Every marketing team with European customers has a spreadsheet somewhere that says “legitimate interest” in a column next to a list of activities. Retargeting. Lookalikes. The partner list from last spring’s co-marketing webinar. The enrichment vendor that fills in job titles. Most of those rows were written once, by someone who has since left, and nobody has read them since.
On November 10, Europe’s privacy regulators finished the rulebook those rows are supposed to follow. The European Data Protection Board, the body where all the national data protection authorities sit together, adopted the final version of its guidelines on legitimate interest, the legal ground that lets a company use personal data without asking first. Two years after the draft, the final text reads less like a policy paper and more like an audit checklist for the data marketing actually touches.
The headline everyone will repeat is that cross-site ad tracking almost never qualifies. True, and not new. The part that should change what you do before Black Friday is quieter: the guidelines now make where your data came from, and what you told people when you got it, part of whether you can use it at all. That turns a legal question into an inventory question, and inventories are a marketing ops job.
What the board actually adopted
The document is Guidelines 1/2024, version 2.0, adopted November 10, 2026. Denmark’s regulator, Datatilsynet, confirmed the adoption on November 12, and PPC Land (November 12) compared the final text line by line with the 2024 draft. Legitimate interest still needs three things at once: a real interest, processing that is genuinely necessary for it, and a balance that does not tip toward the person whose data it is. The test has to be done and written down before the processing starts, not reconstructed when a complaint arrives.
The board also says legitimate interest is not a default you pick “because of a perception that it is less constraining than other legal bases.” If your team chose it because consent banners hurt opt-in rates, that is exactly the reasoning being described.
Not everything got stricter. Stockholm law firm Snellman calls the changes targeted flexibility: telling people that the balancing test is available on request is now only “advisable,” fraud prevention gets a more risk based reading, and the three step test is “largely unchanged.” Fair, but marketing is mostly where it did not land.
Tracking stays with consent, and the industry lost the argument
Paragraph 119 is the one ad tech lobbied against. The balancing test “would be very unlikely to yield positive results” for marketing that involves “intrusive profiling and tracking practices,” including “those which involve tracking individuals across multiple websites, locations, devices or services.” IAB Europe and FEDMA, the European direct marketing federation, both asked the board to drop or soften that line in the 2024 consultation, according to their submissions as quoted by PPC Land. The board kept it and added a reference to “large volumes of data for marketing purposes.”
Paragraph 114 closes the side door. Cookies and device access already need consent under the ePrivacy Directive, and the board says consent “would likely constitute the appropriate legal basis” for the processing that follows too, “which would normally preclude reliance” on legitimate interest. So the pattern where a consent banner covers the cookie and legitimate interest covers everything you do with what the cookie collected is, in the regulators’ reading, not going to hold.
Personalised ads now count as direct marketing
This is a small wording change with operational teeth. The draft said personalised advertising “could be considered” a form of direct marketing. The final text says Court of Justice case law “suggests that personalised advertising may be equated with direct marketing,” citing the Meta ruling of July 2023 and the Mousse ruling of January 2025.
Why it matters: the right to object to direct marketing is, in the board’s words in paragraph 121, “unconditional and irrespective of the legal basis relied on by the controller.” No reason needed, no balancing, no override. “It is enough that the data subject puts forth an objection for the objection to be successful.”
Most companies handle that objection in the email platform. An unsubscribe goes into a suppression list and the newsletter stops. If personalised ads are direct marketing, the same objection has to reach the customer list you upload to Meta, the CRM segment synced to Google, the retargeting pool, and the agency’s audience file. In plenty of stacks, those are four systems that never exchange objections at all.
Email, SMS, RCS: consent, unless they are already your customers
The channel list grew. Paragraph 113 says unsolicited direct marketing “by email, SMS, MMS, RCS, messenger and other kinds of similar applications can only take place with the prior consent” of the recipient, and that legitimate interest cannot be used for it. The 2024 draft named email, SMS and MMS. RCS and messaging apps are now spelled out, which matters in a season when brands are piloting rich messages for holiday promotions.
Here is the genuinely good news. The existing customer exception, usually called the soft opt-in, got stronger. If you collected someone’s contact details yourself in the course of a sale, you market your own similar products, and you offered a clear, free opt out both at collection and in every message, then paragraph 115, following the Court of Justice’s Inteligo Media judgment of November 2025, says that exception “is sufficient in itself as a legal basis.” No separate legitimate interest assessment is needed for the act of sending.
And paragraph 119 offers the board’s own picture of marketing that can pass: “sending the same commercial communication (e.g. a catalogue of products) to all existing customers who have already bought products similar to those that are advertised.” Read that closely. Same message, existing buyers, similar products. The further a campaign drifts from that picture, toward prospects, toward inferred interests, toward data assembled from elsewhere, the harder it gets.
Where the data came from is now part of the test
This is the change I would put at the top of any marketing ops agenda. A new footnote cites a Court of Justice judgment from June 18, 2026, NTH Haustechnik (C-484/24). The board summarises it this way: when a controller “knew, or ought to have known” that personal data passed to it “had been collected or stored unlawfully” by whoever supplied it, that “precludes the receiving controller from collecting this data in the pursuit of a legitimate interest.”
The case itself was an employment dispute about evidence taken from a former employee’s private eBay account, as EU Law Live summarised on the day of the ruling. The board has now lifted its principle into general guidance, and Snellman reads it as a reason to look hard at supplier diligence.
Count how much of a typical growth stack arrives from somebody else. Rented lists. Co-registration from a sweepstakes partner. Event badge scans shared by the organiser. Enrichment that appends job titles, company size or household data. Intent data. Lookalike seeds bought from a data marketplace. For every one of those, “ought to have known” is a standard about your diligence, not the vendor’s. A supplier who cannot tell you how a record was collected, when, and what the person was told is exactly the fact that makes “ought to have known” easy to argue against you.
There is a second provenance rule hiding in the same document. Citing the Mousse judgment, the board says a company must tell people about the legitimate interest it relies on at the time the data is collected, “otherwise that collection cannot be justified” on that ground. A privacy notice updated later does not fix a signup form that said nothing at the time. And meeting the information duties “is not sufficient in itself” to make processing expected. A long notice does not manufacture expectations.
Put together: for each EU audience you use, you need to know who collected it, under what wording, on what date, and what the person reasonably expected. That is an origin story, and most audiences do not have one written down.
Children and inferred traits got tighter too
Two smaller edits deserve a line each. On children, the draft warned about “extensive” profiling. The final text drops the qualifier: profiling for marketing purposes and targeted advertising “will generally not align” with the protection children are owed. Brands in gaming, beauty, snacks and fashion with large teen audiences should look at any lookalike or interest segment that could plausibly sweep in under 18s.
On sensitive data, what matters is whether it is “objectively possible” to infer something like health or religion, regardless of intent. Interest segments built from browsing are where that inference lives.
Why marketing owns this, not just legal
Legal decides what is lawful. But legal cannot answer the questions this document asks without facts that only marketing ops has: which segments feed which platforms, which lists came from which partner, what the signup form said two years ago, whether objections in the email tool reach the ad accounts. If marketing does not bring that inventory, the assessment gets written from assumptions, which is how most of the existing spreadsheets were written.
The enforcement record is not abstract either. Ireland’s Data Protection Commission fined LinkedIn €310 million in October 2024 over behavioural analysis and targeted advertising, finding among other things improper reliance on legitimate interest, as PPC Land recounts. A case digest the board commissioned, reviewed by PPC Land, found most controllers across 62 cross border decisions and five binding decisions failed the balancing test, most often on reasonable expectations.
And do not wait for Brussels to rescue you. The Digital Omnibus, the Commission’s package that would loosen some cookie rules, is still mid negotiation: EU ambassadors agreed the Council’s position on October 21, and Parliament had not adopted one, according to PPC Land. The guidelines adopted this week are what national regulators will apply in the meantime.
What to do this week
Black Friday is November 27. You will not rebuild your legal bases in two weeks. You can stop the riskiest sends, start the inventory, and make one structural fix.
Split your EU holiday send lists by origin before anything goes out. Three buckets: people who gave marketing consent, existing customers who qualify for the soft opt-in (you collected the address in a sale, the products are similar, the opt out was offered at signup and is in every message), and everyone else. “Everyone else” includes partner lists, event scans, sweepstakes entries and enriched prospects. That third bucket does not get email, SMS or RCS promotions this season unless someone can show consent.
Run your RCS and messaging pilots through the same split. A new channel is not a fresh start.
Write a provenance line for every bought, rented, shared or enriched data source you use in the EU: supplier, collection method, date, what people were told, and where that evidence lives. Any supplier who cannot fill that in gets three written questions: how was each record collected, what notice was shown, can you prove it per record. Hold renewals until the answers arrive.
Make objections travel. Pick one test contact, have them object to marketing, and trace whether that objection reaches every ad platform audience, CRM sync and agency file within a reasonable time. Whatever does not update is your structural fix for Q1.
Open your consent platform’s vendor list and filter for anything running profiling, cross device matching or measurement on legitimate interest. Send that list to legal with the board’s paragraph 119 attached and ask for a decision, not a review.
Look at your signup and checkout forms as they are today, and pull the archived versions behind your biggest EU audiences. If the form never said what you would use the data for, that audience’s origin story has a gap you should know about before a regulator finds it.
Agencies, send every client running EU audiences the three bucket split as this week’s ask.
The board spent two years on this, and the final text says the same thing in a dozen places: write it down before you do it. The cheapest time to find out you cannot explain where an audience came from is before you press send on it.
