Explainer: What a Legitimate Interests Assessment Under GDPR Involves
· 2h ago · Originally reported by PPC Land
This piece breaks down the legitimate interests assessment (LIA), the documented analysis companies must complete before processing personal data under Article 6(1)(f) of the GDPR. It covers the three core steps: identifying a legitimate purpose, establishing necessity, and balancing that purpose against individuals' rights and expectations.
Why it matters
Ad tech firms frequently rely on the legitimate interests legal basis for data processing, and regulators expect a proper, documented LIA behind it. Getting this test wrong can invalidate entire data practices.
Explain it like I’m new here
Before using someone's info without asking, a company has to write down why it needs it and check it doesn't unfairly hurt that person — like showing your homework before borrowing a friend's bike.
Terms in this story
Legitimate interest
Legitimate interest is one of the GDPR's six lawful bases for processing personal data, allowing processing without consent when it is necessary for a genuine interest not overridden by the individual's rights.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
PII (personally identifiable information)
PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Go deeper
Related stories
GDPR lawful basis explained: the six grounds for processing personal data
This is an explainer of 'lawful basis,' the GDPR requirement that an organisation identify one of six legal grounds — such as consent or legitimate interests — before processing personal data. No news event, deal, or enforcement action is…
US web tracking lawsuits drive $1.4bn in 2026 settlements, healthcare firms hit hardest
A Privado analysis of 2026's web tracking-related settlements found US companies paid $1.4 billion to resolve such cases. Meta's tracking pixel appeared in 100 of 116 settlements reviewed, and healthcare firms accounted for 64% of…
Opinion: What Publicis' Ownership of LiveRamp Means for Brand Data Independence
An Adweek op-ed argues that holding companies acquiring data infrastructure like LiveRamp creates conflicts of interest, since one owner would control the plumbing that connects multiple competing brands to their customer data. The author…
Zee5 Rolls Out ZAP Privacy-First Audience Intelligence Tool for Advertisers
Zee5 has launched ZAP, a privacy-first audience intelligence product aimed at digital advertising. The tool is positioned to help advertisers understand audiences without relying on invasive data practices. Details on methodology and…
Marketers Weigh Pros and Cons After Publicis Completes LiveRamp Acquisition
Following Publicis' completed acquisition of LiveRamp, marketers are considering whether to continue using LiveRamp's services under its new ownership. The decision centers on how the acquisition may impact data connectivity, privacy, and…
Grindr Acquires HIV Prevention Provider Freddie for $250 Million
Grindr has acquired Freddie, a provider of HIV prevention services, for $250 million, with an additional $70 million contingent on 2027 performance. The deal enables US and Canadian users to access Freddie's services directly from Grindr's…