Can you rely on legitimate interest for cookies?

Usually not. In the EU, the ePrivacy Directive requires consent before you store or read non-essential cookies, and it offers no legitimate interest alternative. Legitimate interest is a GDPR legal basis for processing personal data, so it can matter for data handled through a strictly necessary cookie, but it cannot justify analytics or advertising cookies on its own.

Why can’t legitimate interest replace cookie consent?

Because the rule that governs cookies is not in the GDPR. It is Article 5(3) of the ePrivacy Directive, which allows storing or reading information on a device only with consent or under two narrow exemptions, and legitimate interest is not one of them.

The confusion is understandable. Article 6 of the GDPR lists six legal bases for processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. Because cookies often involve personal data, it is tempting to reason that any of the six will do.

The flaw is that the ePrivacy rule is the more specific law for the act of accessing a device, and it applies even when no personal data is involved. So the question “may I set this cookie?” is answered by ePrivacy alone. The GDPR’s legal bases only come into play for what you do with personal data afterward. Our explainer on ePrivacy Directive vs. GDPR walks through this two-step logic.

What is legitimate interest under the GDPR?

Legitimate interest, set out in Article 6(1)(f), allows processing that is necessary for your legitimate interests or those of a third party, unless those interests are overridden by the individual’s interests or fundamental rights. It is flexible, but it comes with real obligations.

Relying on it means passing a three-part test, usually written up as a legitimate interest assessment:

• Purpose. Is the interest legitimate, clearly defined and lawful?
• Necessity. Is the processing actually needed for that purpose, or is there a less intrusive way to achieve it?
• Balancing. Do the individual’s rights and reasonable expectations outweigh your interest?

People generally have the right to object to processing based on legitimate interest, and you must tell them about it. Covert tracking across sites for advertising is hard to justify on balance, because most people do not expect it.

Where can legitimate interest still apply to cookies?

It can apply to personal data processed through cookies that are exempt from consent, and to processing that does not involve accessing the device at all. It cannot cover the device access itself for non-essential purposes.

Scenario	Storing or reading on the device (ePrivacy)	Processing the data afterward (GDPR)
Login session cookie	Exempt as strictly necessary	Usually contract; legitimate interest possible
Load balancing cookie	Exempt as strictly necessary	Legitimate interest is common
Security and fraud checks on a requested service	Often exempt if strictly necessary; check local guidance	Legitimate interest is common
Analytics cookies	Consent, unless a narrow national exemption applies	Consent is the safe default
Advertising and retargeting	Consent	Consent in practice
Server-side analysis without device access	Generally not triggered; check how data is collected	Legitimate interest may be possible

The top rows depend on the cookie genuinely being strictly necessary, and our guide to strictly necessary cookies covers where that line sits. The last row is the idea behind many cookieless analytics setups, though “cookieless” does not automatically mean “consent-free”.

One firm rule comes from the European Data Protection Board (EDPB), which coordinates EU regulators: you cannot swap legal bases after the fact. If you asked for consent and the visitor refused or later withdrew it, you cannot carry on with the same processing under legitimate interest.

How did IAB TCF 2.2 change legitimate interest?

Version 2.2 of the IAB Europe Transparency & Consent Framework (TCF), released in 2023, removed legitimate interest as a permitted basis for the advertising and content personalization purposes. That closed off the most common way legitimate interest appeared in cookie banners.

The TCF is an industry standard that many publishers and ad tech vendors use to collect consent choices and pass them along the advertising supply chain. Before version 2.2, many banners included a separate “legitimate interest” tab listing vendors and purposes that were switched on by default, with an option to object that few visitors ever found.

Under TCF v2.2, purposes 3 to 6 (creating profiles for personalized advertising, using profiles to select personalized ads, creating profiles to personalize content and using profiles to select personalized content) require consent. Purpose 1, storing or accessing information on a device, already required consent. Some measurement and product development purposes can still use legitimate interest within the framework, but that does not change what the ePrivacy Directive requires for the cookies themselves.

Version 2.2 also requires the number of vendors to be shown in the first layer of the banner. Our guide to IAB TCF 2.2 covers the remaining changes.

How should you handle legitimate interest in your consent setup?

Keep consent-based cookies and legitimate interest processing clearly separate, and never use legitimate interest as a fallback when consent is missing. A simple process helps:

1. Map every cookie and tracker to a purpose. Include tags loaded through tag managers and plugins.
2. Answer the ePrivacy question first. For each item, decide whether it is strictly necessary or needs consent. There is no third option.
3. Choose a GDPR basis for the processing that follows. Document it, and write a legitimate interest assessment wherever you rely on that basis.
4. Explain legitimate interest processing plainly. Describe it in your privacy notice and offer a simple way to object, rather than pre-enabled toggles buried in a second layer.
5. Respect refusals across bases. If a visitor rejects analytics, stop the analytics processing, not just the cookie.
6. Review when vendors change. New tools often arrive with their own assumptions about legal bases, which may not match yours.

Bottom line

Legitimate interest is a real GDPR legal basis, but for cookies it only operates downstream of the ePrivacy question, never in place of it. If a cookie is not strictly necessary, ask for consent. If it is, you can consider legitimate interest for the processing that follows, backed by a documented assessment. Tools like Cookiesh can hold analytics and marketing scripts until consent while letting necessary ones run, which keeps that line clear in practice.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.