The six under the GDPR
- Consent: freely given, specific, informed, unambiguous
- Contract: necessary to perform a contract with the data subject
- Legal obligation: required by law
- Vital interests: to protect someone’s life
- Public task: an official function or public interest
- Legitimate interests: yours or a third party’s, balanced against the individual’s rights
Choosing consent when another basis fits better is a common and expensive mistake, because consent can be withdrawn and the processing then has to stop. Billing records should not depend on a checkbox.
Two questions, not one
The cookie question comes first
Article 5(3) of the ePrivacy Directive requires consent for storage and access regardless of which basis you would use for the data afterwards. You cannot legitimate-interest your way past it. Once the information is lawfully on hand, the basis for what you then do with it is a separate analysis.
Common questions
Can legitimate interests cover analytics cookies?
Not the storage-and-access step in the EEA, which requires consent unless an exception applies. Legitimate interests may be relevant to subsequent processing after information has been lawfully obtained, but that is a separate, narrower analysis.
Does every regime work this way?
No. Brazil lists ten bases and has no separate storage rule. Switzerland treats lawful processing as the default and requires consent only in defined situations. The jurisdiction pages describe each one.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Regulation (EU) 2016/679 (GDPR)
Legislation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.