Consent vs legitimate interest in marketing

Under the GDPR, personal data may be processed for marketing purposes, but—as with any processing—a lawful basis must be established. Two common options are consent and legitimate interests. Here is how they differ.

To process personal data for marketing you need one of the six lawful bases in Article 6 GDPR. In practice, consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f)) are usually the candidates for marketing. The correct choice depends on context—not on what is most convenient for the controller. This is the essence of consent vs legitimate interest.

Consent for electronic direct marketing

Consent is required in many scenarios under both the GDPR and national law. Under Section 19 of the Swedish Marketing Act, electronic direct marketing may only be sent where the recipient has given prior consent—unless the exemption for existing customer relationships applies.

• The exemption requires that the recipient provided their email address or telephone number in connection with a purchase.
• The marketing must concern similar products or services.
• The recipient must have been offered an easy unsubscribe option when the contact details were collected and in each marketing message.

Consent must meet the GDPR standard: it must be freely given, informed, specific and recorded. Pre-ticked boxes or inactivity are not valid consent. In short, consent must be informed and consent must be specific. These principles apply equally to email marketing consent and SMS marketing consent, and align with freely given consent GDPR, informed consent GDPR and specific consent GDPR requirements.

Legitimate interests and the balancing test

Legitimate interests may be used where there is an existing customer relationship or where the marketing is expected, relevant and limited in scope. This requires a documented legitimate interest balancing test demonstrating that the controller’s interests outweigh the data subject’s interests and rights. Keep the targeting proportionate and the impact minimal.

Advisory support for your lawful basis

Morling Consulting helps companies across Europe select an appropriate lawful basis for their marketing, with advice from an experienced GDPR lawyer. We assist with the legitimate interest balancing test, consent workflows for email and SMS marketing consent, and audit-ready documentation.