Updated ETGet the DI Daily by Email

Technology news for e-commerce professionals, with our take on why it matters.

EU privacy board says cross-site ad tracking will rarely pass legitimate interest test

EU privacy board says cross-site ad tracking will rarely pass legitimate interest test
Image: PPC Land

The final guidelines, adopted November 10, also treat personalized ads as direct marketing and say marketing profiling of children will generally fail.

7:33 pm ET

Source: PPC Land

The European Data Protection Board adopted the final version of its guidelines on legitimate interest under Article 6(1)(f) of the GDPR on November 10, 2026, more than two years after the draft, PPC Land reported. The guidelines say marketing that involves tracking individuals across multiple websites, locations, devices or services is a case where the balancing test "would be very unlikely to yield positive results." IAB Europe and FEDMA had asked the board to drop that position, and it did not, according to PPC Land.

The final text says case law suggests personalized advertising may be equated with direct marketing, which brings an unconditional right to object. It says consent would likely be the right basis for cookies, and that email, SMS, MMS, RCS and messenger marketing needs prior consent unless the ePrivacy soft opt-in for existing customers applies, in which case that rule alone is sufficient. Profiling for marketing and targeted ads aimed at children will generally fail; the draft's "extensive" qualifier was removed.

Citing a June 2026 court ruling, the guidelines say a company that knew or ought to have known data was collected unlawfully cannot collect it under legitimate interest. A new paragraph points to the board's Opinion 28/2024 for AI model development. The board gives sending the same catalog to existing buyers of similar products as an example of marketing that is easier to justify.

Read the full article at PPC Land

Our take

For EU commerce teams, this is the regulators' shared enforcement position, so legitimate interest is a weak footing for cross-site tracking, behavioral segments and bought audiences.

  • Audit which marketing and analytics processing relies on legitimate interest, and document each assessment.
  • Ask data brokers and enrichment vendors to show how their records were collected.
  • Watch the Digital Omnibus talks, which could change cookie and AI rules but have not concluded.

Was our take useful?

Key takeaways

  1. EDPB adopted final legitimate interest guidelines on November 10, 2026
  2. Cross-site tracking for ads is "very unlikely" to pass the balancing test
  3. Email, SMS, RCS and messenger marketing need consent unless soft opt-in applies