The Difference Between Consent, Legitimate Interest, and Contractual Necessity

The Difference Between Consent, Legitimate Interest, and Contractual Necessity

GDPR is not only about asking users to accept cookies. Before collecting or using personal data, a business needs a lawful basis for the processing. Three bases are especially easy to confuse: consent, legitimate interest, and contractual necessity.

Each can be valid in the right context, but they are not interchangeable. Choosing the wrong basis can affect the information you give people, their rights, and how your cookie banner or Consent Management Platform behaves.

---

What is a lawful basis?

The GDPR requires organisations to have a lawful basis before processing personal data. The European Data Protection Board’s overview lists six bases: consent, contract, legal obligation, vital interests, public interest, and legitimate interests. Select the basis from the purpose of the processing—not after data has already been collected.

---

Consent explained

Consent is a freely given, specific, informed, and unambiguous agreement to process personal data. The ICO’s valid consent guidance explains that it needs a clear affirmative action.

Consent is often suitable where people have genuine choice and control: email marketing opt-ins, optional analytics cookies, advertising cookies, retargeting pixels, behavioural tracking, newsletters, and optional sharing with third-party marketing tools.

It should not be forced, hidden in unrelated terms, bundled, or assumed from silence. Pre-ticked boxes, vague wording, and “by continuing to browse” are not strong consent models. Withdrawal must also be as easy as acceptance. CookiePal can support consent banners, scanning, and auto-blocking when non-essential cookies need to wait for consent.

---

Legitimate interest explained

Legitimate interest may apply where an organisation has a genuine lawful interest, the processing is necessary for that purpose, and the individual’s rights and freedoms do not override it. The ICO describes a three-part legitimate interests assessment: a purpose test, necessity test, and balancing test.

Depending on the context, it can suit low-risk activities such as fraud prevention, website security, internal administration, certain B2B communications, limited analytics, or abuse prevention. It is not a shortcut around consent. Tracking cookies, advertising pixels, retargeting, and similar device technologies may still require cookie consent even if you consider a GDPR legitimate interest. People also have a right to object.

---

Contractual necessity explained

Contractual necessity applies where processing is needed to perform a contract with the individual, or to take specific pre-contractual steps at their request. The ICO’s contract guidance explains that the processing must be genuinely necessary to deliver the contract or requested step.

Examples include processing a delivery address to ship an order, payment details to complete a purchase, account details requested by the user, service messages, booking details, or contact details to answer a requested quote. It should not be stretched to cover general business goals: an order-confirmation email does not make promotional newsletters contractually necessary, and analytics cookies are not necessary for someone to read a website.

---

Comparing the three bases

| Lawful basis | Best suited to | User control | | --- | --- | --- | | Consent | Optional processing with a real choice | Can withdraw consent | | Legitimate interest | Necessary, fair, balanced business interests | Can object | | Contractual necessity | Processing needed for a contract or requested step | Tied to providing the service |

If processing is optional, consent may be the appropriate basis. If it is needed for a balanced business interest, legitimate interest may fit. If it is genuinely needed to provide the requested service, contractual necessity may apply.

---

How this affects cookie banners

Cookie banners concern cookies and similar technologies, not every type of personal-data processing. Still, the basis behind your tracking matters. Strictly necessary cookies may not need consent, but should be explained. Analytics, advertising, retargeting, and audience-building cookies commonly need consent before they run. Functional tools such as live chat or embedded video may also need it, depending on how they operate.

The ICO’s cookies guidance explains that consent can be required for storing or accessing information on a device unless an exemption applies.

---

Common mistakes to avoid

Using legitimate interest because consent rates are low

Low acceptance rates do not change the lawful basis. The basis depends on purpose and context, not the outcome a business wants.

Calling marketing contractual

A customer may need an account or receipt, but does not normally need promotional emails or retargeting to receive the service.

Asking for consent where there is no real choice

Where processing is genuinely necessary to provide the service, consent may not be the right basis.

Mixing purposes together

Security, service delivery, analytics, marketing, and personalisation are different purposes. Do not bundle them into a vague statement.

---

Practical checklist

Before choosing a lawful basis, ask what data you process, the exact purpose, whether it is optional or necessary, whether cookies are involved, whether the individual has a real choice and would reasonably expect the processing, whether you can use less data, what rights apply, and whether your privacy policy and cookie banner match the real setup.

---

Conclusion

Consent, legitimate interest, and contractual necessity solve different problems. Consent is for genuine choice; legitimate interest requires necessity and a fair balance; contractual necessity is for processing genuinely needed to deliver a contract or requested step. For cookies, advertising, analytics, and marketing tools, separate purposes clearly and ensure the explanation, choices, and website behaviour match.