Two Legal Bases, One Banner

Every vendor in an IAB TCF consent string declares, purpose by purpose, which legal basis it relies on: consent or legitimate interest. Both are lawful bases under Article 6 of the GDPR, but they behave very differently in a banner, in the TC string and in your ad stack. Publishers who treat them as interchangeable tend to discover the difference the hard way — usually as a vendor that stops bidding, or a complaint about a purpose the user thought they had refused.

This article compares the two side by side, purpose by purpose, so you can decide how to configure your CMP and what to expect from your demand partners.

How Each Basis Works

Consent is opt-in. The user must take a clear affirmative action, and until they do, the vendor may not process data for that purpose. Withdrawal must be as easy as giving consent. In the TC string, consent is recorded in the purpose consent and vendor consent sections.

Legitimate interest is effectively opt-out. The vendor (or publisher) asserts that it has a legitimate interest that is not overridden by the user’s rights, having carried out a balancing test. The user must be informed and given a way to object. In the TC string, this is recorded in the purpose legitimate interest and vendor legitimate interest sections, and an objection clears the relevant bits.

The Comparison at a Glance

• Default state — consent: off until the user agrees; legitimate interest: on until the user objects.
• User action required — consent: an explicit choice; legitimate interest: none, but an objection must be possible.
• Where it appears — consent is usually front and centre in the first layer; legitimate interest is typically explained and objectable in the second layer.
• Documentation — consent needs proof that it was given; legitimate interest needs a written balancing test (a legitimate interest assessment).
• Device storage — reading or writing cookies and similar identifiers falls under the ePrivacy rules, which require consent unless an exemption applies. Legitimate interest cannot replace that.

Which Purposes Allow Which Basis

The TCF does not let vendors choose freely for every purpose. The important rules to know:

• Purpose 1 (store and/or access information on a device) is consent-only. This mirrors the ePrivacy requirement for device storage.
• Purposes 3 to 6 — creating and using profiles for personalised advertising and personalised content — have been consent-only since TCF v2.2 removed legitimate interest as an option for them.
• Purposes such as 2 (limited data to select advertising), 7 (measure advertising performance), 8, 9 and 10 can still be declared under legitimate interest by vendors that choose to, and many ad tech vendors do so for measurement and basic ad selection.
• Special purposes, such as security and fraud prevention or technically delivering ads, are processed under legitimate interest and the user cannot object to them in the banner; they must still be disclosed.

Because each vendor declares its own bases in the Global Vendor List, two vendors doing the same thing can sit on different bases. Your CMP reads those declarations; you do not set them for the vendor.

Practical Consequences for Publishers

Revenue

Legitimate interest can keep some measurement and basic ad selection running for users who never interact with the banner. But personalised advertising depends on consent for Purposes 1, 3 and 4, so legitimate interest is not a substitute for a healthy consent rate. Do not plan revenue around it.

Your own processing

The TCF also lets the publisher declare its own purposes and legal bases. If you rely on legitimate interest for your own analytics or content measurement, you need the same balancing test and objection mechanism a vendor would. If those purposes involve cookies, the consent requirement for device storage still applies.

Regulatory scrutiny

Supervisory authorities and courts have repeatedly examined how legitimate interest is used in online advertising. In March 2024 the Court of Justice of the EU, in a case about the TCF, confirmed that a TC string can be personal data when it can be linked to an identifier. Treat every legitimate interest claim in your stack as something you may have to explain.

How to Configure Your CMP

1. Review your vendor list and note which vendors declare legitimate interest for which purposes. Remove vendors you do not actually work with.
2. Make objection easy. The second layer should show legitimate interest purposes clearly, with a working objection toggle per purpose and per vendor.
3. Decide on your own purposes. If your legal team is not comfortable with legitimate interest for a given publisher purpose, use consent or drop it.
4. Check the string. After an objection, decode the TC string and confirm the legitimate interest bits actually clear.
5. Ask partners how they behave when legitimate interest is objected to or consent is missing, so revenue changes do not surprise you.

Where FlexyConsent Fits

FlexyConsent is a Google-certified CMP, certified by IAB Europe and IAB Canada, and supports IAB TCF 2.4. It reads each vendor’s declared legal bases from the Global Vendor List, presents legitimate interest purposes with objection controls in the second layer, and encodes both consent and objections into the TC string your partners receive.

Key Takeaways

• Consent is opt-in; legitimate interest is opt-out with a mandatory right to object.
• Purpose 1 and the profiling purposes 3 to 6 are consent-only in the TCF.
• Legitimate interest never replaces consent for cookies or personalised ads.
• Vendors choose their own bases in the Global Vendor List; your CMP must display and honour them.
• Test objections by decoding the TC string, not by trusting the toggle.