator must prove consent was freely given	The bigger the power gap, the harder consent is to defend
Behavioural advertising on legitimate interests	CJEU C-252/21; EDPB Guidelines 1/2024 paras. 118 to 121	Large-scale profiling people do not expect fails balancing
Selling member data to sponsors	CJEU C-621/22: commercial interest can be legitimate, but asking members first was a less intrusive alternative; reasonable expectations at joining weigh heavily	Necessity can point you back to consent
Consent as a condition of free services	ICO café wifi example: consent to marketing as a condition of wifi was not valid	Bundled consent is not freely given (Art. 7(4))
Fallback after withdrawal	ICO credit card example: the company should have relied on legitimate interests from the start	Pick the honest basis on day one
Vague fraud or security purposes	EDPB paras. 105, 106 and 127	Specify the threat, the data and the retention

Worked scenario: a fintech app

A UK and EU consumer payments app processes five streams of personal data. The privacy team works through each:

Device fingerprint and login telemetry for account takeover detection: legitimate interests. The interest (preventing unauthorised account access) is specific, the data is limited to device and session attributes, retention is 13 months, and analysts see pseudonymised identifiers until a case is opened. An objection is answered with compelling grounds: removing one user from fraud scoring would expose that user and others.
Anti-money laundering checks: legal obligation, not legitimate interests, because the checks are required by law.
Analytics cookies on the web app: consent through the cookie banner, because ePrivacy rules require it.
Product emails to existing customers about similar features: soft opt-in under PECR with an unsubscribe link in every message; the GDPR basis is legitimate interests with an absolute right to object.
Spending insights built from transaction categorisation: consent, because it is optional, some users would find it intrusive, and the product should simply switch off for anyone who declines.

Decision checklist

Question	If yes
Does a law require the processing?	Legal obligation, not consent or legitimate interests
Is it necessary to deliver what the person asked for?	Contract
Does ePrivacy law (cookies, device access, electronic marketing) require consent?	Consent
Would you continue the processing if the person said no?	Not consent; test legitimate interests
Is there a power imbalance (employer, public authority, dominant platform)?	Consent is unlikely to be freely given
Would people be surprised, or is the processing intrusive or large-scale profiling?	Legitimate interests is unlikely to pass; consider consent or do not process
Can you state a specific interest, show necessity and document the balance?	Legitimate interests is available
Is it special category data?	You also need an Article 9 condition, whichever Article 6 basis you use

Detection and measurement

LIA coverage: percentage of record of processing entries on legitimate interests with a current, signed LIA (target 100 percent).
Consent evidence completeness: percentage of consent records holding identifier, timestamp, notice version and capture method.
Withdrawal latency: median time from withdrawal to processing stopping across all downstream systems, including processors.
Objection handling time: days from Article 21 objection to documented decision, and the share upheld.

Log every consent status change as an auditable event. See the GDPR Compliance Guide for Security Teams.

Common failure patterns

Consent as a safety net: asking for consent "just in case" while intending to fall back on legitimate interests. The ICO says this is misleading and the fallback is not available for the same processing.
Template LIAs: one generic LIA covering "security and fraud" for every system. The EDPB expects the type of fraud and the data needed to be specified.
Withdrawal that does not propagate: the preference centre updates the CRM but not the marketing platform, data warehouse or processor, so processing continues unlawfully.
Security data creep: logs collected under a security LIA reused for performance management or marketing without a compatibility assessment.
Employee consent: relying on staff consent for monitoring, where the ICO says the power imbalance makes consent inappropriate.
Ignoring the ePrivacy layer: a well-argued LIA for analytics cookies that PECR or the ePrivacy Directive still requires consent for.

Framework mapping

Framework	Reference	Relevance
GDPR / UK GDPR	Art. 4(11), 6(1)(a), 6(1)(f), 7, 21; Recitals 47 and 49; UK Art. 6(1)(ea)	Definitions, tests and rights
GDPR accountability	Art. 5(2), 30, 35	Record the basis, keep the LIA, run a DPIA where risk is high
NIST SP 800-53 Rev. 5	PT-2 Authority to Process Personally Identifiable Information; PT-4 Consent	Document authority and consent mechanisms in the control set
ISO/IEC 27001:2022 Annex A	5.34 Privacy and protection of PII	Identify and meet privacy requirements in the ISMS
NIST CSF 2.0	GV.OC-03	Legal, regulatory and contractual cybersecurity requirements, including privacy obligations, are understood and managed

Practitioner checklist

Map every processing activity in the ROPA to one basis, recorded before processing starts.
Remove consent requests for processing you would continue regardless, and move it to the honest basis with updated notices.
Complete a specific LIA for each legitimate interests activity, naming the threat or interest, the data, retention and safeguards.
Build withdrawal and objection handling into every downstream system and processor, and test it end to end.
Keep consent evidence (who, when, notice version, method, withdrawal) for as long as you rely on it.
Check ePrivacy and PECR requirements before finalising any analytics, cookie or marketing basis.
Scope security logging and fraud data tightly, with retention limits, and run a DPIA for intrusive monitoring.

Standards and references

Related NHI Mgmt Group resources: Identity Data Privacy and Consent Guide · Legitimate Interests Assessment Template · Consent Management Guide · PECR Guide · DPIA Template. This guide summarises the GDPR and UK GDPR lawful bases and is not legal advice.

Consent vs Legitimate Interest: Choosing the Right GDPR Lawful Basis