– After Cookie consents became mandatory, some websites have suddenly added “legitimate interest” to their consent boxes, which are opt-out. What does “Legitimate interest” cover, and why is this allowed?
In: Technology
Legitimate interest is one of the legal grounds for collecting and using personal identifiable information.
It’s also the least clearly defined. Here’s an explanation from the UK’s ICO:
* the processing is not required by law but is of a clear benefit to you or others;
* there’s a limited privacy impact on the individual;
* the individual should reasonably expect you to use their data in that way; and
* you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.
Number 1 is pretty easy. #2 is not too hard. 3 and 4 are where it gets a bit slippery. So for example, in the Guardian website’s section on legitimate interest it says:
>We have a need to use your data for this processing purpose that is required for us to deliver services to you.
>* Personalised ads and content, ad and content measurement, audience insights and product development
with the option to opt out of this.
Now some questions: do most people reasonably expect their personal data to be used to provide personalised ads? This is particularly true if that data is being passed on to third parties, which is allowed by legitimate interest.
Are people unlikely to object to this processing? Given that this information and opt-out is in the same form as all their other cookie consents, is putting it on its own tab less “disruptive”? Is it not arguable more disruptive, making customers look at a second tab, rather than putting all information in one place?
So yeah, things are open to debate, and the details law and good practice on this will only be developed over time.
Latest Answers