“Legitimate interest”: the loophole-looking basis, explained

Six legal bases exist (Art. 6); legitimate interest (Art. 6(1)(f)) is the elastic one — no consent needed if the company’s interest outweighs your rights. Fraud prevention, network security, basic customer analytics: fine. The abuse pattern: stretching it over ad profiling, data sales and AI training. The three-part test they must pass: a genuine, lawful interest; necessity (no less intrusive way); and a balancing against your interests and reasonable expectations — did you, as a normal person, expect this use? The CJEU has confirmed pure commercial interests can qualify, but the balancing still decides, and the EDPB rejects legitimate interest for most tracking-based advertising. Your two levers: transparency — they must name the legitimate interest at collection (Art. 13(1)(d)), and on request explain the balancing; and the right to object (Art. 21) — which flips the burden onto them to demonstrate compelling grounds or stop. Ask one question in every dispute: “Please provide your legitimate-interest assessment for this processing.” Companies that never did one — most — tend to fold rather than write it after the fact.