Right to object — the marketing stop-switch (Art. 21)

The right to object (Art. 21) has two speeds. Direct marketing — absolute: object and they must stop, immediately, no weighing of interests, profiling for marketing included (Art. 21(2)-(3)). Every marketing email must carry a working opt-out; “reply STOP” or one click has to be enough. This is the strongest consumer switch in the GDPR and astonishingly underused. Everything else — a balancing test: where processing rests on “legitimate interests” or public-interest grounds, you can object “on grounds relating to your particular situation” — the organisation must stop unless it demonstrates compelling legitimate grounds that override yours (their burden, not yours). Classic wins: your data in a people-search site, risk profiling that misfires on your situation, camera analytics you never agreed to. AI training runs on this right too — see Can AI train on my data? How to object: “Under Article 21 GDPR I object to the processing of my data for [direct marketing / the following purpose]. For marketing, stop immediately; otherwise, demonstrate compelling legitimate grounds or cease.” They must tell you about this right clearly and separately, at first contact (Art. 21(4)) — most bury it, which itself is a violation. Spam that keeps coming after you objected? Straight to Stop spam & marketing.