Consent and legitimate interests do the same job. Only one of them waits for you to say yes.
Moving a processing activity from one lawful basis to the other changes nothing the user can see. It changes who has to move first, and almost nobody moves.
Draft, not yet edited. Written by Nadia Berger, and not yet through the desk: nothing here has been checked against the sources listed at the foot of the page. Do not act on it.
European data protection law gives you six lawful bases for processing personal data. Two of them do most of the commercial work, and for a great many activities a company may pick either one. The choice is invisible from the outside. It decides everything.
The first is consent. Nothing happens until the person says yes, and the yes has to be a real one — a statement or a clear affirmative act, freely given, for a named purpose. Silence is not consent. A pre-ticked box is not consent. And a person who said yes in March can withdraw in April, at which point the processing stops.
The second is legitimate interests. The company weighs its own interest against the rights of the person, concludes the interest wins, and starts. There is no yes. There is no box. The person is told, in the privacy notice, and then the processing runs.
Same activity. Same servers. Same data. What differs is what happens in the silence.
Planning permission, and the thing you can build without it
Consider a building. Under planning permission, you cannot start until the council decides in your favour, and if nobody applies, nothing gets built. Under permitted development, you start, and a neighbour who dislikes it has to raise an objection, which then has to be weighed.
The building is identical either way. What has changed is who bears the cost of the process, and what the default outcome is when nobody can be bothered. One rule produces a small number of carefully considered extensions. The other produces a great many extensions.
That is the whole of it. Consent is planning permission for a processing activity. Legitimate interests is permitted development. The change from one to the other never appears as a change to the product, and it is not a technical decision, and it is very rarely announced as a decision at all.The analogy has one seam, and it is worth knowing where. In planning, the council decides. In data protection there is no council: the company runs the balancing test on itself, in private, and the regulator arrives afterwards, if ever.
Objecting and withdrawing are different verbs
This is the part that surprises people who have read the summary rather than the text.
Withdrawing consent is unilateral. You said yes, you now say no, and the law does not ask you why. Article 7(3) makes withdrawal as easy as giving, and once it lands the basis is gone.
Objecting to processing under legitimate interests is not that. Article 21(1) lets you object on grounds relating to your particular situation, and the controller must then stop — unless it can demonstrate "compelling legitimate grounds" that override your interests, rights and freedoms. Read that as it is drafted: your objection opens an argument, and the company is the one who answers it in the first instance.
The exception to the exception matters more than either. Under Article 21(2), where the processing is for direct marketing, objection is absolute. No balancing, no compelling grounds, no argument. You say stop and it stops.
The tightest right in the regulation applies to the purpose people complain about least, and the loosest applies to the ones they have never been told the name of.
So there are two doors, and the sign on them is written by the company. Purposes framed as advertising fall inside the absolute right. Purposes framed as analytics, security, service improvement or model development do not, and land in the balancing test instead.
The regulation does not say which basis goes with which activity
This is the omission that shapes the market, and it is not an oversight.
There is no annex listing the processing activities for which consent is required. There is no rule that says a company must keep using the basis it started with. The balancing test — the document that justifies the whole edifice — need not be published, need not be shown to the person affected, and in most cases is only ever read by a supervisory authority after a complaint. Accountability requires the company to be able to demonstrate it. Nothing requires it to volunteer it.
Two things narrow this in practice, and both are worth knowing. Reading or writing anything on someone's device is a separate question with its own answer, and that answer is usually consent regardless of the GDPR basis for what follows.Which is why a company can be entitled to process data under legitimate interests and still legally unable to collect it the way it wanted to. And the European Data Protection Board's opinion on AI models, adopted at the end of 2024, set out a structured way of testing whether legitimate interests can carry model training at all. It did not say no. It said: show your working, at three stages, and one of them is whether the person would reasonably have expected this.
Reasonable expectation is doing an enormous amount of load-bearing work for a phrase nobody can measure.
What to actually ask
Not whether the privacy notice mentions legitimate interests. It will.
Ask which purposes sit on it, ask to see the balancing test for the two that matter most, and ask when each purpose moved. A purpose that was on consent in 2023 and is on legitimate interests now was moved by somebody, in a meeting, with a paper. The paper exists.
The interesting question for the next two years is not whether regulators will accept legitimate interests for model training. Some will, on some facts. It is whether a person who objects under Article 21(1), and receives a reply asserting compelling grounds, has anything left to do that does not involve eighteen months and a lawyer.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Regulation (EU) 2016/679 (GDPR), Articles 6, 7 and 21The mechanism this piece rests on: Article 6(1)(a) and 6(1)(f) as alternative bases, Article 7(3) on withdrawal, Article 21(1) and 21(2) on objection. We have paraphrased throughout and quoted only two operative phrases. An editor should read 21(1) off the consolidated text before this runs — the piece turns on the fact that the burden there sits with the controller and the exception is drawn narrowly.
- Placeholder: EDPB Opinion 28/2024 on personal data processing in AI modelsAdopted December 2024, and the reason the legitimate-interests question moved from advertising to model training. We have described its three-stage approach rather than quoted it. Verify the opinion number and date before publication; if either is wrong, cut the sentence rather than fix it.
- Placeholder: Directive 2002/58/EC (ePrivacy) on storage and access on terminal equipmentCited here for one point only — that reading or writing on a device is a separate consent question from the GDPR basis for what happens next. Check the article reference before printing it.
Reporting Attributed, not relied on. Where the reporting is the fact, it says so.
- Placeholder: national supervisory authority guidance on switching lawful basisAttributed if used. Nothing in this piece rests on it.
Lead Pointed us at the story. Nothing here is cited as authority.
- Placeholder: the platform privacy-policy changes that prompted this pieceSeveral large platforms have moved advertising and model-training purposes onto legitimate interests since 2024. We have deliberately named no company and quoted no clause: we cannot verify current policy wording from this desk, and a paraphrase presented as a quotation would be worse than silence. If the piece is to name a platform, someone must pull the current text and the archived prior version and put both in front of the editor.