The Conventional Wisdom
Ask any enterprise privacy team, and you'll often hear this belief: consent is fragile, while legitimate interests is sturdy. Consent can be withdrawn, challenged for lack of granularity, and invalidated by a poorly designed consent notice. Legitimate interests, many think, is a flexible fallback. Document a balancing test once, file it, and move on.
This belief influences real decisions. Teams quietly shift processing activities away from consent toward Article 6(1)(f) to escape the operational burden of a consent management platform, consent fatigue, and withdrawal of consent requests.
Why We Disagree
This view is outdated. It treats Article 6(1)(f) as a destination reached by completing paperwork. The EDPB Guidelines 1/2024 emphasize that it's a demanding, three-part test that must be genuinely passed, not just documented.
The provision requires a legitimate interest, proof that processing is necessary for it, and a balancing exercise where your interest isn't overridden by the data subject's interests, rights, and freedoms. Each part can fail independently, yet most teams only focus on the third.
There's another issue. Legitimate interests don't exist in isolation. The EDPB and EDPS have issued joint legislative opinions linking "Legal basis" with "Cross-regulatory interplay," including the February 2026 Joint Opinion 2/2026 on the Digital Omnibus proposal and the March 2026 Joint Opinion 3/2026 on the Proposal for a European Biotech Act. These opinions show that the interaction between instruments matters as much as the text of any single one. Ignoring this interplay makes your legitimate interests assessment incomplete.
The Evidence
Regulators categorize this work in a way that underscores its complexity. The Joint Opinion 2/2026 on the Digital Omnibus is tagged across areas like artificial intelligence, automated decision-making, profiling, online tracking, controller/processor roles, cross-regulatory interplay, and legal basis. This indicates that the legal basis question isn't a standalone checkbox. It's intertwined with profiling, tracking, and role allocation between controllers and processors.
The same pattern is seen in the EDPB's Guidelines 1/2026 on processing for scientific research purposes. Its tags include health and research, legal basis, controller/processor roles, data subject rights, and basic principles. Again, legal basis is considered alongside data subject rights and foundational principles.
Two practical takeaways:
- Legal Basis Choices Carry Obligations. Relying on legitimate interests doesn't remove data subject rights; it changes which ones you'll address. Objection under Article 21 becomes an operational channel you must honor.
- Public Consultations Are Indicators. The closed consultation on Guidelines 1/2026 shows that the EDPB tests its thinking openly before finalizing it. Positions can change with stakeholder input. If your assessment relies on a narrow reading of a guideline still in flux, you're carrying unpriced risk.
One caution: don't treat legitimate interests as a substitute for prior consent where the ePrivacy Regulation framework applies. Where terminal equipment access is involved, such as storing or reading non-essential cookies, Article 5(3) ePrivacy rule requires consent regardless of the GDPR basis chosen. Choosing Article 6(1)(f) for subsequent processing doesn't dissolve that requirement.
What to Do Instead
Stop treating the legitimate interests assessment as a one-time artifact. Make it a living record with an owner and a review trigger.
- Run All Three Limbs Separately. Document the interest, test necessity against less intrusive alternatives, then balance. If necessity fails, the balancing exercise is moot.
- Tie Each Assessment to a Purpose Disclosure. Your privacy notice must clearly state the interest you're relying on. If you can't, the interest isn't well-defined.
- Build the Objection Pathway Before You Need It. Ensure your DSAR workflow can handle Article 21 objections with the same rigor as withdrawal of consent.
- Map Controller/Processor Roles First. Several EDPB-EDPS opinions highlight this. An assessment assuming the wrong role allocation is flawed.
- Set a Review Cadence Linked to Regulatory Events. Reassess activities when a consultation closes or a joint opinion is issued. Don't wait for an annual audit.
- Keep Consent Where It's the Honest Answer. If the data subject would be surprised by the processing, or the intrusion is significant, valid consent with genuine choice is often the more defensible path.
When the Conventional Wisdom Is Right
Legitimate interests is the better fit in some situations. Routine network and information security, fraud prevention, and internal administrative processing often don't require consent, as the processing is expected and refusal isn't meaningful. Forcing consent there creates fatigue and results in consent that isn't freely given.
It's also appropriate where the relationship is established, processing is within reasonable expectations, and a lighter-touch basis avoids unnecessary interactions. In these cases, a well-run Article 6(1)(f) assessment is the more honest tool.
The point isn't that legitimate interests is inherently weak or risky. It's that it's neither easier nor safer than consent. It shifts the work from collecting a signal to defending a judgment. If your team has been choosing it as a low-effort option, revisit that assumption before a regulator does it for you.
