> Legitimate interest vs consent under the GDPR: the three-step test, key differences, and why cookies and trackers still need consent. > > Canonical: https://www.flowconsent.com/en/blog/legitimate-interest-vs-consent-cookies [Comparisons](https://www.flowconsent.com/en/blog?category=comparisons) # Legitimate interest vs consent: which applies to cookies? By Roland Vekemans · Published 27 October 2026 · 8 min read In short Legitimate interest vs consent is a choice between two of the six legal bases in Article 6 of the GDPR. Legitimate interest lets you process data without asking, if the processing is necessary and does not override people's rights; consent requires a free, specific, informed and unambiguous yes. For cookies, the question is mostly settled: the ePrivacy rules require consent for any non-essential cookie or tracker, so legitimate interest cannot replace it. It remains useful for processing that does not touch the visitor's device, such as security logs or fraud prevention. ## What is legitimate interest under the GDPR? Article 6(1)(f) of the [GDPR](https://www.flowconsent.com/en/laws/gdpr) allows processing that is "necessary for the purposes of the legitimate interests" of the controller or a third party, unless the interests or fundamental rights of the person override them. It is one of six legal bases, alongside consent, contract, legal obligation, vital interests and public task. None is ranked above the others, and our guide to [the 7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) explains why consent is not automatically the "safest" choice. Supervisory authorities describe legitimate interest as a three-step test, and you must pass all three: 1. **A legitimate interest.** The interest must be lawful, clearly defined and real, not hypothetical. In its KNLTB judgment of 4 October 2024 (C-621/22), the Court of Justice of the EU confirmed that a commercial interest can qualify. 2. **Necessity.** The processing must actually serve that interest, and there must be no less intrusive way to reach the same goal. 3. **Balancing.** Your interest must not override the rights of the people concerned, taking into account what they can reasonably expect. The CNIL gives the example of a social network: advertising profiling can go beyond what users reasonably expect. You document this in a legitimate interest assessment (LIA) and you tell people about it in your privacy notice. The European Data Protection Board (EDPB) set out the same three steps in its Guidelines 1/2024 on legitimate interest, adopted as a draft on 8 October 2024 for public consultation. ## Legitimate interest vs consent: the key differences The two bases do not work the same way for you or for the people concerned: - **Who decides.** With consent, the person decides before anything happens. With legitimate interest, you decide, after weighing interests, and the person can object afterwards. - **Timing.** Consent must be collected before the processing starts. Legitimate interest allows processing from the start, provided the balancing test holds. - **Withdrawal or objection.** Consent can be withdrawn at any time, as easily as it was given. Under legitimate interest, people have a right to object (Article 21). For direct marketing, that objection is absolute. - **Proof.** Consent must be provable, record by record. Legitimate interest must be documented through your assessment. - **Rights.** The right to data portability applies to consent and contract, not to legitimate interest. - **Switching.** You cannot move from one basis to the other when it suits you. If consent is refused or withdrawn, you cannot fall back on legitimate interest for the same purpose. The last point is the one that catches most websites. Legitimate interest is not a plan B for people who said no. ## Can you use legitimate interest for cookies? For most cookies, no. Two separate rules apply to a cookie, and they stack. The first is Article 5(3) of the [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive). It covers the act of storing or reading information on the user's device: cookies, local storage, pixels, fingerprinting. It only knows two exceptions: transmission of a communication, and what is strictly necessary for a service the user explicitly asked for. Everything else needs prior consent. Legitimate interest is not on that list. The Court of Justice confirmed in Planet49 (C-673/17, 1 October 2019) that this rule applies whether or not the data is personal, and that a pre-ticked box is not consent. The second is the GDPR, which governs what you then do with the personal data collected. That is where Article 6 and legitimate interest come in. The EDPB draft guidelines on legitimate interest make the link explicit: where Article 5(3) requires consent for cookies and similar trackers, consent is likely the right legal basis for the processing that follows, which typically rules out legitimate interest. In the Meta Platforms judgment of 4 July 2023 (C-252/21), the Court also found that users of a social network cannot reasonably expect their data to be used for personalised advertising without their consent. National rules say the same. In France, Article 82 of the Loi Informatique et Libertés transposes Article 5(3). In Germany, § 25 TDDDG does. In Spain, Article 22.2 of the LSSI. In the UK, PECR. None of them accepts legitimate interest as a substitute for consent when you read or write on the device for analytics or advertising. The only cookies that escape consent are the strictly necessary ones, which our guide on [strictly necessary cookies](https://www.flowconsent.com/en/blog/strictly-necessary-cookies-examples) lists with examples. That is an ePrivacy exemption, not legitimate interest. The two are often confused because the GDPR basis for the data in those cookies is frequently legitimate interest or contract. ## Why do cookie banners show a "legitimate interest" tab? If you have ever opened the settings of a large publisher's banner, you have seen a list of vendors with two switches: "Consent" and "Legitimate interest", the second one already turned on. This comes from the IAB Transparency and Consent Framework (TCF), which lets ad tech vendors declare legitimate interest for some purposes. Regulators have pushed back hard. In February 2022, the Belgian data protection authority found that the TCF breached the GDPR, partly because legitimate interest could not justify the processing involved, and fined IAB Europe 250,000 euros. The Court of Justice later confirmed in March 2024 (C-604/22) that the TC string the framework produces is personal data. Version 2.2 of the framework then removed legitimate interest for the purposes linked to personalised advertising and content profiling. Our [TCF 2.2 guide](https://www.flowconsent.com/en/blog/tcf-2-2-transparency-consent-framework-guide) details which purposes changed. Even for the purposes where the TCF still allows it, the storage or reading of an identifier on the device remains subject to consent. A pre-enabled "legitimate interest" switch does not change that. ## When legitimate interest does work on a website Legitimate interest is a real legal basis, just not for trackers that need consent. On a typical website, it fits processing that does not depend on storing or reading anything non-essential on the visitor's device: - **Security and fraud prevention.** Server logs, rate limiting, bot detection and fraud checks on orders. The CNIL lists network security and fraud prevention among typical legitimate interests. - **Error monitoring.** Collecting crash reports to keep the service stable, provided it is limited to what is needed. - **Existing customers.** Some follow-up communications to customers, within the limits of the ePrivacy rules on electronic marketing and with an easy way to object. - **The data inside exempt cookies.** Once a cookie is strictly necessary, for example a load-balancing or cart cookie, the GDPR basis for the data it carries is often legitimate interest or contract. Audience measurement sits in between. In France, the CNIL exempts some analytics tools from consent when strict conditions are met, as our article on [Matomo and the CNIL exemption](https://www.flowconsent.com/en/blog/matomo-cookies-gdpr-do-you-need-banner) explains. That is a consent exemption under Article 82, not a general permission to use legitimate interest for analytics. FlowConsent is a concrete example of how a CMP separates the two: each service in its catalog carries a plausible legal basis, so an error-tracking tool such as Sentry is flagged as legitimate interest with a right to object, while analytics and advertising tools default to consent. ## How to choose between legitimate interest and consent A simple decision path covers most website cases: 1. **Does the tool store or read something on the device?** Cookies, local storage, pixels, SDKs, fingerprinting. If not, skip to step 4. 2. **Is it strictly necessary for the service the visitor asked for?** Login session, cart, security, load balancing, the record of their cookie choice. If yes, no consent is needed for the device access. 3. **If not, ask for consent.** Analytics (outside a national exemption), advertising, retargeting, social media embeds and A/B testing tools all fall here. Use a banner with a reject button as visible as the accept button, as our guide to [opt-in vs opt-out](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent) explains. 4. **For processing that does not touch the device,** run the three-step test. If it passes, document it, mention it in your privacy notice and give people an easy way to object. Before choosing, you need to know what your site actually loads. Check in 30 seconds which cookies your site drops with the [free cookie scanner](https://www.flowconsent.com/en/scan): any third-party cookie set before a choice is a sign that a tool is relying on a legal basis it does not have. Two mistakes come up again and again. The first is putting analytics or advertising tags under "legitimate interest" in a banner so they load by default. The second is collecting consent and, when it is refused, running the same tool under legitimate interest. Both expose you to the same type of sanction as having no banner at all. If you are unsure which form of consent you need, our guide to [explicit and implied consent](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied) clarifies the vocabulary. ## Should you reject legitimate interest as a visitor? If a banner offers legitimate interest switches, you can turn them off. Doing so exercises your right to object under Article 21 of the GDPR. It does not break the site: strictly necessary cookies keep working because they do not depend on that switch. If a publisher keeps tracking you after you objected, you can complain to your data protection authority. ## How FlowConsent handles legitimate interest and consent FlowConsent treats consent as the default for every service that stores or reads data on the device. Essential cookies stay active from the first page load; analytics, marketing and preference services are blocked until the visitor accepts their category, and refusing is as easy as accepting. Each service in the catalog carries a legal basis. A badge appears only when it differs from consent: legitimate interest (with a reminder to declare it and offer a right to object), contract, or a possible CNIL exemption with its checklist. The basis is a starting point, and the publisher keeps the final assessment. Consent records can be exported as proof, and Google Consent Mode v2 is built in. Details are in the [services and legal bases documentation](https://www.flowconsent.com/en/doc/services-and-legal-basis). [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Flegitimate-interest-vs-consent-cookies) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Flegitimate-interest-vs-consent-cookies) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is the difference between legitimate interest and consent? With consent, the person agrees before any processing, and can withdraw at any time as easily as they agreed. With legitimate interest, you decide after a documented three-step test (a real interest, necessity, balancing), and the person can object afterwards under Article 21 of the GDPR. Consent must be provable record by record; legitimate interest must be justified by your assessment. You cannot switch from one to the other for the same purpose. ### Can cookies be based on legitimate interest? Not for non-essential cookies. Article 5(3) of the ePrivacy Directive requires prior consent for storing or reading information on a device, with only two exceptions: transmitting a communication and what is strictly necessary for a service the user asked for. Legitimate interest is not one of them. The EDPB adds that when cookies need consent, consent is likely the right basis for the processing that follows as well. ### Should I reject legitimate interest on cookie banners? You can, and it is often wise. Turning off a legitimate interest switch exercises your right to object under Article 21 of the GDPR. It does not break the website, because strictly necessary cookies do not depend on that switch. If a site keeps tracking you after you objected, you can complain to your data protection authority. Many of these switches come from the IAB TCF, which regulators have criticised. ### Can you give an example of a legitimate interest? Typical examples are network security, fraud prevention, server logs to keep a website running, and error monitoring that stays limited to what is needed. The CNIL also cites marketing to existing customers. The Court of Justice confirmed in October 2024 (C-621/22) that a commercial interest can be legitimate, but it still has to pass the necessity and balancing tests, and it cannot replace consent where the ePrivacy rules require it. ### What are the three parts of a legitimate interest assessment? First, the purpose test: is the interest lawful, clearly defined and real? Second, the necessity test: does the processing actually serve that interest, with no less intrusive alternative? Third, the balancing test: do the rights and reasonable expectations of the people concerned override your interest? You document all three before processing, mention the basis in your privacy notice and offer an easy way to object. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Marketing tools · 28 March 2026](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) ### [Consent Mode v2: basic vs advanced mode, which one to choose?](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Consent Mode v2 offers two modes: basic (strict blocking) and advanced (anonymized pings). Differences, GDPR implications and choosing guide.](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Read the article ](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose)· [Platform guides · 13 July 2026](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) ### [Next.js cookie consent and GDPR: the complete compliance guide](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [How to collect valid cookie consent in a Next.js app, from App Router installation and SPA navigation to Google Consent Mode v2 and server-side consent checks.](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)· [Marketing tools · 1 July 2026](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ### [The \_ga, \_gid and \_gat cookies explained: purpose, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [What the Google Analytics cookies \_ga, \_ga\_\, \_gid and \_gat actually do, how long they last, why they need consent in the EU and how Consent Mode v2 changes their behaviour.](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [Read the article](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)