legitimate interest

advancedwidespread

Legitimate interest is a data processing legal basis allowing an organization to process your data without your consent if it has a real, lawful interest, the processing is necessary for that interest, and your rights and interests do not override its own.

In plain terms

Under the European data protection regulation (GDPR), personal data may only be processed on a legal basis. There are six such bases: the most well-known is consent, while the most flexible and most debated is legitimate interest.

It is like when an apartment building installs a camera in the entrance hall. It does not ask for permission from each resident and guest individually, because property protection is a reasonable goal. However, a staircase camera cannot look into your apartment, nor can it become a surveillance system: the interest and your privacy must be in balance.

The concept entered the news due to artificial intelligence. Training large language models requires vast amounts of public text, and it is impossible to ask for separate permission from every affected party. AI companies therefore typically invoke legitimate interest when training their models on public posts, comments, or websites.

With consent, you are asked in advance and can say no. With legitimate interest, the organization decides itself, and you have the right to object afterwards. That is why this legal basis is often said to be the most convenient for the company and the least visible to the data subject.

How it works

Specifying the interest: the organization must state its goal precisely (for example, fraud prevention, network security, or developing an AI model). The interest must be lawful, genuine, and specific.
Necessity test: you must prove that the goal cannot reasonably be achieved with less data or a gentler method.
Balancing test: it must weigh its own interest against your rights and what you can reasonably expect. You expect something different from a public professional profile than from a message written in a closed group.
Documentation, guarantees, and information: the organization must document the result of the three-step (legitimate interest assessment) test to prove it later. You must be informed clearly, and the risk must be reduced, for example through pseudonymization or filtering.
Right to object: you can object to data processing at any time. In such cases, the organization must stop, unless it proves it has a compelling, overriding reason stronger than your rights, or the data is needed to assert a legal claim. In direct marketing, your objection is valid unconditionally.

An everyday example

You receive a notification from a social media platform that your public posts will henceforth be used to train their AI model, and if you do not wish this, you can object via a form. They did not ask for your permission because the company invokes its legitimate interest. If you do not fill out the form, your data will be included in the training material.

Who is affected

everyoneYour publicly posted texts and images can become training data for AI models without your consent if you do not object.

entrepreneur, executiveIf your company runs an AI system or agent on customer data, the company must be able to show, with documentation, that the legitimate interest genuinely holds.

marketerSome direct outreach may rely on this legal basis, but behavior-based targeted advertising and cookies typically require consent. If the data subject objects to direct marketing, you must stop. → Marketing

developerIf you collect data from the web for model training, choosing and documenting the legal basis is part of the task just like writing the code. → Code

A common misconception

MythIf a company invokes its legitimate interest, it can do anything with my data, and I have no say.

In realityLegitimate interest is not a free pass: the company must demonstrate it with a three-step test, and you can object. If the balancing is flawed, the authority can prohibit the data processing and impose a fine.

Limits and risks

The organization itself conducts the assessment in its own case, so it is prone to deciding in its own favor. External oversight typically occurs only following a complaint, during regulatory or court proceedings.
For special data (e.g., health status, religion, political opinion), legitimate interest alone is not enough; stricter conditions are required.
Objection is hard to enforce retroactively with AI models because a person's data cannot yet be reliably and tracelessly removed from an already trained model.
Authorities cannot rely on legitimate interests when performing public duties; in such cases, the performance of the public duty or a legal obligation is typically the legal basis.

Similar, but not the same

consent – With consent, you are asked in advance, and your data can be processed only if you say yes. With legitimate interest, you are not asked; you can only object afterwards.
contract performance – This applies only to data without which the contract concluded with you cannot be fulfilled; legitimate interest can cover broader purposes.
public interest – Public interest data processing is based on a statutory public task, whereas legitimate interest refers to the organization's or a third party's own interest.

Related concepts

Broader

legal basis for data processing, data protection, GDPR

Narrower

Balancing-of-interests test, right to object

On the edge

consent, training data, web data collection, Profiling, data protection impact assessment

A brief history

Legitimate interest already appeared in the European Union's 1995 Data Protection Directive (95/46/EC); its current form is provided by Article 6(1)(f) of the GDPR, applicable since May 25, 2018. The Court of Justice of the European Union has established a three-step test (interest, necessity, balancing) in several rulings. According to an opinion issued by the European Data Protection Board in December 2024, legitimate interest can in principle serve as a legal basis for developing AI models if the test is met.

Where things stand

Legitimate interest has been one of the most frequently used legal bases for years, and AI developers typically cite it for model training. Where exactly the boundary lies is shaped by regulatory and court cases, as well as the European Commission's November 2025 'digital omnibus' proposal, which would regulate legitimate interest specifically for AI development within the GDPR.

Status: 2026 November

Also known as

legitimate interest · data processing based on legitimate interest · legitimate interest legal basis · balancing of interests · legitimate interest · legitimate interests · LIA (legitimate interests assessment) · GDPR 6. cikk (1) f) pont

Sources

European Data Protection Board: Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.