- The Court of Justice did not abolish legitimate interests for advertising. It set three conditions and applied them. [1]
- It quoted recital 47 approvingly: direct marketing may be carried out for a legitimate interest. [1][2]
- It then held that a free network’s users cannot reasonably expect personalized advertising without consent, so 6(1)(f) did not cover it. [1]
- The UK left direct marketing out of its new list of recognised legitimate interests, which has five entries, none commercial. [3]
- It named direct marketing in operative text under the ordinary ground instead, which keeps the balancing test. [3]
- The ICO adds the constraint that decides most cases: this works for direct marketing only where PECR does not require consent. [4]
- The artifact that settles all of it is a written legitimate interests assessment, which almost nobody in marketing keeps. [4]
Two sentences about European privacy law circulate in marketing teams, and both are wrong in the same direction. The first says the courts killed legitimate interests for advertising, so everything now needs consent. The second says Britain went the other way and handed direct marketing a free pass. Neither survives ten minutes with the texts, and the gap between the folklore and the documents decides whether your setup is defensible or resting on a legal basis nobody wrote down.
01What the Court actually ruled
The judgment everyone gestures at is Case C-252/21, Meta Platforms and others against Bundeskartellamt, decided by the Grand Chamber on July 4, 2023. [1] It runs to eight operative points, and the fifth is the one about legitimate interests.
It holds that collecting a social network user’s data from other services in the group or from third-party sites and apps, linking it to their account and using it, can be necessary for legitimate interests “only on condition” that three things hold: the operator has informed users of the interest pursued, the processing is carried out “only in so far as is strictly necessary” for it, and a balancing of the opposing interests shows that the users’ rights “do not override that legitimate interest.” [1]
Three limbs, and the same test the regulation always described. What the Court did was refuse to let a controller skip any of them. The ruling is not “you cannot use legitimate interests.” It is “here is what using it requires, and you must show your work.”
That matters because of what comes eighty paragraphs earlier. At paragraph 115, dealing directly with advertising, the Court recalls that according to recital 47, processing for direct marketing purposes may be regarded as carried out for a legitimate interest of the controller. [1][2] That sentence was there before the judgment and is there now, cited as the starting point rather than an error to correct.
The Court then applies the second and third limbs to the facts in front of it, and those facts are not a company emailing its own customers.
In this regard, it is important to note that, despite the fact that the services of an online social network such as Facebook are free of charge, the user of that network cannot reasonably expect that the operator of the social network will process that user’s personal data, without his or her consent, for the purposes of personalised advertising. In those circumstances, it must be held that the interests and fundamental rights of such a user override the interest of that operator in such personalised advertising by which it finances its activity, with the result that the processing by that operator for such purposes cannot fall within the scope of point (f) of the first subparagraph of Article 6(1) of the GDPR.
Court of Justice of the European Union, Case C-252/21, paragraph 117
Three things are load-bearing there and none is the word advertising. Reasonable expectation, which the Court takes from recital 47 itself. Scale, which the next paragraph describes as potentially unlimited data with a significant impact on the user. And provenance: other services in the group, and visits to third-party sites. Change those three and the answer changes. A retailer emailing a customer about a category that customer has bought from is a different object in law from a network assembling a profile across properties the user never connected to the account.
The judgment also supplies the remedy that became an industry. Users must be free to refuse individually without having to stop using the service, “which means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations.” [1] That clause, paragraph 150, is the origin of every consent-or-pay wall you have clicked through since.
02What the UK actually changed
Now the other half of the folklore. The Data (Use and Access) Act 2025 is routinely described as having made direct marketing a recognised legitimate interest in the UK, which would mean no balancing test at all. That is not what it does, and the correction matters because the claim reads as a green light.
Section 70 amends Article 6 of the UK GDPR in three moves. [3] It inserts a new lawful basis at Article 6(1)(ea), processing necessary for a recognised legitimate interest. It adds Article 6(5), which says processing qualifies under that basis only if it meets a condition in Annex 1. And through Schedule 4 it inserts Annex 1 itself, which was not in force at Royal Assent and commenced on February 5, 2026 by S.I. 2026/82. [3]
Annex 1 holds five conditions: disclosure for a purpose described in Article 6(1)(e), national security and public security and national defense, emergencies, crime, and safeguarding a vulnerable individual. [3] Direct marketing is not there. Neither is anything commercial.
What the Act did for marketing sits one paragraph further down, in new Article 6(11): “For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include (a) processing that is necessary for the purposes of direct marketing”, along with intra-group transmission and network security. [3]
Paragraph 1(f) is the ordinary ground, the one with the balancing test. So the UK took a statement that already lived in a recital, gave it operative force, and deliberately kept it out of the list that skips the test. That is a real change, because a recital is interpretive and operative text is not. It is also far smaller than the commentary suggests.
The ICO, in guidance updated March 23, 2026 to reflect the Act, draws the line in one sentence: “Legitimate interests is different from the recognised legitimate interest lawful basis.” [4] It names what the UK GDPR now lists as potential legitimate interests, which are IT security, direct marketing and intra-group transmissions, then attaches the condition that decides most real cases: legitimate interests can apply for direct marketing but only where the Privacy and Electronic Communications Regulations do not require consent. [4] For email, texts and telephone marketing, PECR binds the channel, and no lawful basis under the UK GDPR releases you from it.
03The same test on both sides of the Channel
Put the two regimes next to each other and the divergence narrative largely dissolves.
| EU | UK | |
|---|---|---|
| Direct marketing named as a possible legitimate interest | Yes, recital 47 [2] | Yes, Article 6(11) operative text [3] |
| Balancing test required for it | Yes [1] | Yes, it sits under 6(1)(f) [3] |
| A route that skips the balancing test | No | Yes, Annex 1, five conditions, none commercial [3] |
| Cross-service profiling for advertising | Fails the balance on the facts of C-252/21 [1] | Not addressed by the Act |
| Electronic marketing channels | ePrivacy rules decide | PECR decides, and it overrides the basis [4] |
At platform scale the European Data Protection Board has drawn the consequence. In Opinion 08/2024, adopted April 17, 2024, it concluded that in most cases large online platforms will not be able to comply with the requirements for valid consent if they confront users only with a choice between consenting to processing for advertising built on tracking and paying a fee, and said platforms should consider an equivalent alternative that does not entail a fee. [5][6] It also stressed that consent does not release a controller from purpose limitation, data minimization and fairness. [5] Consent is not a key that unlocks the rest of the regulation, and getting it does not make an oversized collection proportionate.
04The artifact almost nobody has
Everything above converges on one document, and most marketing teams do not have it.
The ICO sets out the three-part test plainly: identify a legitimate interest, show that the use of personal information is necessary to achieve it, and balance it against the interests, rights and freedoms of the person whose information you want to use. [4] It names the record of that reasoning a legitimate interests assessment, says you should do it before you start processing and record it to demonstrate compliance, and describes it as light-touch and sometimes quite short. [4]
Short is the word to notice, because length was never the obstacle. Writing one forces a team to say out loud what data it is using, where that data came from, and why a customer would not be surprised. Those three sentences are exactly what gets skipped when a segment is assembled in an afternoon.
So the practical question is not “is this marketing.” Would this person, given their relationship with us, expect this? Did any of the data come from watching them somewhere they never connected to us? Does PECR demand consent for the channel regardless? [7] And can we show the reasoning to somebody who was not in the room?
Sort your processing by those four questions rather than by the department that owns it. A customer list built from purchases, used to tell those customers about related products, sits near the center of what recital 47 contemplates and survives a written assessment comfortably. An audience assembled from third-party signals about behavior on sites with nothing to do with you is what paragraph 117 described, and it fails the same test on either side of the Channel.
That is the whole divergence, and it is smaller than the headlines. The EU wrote a judgment about where the balance tips. The UK wrote the starting point into the statute and left the balance where it was. Nobody removed the test, and the people exposed are the ones who never ran it. The paperwork is also only half the job: the other half is technical, which is what a half-configured consent signal turns into a reporting problem downstream.
Sources
- Court of Justice of the European Union · Case C-252/21, Meta Platforms and Others v BundeskartellamtGrand Chamber, July 4, 2023. Operative point 5 on legitimate interests, paragraphs 115 and 117 on advertising, paragraph 150 on the alternative offered for a fee, and operative point 8 on dominance and consent.
- European Union · Regulation (EU) 2016/679, the General Data Protection RegulationRecital 47, where direct marketing is named as a purpose that may be carried out for a legitimate interest, and Article 6 itself.
- UK Parliament · Data (Use and Access) Act 2025, Schedule 4The inserted Annex 1 and its five conditions, with the commencement note recording that it came into force on February 5, 2026 by S.I. 2026/82. Section 70 carries the Article 6 amendments, including paragraph 11.
- Information Commissioner’s Office · Legitimate interestsUpdated March 23, 2026. The three-part test, the distinction from recognised legitimate interest, the PECR constraint on direct marketing, and the legitimate interests assessment.
- European Data Protection Board · Consent or pay models should offer real choiceApril 17, 2024. The conclusion that in most cases such a binary choice will not produce valid consent, the equivalent-alternative recommendation, and the reminder that consent does not displace the other principles.
- European Data Protection Board · Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platformsThe opinion itself, adopted under Article 64(2) at the request of the Dutch, Norwegian and Hamburg authorities.
- Information Commissioner’s Office · Direct marketing guidanceWhere the PECR rules for electronic mail, texts and calls are set out, which is the constraint the lawful basis does not remove.
Frequently asked questions
Did the Court of Justice ban legitimate interests for advertising?
No. In Case C-252/21, decided on July 4, 2023, the Court ruled that legitimate interests can cover the processing at issue only if the controller informed users of the interest pursued, processed only what was strictly necessary for it, and the balancing of opposing interests came out in the controller’s favor. That is a conditional test, not a prohibition. The prohibition in that case came from applying the test to those facts.
What did the Court say about personalized advertising specifically?
At paragraph 117 it held that a user of a free social network cannot reasonably expect the operator to process their personal data for personalized advertising without consent, that the user’s interests and rights override the operator’s interest in financing its activity that way, and that the processing therefore cannot fall within Article 6(1)(f). The reasoning rests on scale, on cross-service collection, and on what a user would expect.
Does recital 47 still say direct marketing can be a legitimate interest?
Yes, and the Court quoted it. At paragraph 115 the judgment recalls that according to recital 47 of the GDPR, the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest of the controller. Nothing in the judgment removes that. What follows it is the reminder that necessity and balancing still have to be satisfied.
Did the UK make direct marketing a recognised legitimate interest?
No, and this is the most common error in circulation. Schedule 4 of the Data (Use and Access) Act 2025 inserts Annex 1 into the UK GDPR, listing five conditions: disclosure for an Article 6(1)(e) purpose, national security and public security and defense, emergencies, crime, and safeguarding vulnerable individuals. Direct marketing is not among them.
So what did the UK actually change?
It moved the recital-level statement into operative text. The amended Article 6 says that for the purposes of paragraph 1(f), examples of processing that may be necessary for a legitimate interest include processing necessary for direct marketing, intra-group transmission for internal administrative purposes, and processing necessary for network and information security. Those sit under the ordinary legitimate interests ground, which keeps its balancing test.
When did that take effect?
Schedule 4 was not in force at Royal Assent and came into force on February 5, 2026 by S.I. 2026/82. The new Article 6(1)(ea) and the Annex 1 mechanism arrive with it.
Does legitimate interest let me send marketing email without consent in the UK?
No. The ICO states that legitimate interests can apply for direct marketing but only where the Privacy and Electronic Communications Regulations do not require consent. PECR governs electronic mail, texts, and calls, and where it demands consent, a legitimate interests assessment cannot substitute for it. The lawful basis question and the PECR question are separate, and PECR is the binding one for the channel.
What is a legitimate interests assessment and do I have to do one?
It is the documented three-part test: identify the interest, show the processing is necessary to achieve it, and balance it against the rights of the person. The ICO calls it a legitimate interests assessment, says you should carry it out before you start processing, and says you should record it to demonstrate compliance. It is a light-touch risk assessment, sometimes short, and it is the artifact nearly every marketing team is missing.
Where does consent-or-pay fit into this?
It is the platform-scale version of the same argument. The European Data Protection Board’s Opinion 08/2024, adopted April 17, 2024, concluded that in most cases large online platforms will not be able to comply with the requirements for valid consent if they confront users only with a choice between consenting to processing for advertising based on tracking and paying a fee, and said platforms should consider an equivalent alternative that does not entail a fee.
What should a marketing team do differently on Monday?
Separate the processing into things a customer would expect from you and things built on watching them elsewhere, then write the assessment for the first group and find consent for the second. The dividing line in the case law is reasonable expectation and scale, not the label on the activity, so an audit that sorts by expectation will survive better than one that sorts by whether somebody called it marketing.
Mikołaj Salecki
Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.
