GDPR Legitimate Interest vs Consent AI

GDPR doesn't require consent for every use of personal data, it requires a lawful basis, and legitimate interest is a genuinely valid one for a lot of ordinary AI-assisted business activity. The instinct to add a consent checkbox to everything, out of caution, often creates unnecessary friction for a use case that legitimate interest already covers properly.

The plain-English answer

Whether you need consent or can rely on legitimate interest depends on the specific processing, not on the fact that AI is involved. An AI tool recommending products a customer might like, based on what they've already bought from you, is a reasonable candidate for legitimate interest, it's a natural extension of an existing customer relationship, not a surprising new use of their data. An AI tool that profiles customers for a purpose they wouldn't reasonably expect, or that processes sensitive categories of data, is a much harder case to justify under legitimate interest, and often needs consent instead.

Why this matters for your business

A 10-person retail business adding AI-driven product recommendations is exactly the kind of ordinary commercial use case that GDPR's legitimate interest basis was designed to accommodate, but a lot of businesses either default to consent everywhere out of caution, adding friction that doesn't need to exist, or assume legitimate interest applies without actually doing the required assessment, which is its own compliance gap.

Getting this right matters commercially, not just legally. An unnecessary consent checkbox on an ordinary product recommendation feature can measurably hurt conversion for something the customer would likely welcome anyway, while skipping the legitimate interest assessment entirely, even when the conclusion would have been fine, leaves you with no documented basis if a regulator or the customer themselves ever asks why their data was processed this way.

What GDPR actually requires

The European Data Protection Board's Guidelines 1/2024 on legitimate interest set out a three-part test. First, is there a genuine legitimate interest being pursued, commercial interests like personalising a service to an existing customer generally qualify. Second, is the processing actually necessary for that interest, not just convenient, if a less intrusive method would achieve the same goal, legitimate interest is harder to justify. Third, and most substantively, a balancing test: do the person's own rights, freedoms, and reasonable expectations outweigh your interest in the processing. The EDPB guidance points to factors like the nature of the existing relationship with the person and whether they'd reasonably expect this kind of processing given that relationship.

Consent works differently, and is the right basis where the processing genuinely needs the person's active, informed agreement, marketing to someone with no existing relationship to you, or processing that a reasonable person wouldn't expect from the context. Consent under GDPR also has to be a real, specific, opt-in choice, not a pre-ticked box or a buried default, which is part of why it's a heavier mechanism to rely on for routine processing than legitimate interest, when legitimate interest genuinely applies.

What this looks like in practice

Picture the marketing manager rolling out the AI recommendation tool, initially planning to add a consent checkbox to be safe. Working through the three-part test instead: the legitimate interest is genuine, offering a customer more relevant products is a normal part of running a retail business. The processing is necessary, the recommendation feature can't work without looking at purchase history. And the balancing test favours the business, a customer who's already bought from you would reasonably expect product suggestions based on that history, this isn't a surprising or invasive use of their data.

The outcome is a documented legitimate interest assessment, kept on file, rather than a consent checkbox that would have added friction to a feature most customers would find genuinely useful anyway. If the business later wanted to use the same purchase history to sell that data to a third party, a very different use case, the same test would very likely come out the other way, and consent would be the right call instead.

What you can do about it

A practical way to decide, and document, the right basis for an AI feature:

• Write down the specific interest the processing serves, and check it's genuine and not just a business convenience dressed up as necessity.
• Confirm the processing is actually necessary for that purpose, not simply the easiest option available.
• Run the balancing test explicitly: would the person reasonably expect this, given their relationship with your business, and does your interest outweigh any risk or intrusion to them.
• Document the assessment, even briefly, this is what a regulator or the person themselves would expect to see if ever asked.
• Default to consent instead when the relationship is thin, the use is unexpected, or sensitive data is involved, don't force legitimate interest onto a use case it doesn't genuinely fit.

If the AI tool also makes or influences a decision that significantly affects a specific person, beyond a product recommendation, it may also need a GDPR Data Protection Impact Assessment. See our guide on when a DPIA is required for an AI system.

Related reading: our AI governance by region.

Free tools: AI Privacy Risk Scorer to score your current AI tool setup against data-privacy best practice | AI Tool Selector to get a personalised AI tool recommendation for your business.