Legitimate interest

Functional and basic-stats cookies — think security, or remembering what’s in the shopping cart — can run on legitimate interest instead of consent. Legitimate interest means you may use the data without asking first, as long as it’s fair. High-impact cookies, such as tracking cookies, cannot use this — those need a “yes”.

What you must do when you rely on legitimate interest

• Weigh your interest (or another company’s) against the visitor’s interests, rights, and freedoms — and be able to prove you did.
• Still tell visitors clearly how you use their data.
• Let visitors object easily — make this simple, in the banner or by pointing to a privacy or cookie page. Don’t make them go looking for how to object.
• Make clear what each button or slider does, and what happens when you click it. If the effect is unclear, you may be breaking the privacy law (GDPR).

Caution

Don’t mix up the two legal reasons. A slider next to “legitimate interest” is confusing, because a “yes” doesn’t apply here — it’s unclear what turning it on or off does. And legitimate interest is not a valid reason for personalised ads.

If you say no to an objection

Show the visitor that you have strong, valid reasons to keep using the data that matter more than their interests, rights, and freedoms. Keep a record of the objection and your reasoning, so you can show both later.