Privacy
Legitimate interest
Also called LI basis.
Legitimate interest is a GDPR lawful basis that rests on a balancing test rather than on a person's agreement. You may use it when your need is real and does not override their rights.
How it is measured
Run three steps and write them down: state the interest, show the processing is necessary for it, and balance it against the person's expectations and rights. The record is called a legitimate interests assessment.
People can object, and you must stop unless you show compelling grounds. Check that your notice names the interest and explains the right to object.
Worked example
A bike shop keeps checkout signals to block card fraud. Its assessment names the interest, shows chargeback losses of 2.4 percent of orders, and concludes customers expect fraud checks.
The same shop tries the basis for ad retargeting from browsing history. Buyers do not expect it, the balance fails, and the shop asks for consent instead.
How it differs
Legitimate interest is a basis you argue for. Consent is a basis the person grants. Interest excludes asking the person first; consent excludes any balancing done on your side.
Common errors
Using it as a fallback when consent is refused. Skipping the written test. Applying it to storing data on a device, which ePrivacy covers. Ignoring objections. Relying on it for sensitive categories.
In practice
Write one assessment per use, keep it on file, and link the notice to it. Do not use it to justify non-essential cookies.