Legitimate Interest (Analytics)

The three-part test

To rely on Art. 6(1)(f), the controller must document a three-part test: a legitimate purpose (understanding website use), necessity (the processing achieves the purpose), and balancing (the data subject’s rights do not override). The EDPB has accepted this reasoning for basic analytics provided the controller does not build per-user profiles, does not enable cross-site tracking, and stores no personal data beyond what is strictly needed for aggregate measurement.

Why GDPR is not enough

The common mistake: assuming a Art. 6(1)(f) DPIA replaces the cookie banner. It does not. ePrivacy Article 5(3) applies independently of GDPR’s lawful basis. Storing a cookie or reading localStorage requires consent regardless of how the data is processed afterward. Legitimate interest unlocks GDPR; ePrivacy still requires the banner.

When it does work

Art. 6(1)(f) becomes the right basis when paired with an architecture that does not trigger ePrivacy: no cookie, no localStorage, no device storage. Server-side aggregate measurement falls in this category — GDPR scope may or may not engage (if no personal data is processed, it does not), and ePrivacy explicitly does not. This is the legal foundation of consentless analytics: the analytics is lawful by architecture, not by paperwork.

Authority guidance

The CNIL, German DSK, AEPD, Italian Garante and UK ICO have all published guidance accepting legitimate interest for analytics — provided the architecture meets the exemption criteria (no per-user identification, no cross-site tracking, aggregate reporting, EU-only processing). The convergence makes legitimate interest the cleaner-than-consent path for analytics that is built correctly.