Type something to search...
to navigateto selectESC to close

Legitimate Interest

Legitimate interest is one of the legal grounds under data protection law (GDPR) that allows organizations to process personal data when they have a valid reason, as long as that reason does not override the individual's rights and freedoms. In the context of political advertising, legitimate interest can be used as a legal basis for processing personal data, but it requires a careful balancing test and is subject to strict conditions when targeting or ad delivery techniques are used.

Legal Basis

"Processing shall be lawful only if and to the extent that at least one of the following applies: [...] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

— Article 6(1)(f), Regulation (EU) 2016/679 (GDPR)

For political advertising targeting:

"The use of targeting and ad-delivery techniques in the provision of a political advertising service shall be allowed exclusively under the conditions set out in this Article and in full compliance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC."

— Article 12(1), Regulation (EU) 2024/900

Why It Matters

Legitimate interest affects political actors, publishers, and anyone providing political advertising services who want to use personal data for targeting or ad delivery. Under the TTPA Regulation (EU 2024/900), the use of legitimate interest for political ad targeting is heavily restricted compared to other types of advertising.

When a controller relies on legitimate interest, they must conduct a balancing test weighing their business needs against the individual's rights and freedoms. For political advertising, this balance tilts heavily toward protecting individuals' democratic rights. Article 12 of the TTPA Regulation imposes additional conditions beyond the GDPR's legitimate interest requirements, including prohibitions on using certain categories of personal data and requirements to obtain data directly from the individual for the specific purpose of political advertising.

Political advertisers cannot simply assume legitimate interest applies. They must document their assessment, provide clear information to individuals, and respect the right to object. For online political advertising using targeting techniques, the TTPA's stricter rules mean legitimate interest alone is rarely sufficient—explicit consent or another specific legal basis is typically required.

Key Points

  • Balancing test required: Controllers must demonstrate that their legitimate interest does not override the individual's rights, freedoms, and interests
  • Right to object: Individuals can object to processing based on legitimate interest at any time, and the controller must stop processing unless they can show compelling legitimate grounds
  • TTPA restrictions: Article 12 of Regulation 2024/900 severely limits the use of personal data for political ad targeting, even when legitimate interest might otherwise apply under GDPR
  • Transparency obligation: Organizations relying on legitimate interest must clearly explain their reasoning and inform individuals of their right to object
  • Not available for special category data: Legitimate interest cannot be used as a legal basis for processing special categories of personal data (e.g., political opinions) under Article 9 GDPR—explicit consent or another Article 9 condition is required
  • Documentation essential: Controllers must document their legitimate interest assessment and be prepared to demonstrate compliance to supervisory authorities

Legitimate Interest vs. Consent

Legitimate interest and consent are two different legal bases for processing personal data under the GDPR. Consent requires an active, freely given, specific, informed, and unambiguous indication of agreement from the individual. Legitimate interest, by contrast, does not require the individual's permission in advance, but does require a balancing test and gives the individual the right to object afterward.

For political advertising targeting under the TTPA Regulation, the difference is crucial. While legitimate interest may work for some types of advertising, political ad targeting typically requires explicit consent when using personal data, especially for online ads. Consent gives individuals more control upfront, while legitimate interest shifts some of that control to the controller's assessment—making it less suitable for the sensitive context of political advertising.

Aspect Legitimate Interest Consent
Individual action required No (but right to object afterward) Yes (opt-in required upfront)
Withdrawal Object at any time Withdraw at any time
Suitable for political ad targeting Rarely (TTPA Article 12 restrictions apply) Yes (if explicit and freely given)
Balancing test Required Not required

Related Terms

Legitimate interest: Core Facts

Status
Active Definition
Verified
2026-04-21

Related

Very transparent. Every political ad will be labelled, linked to a transparency notice with detailed information, and online ads will be searchable in a central European repository.
The Network coordinates election-related cooperation between member states. National contact points for TTPA enforcement should be members of this network where possible.
Election campaigns will need to ensure all paid advertising includes proper labels and transparency notices. Sponsors must be prepared to provide required information to all service providers.
Several major platforms currently do not allow paid political advertising, including some large social networks. This limits where political actors can place paid online advertisements.
The TTPA applies from 10 October 2025. Member States had until 10 April 2025 to designate competent authorities, and the Commission must provide label templates by 10 July 2025.
Publishers must ensure completeness and accuracy of certain information but are not required to verify all sponsor claims. They must correct manifestly erroneous information when they become aware of it.
Yes. When a hosting provider and a website both display an ad, both are considered publishers with responsibility for their specific services. Contracts should clarify how they share compliance duties.
If a publisher removes or disables access to a political ad due to illegality or terms violations, they must still provide access to the transparency information for the full seven-year retention period.