What Is Legitimate Interest in GDPR and How Companies Abuse It

Under the EU's GDPR, companies need a legal reason to use your personal data. Consent is one; legitimate interest is another. It lets a company use your data without asking, if its reason is genuine, the use is necessary and your rights don't outweigh it. Cookie banners often stretch it to cover advertising you never agreed to.

What legitimate interest is for

It's meant for uses people would reasonably expect, such as:

• Preventing fraud and keeping systems secure.
• Basic analytics to keep a service working.
• Some marketing to existing customers.

The company must weigh its interest against yours, and you have the right to object. For direct marketing, an objection must always be respected.

How cookie banners stretch it

• Many banners list hundreds of ad partners, each claiming legitimate interest.
• These switches are often on by default and hidden behind a separate "Legitimate interest" tab.
• Clicking "Reject all" on some banners refuses consent but leaves legitimate interest in place, unless you object separately.

Rules have tightened. European regulators have ruled against using legitimate interest for personalized advertising, and the ad industry's own consent framework, IAB's TCF, stopped allowing it for ad and content personalization in 2023. For cookies and similar trackers themselves, EU law generally requires consent anyway, unless they're strictly necessary.

How to object

1. On the banner, choose Manage options or More options.
2. Open the Legitimate interest tab, or the vendor list.
3. Click Object all, or switch off each one.
4. Save your choices.

Your choice is usually stored in a cookie, so you'll need to object again after clearing cookies, or when the banner asks again. You can also email the company's data protection contact and object under GDPR. If a company ignores you, complain to your country's data protection authority.

What Cookie Auto-Reject does here

Cookie Auto-Reject clicks the banner's "Reject all", "Decline" or "Only necessary" button for you on many sites. If there isn't one, it opens the preferences panel and leaves the choices to you. It doesn't switch off legitimate interest toggles, so on banners that separate the two, object by hand on the sites you use most.

Learn more

See whether cookie walls are legal and first-party vs third-party cookies.