Consent or legitimate interest: how to decide

There are two camps in the industry. One says: anyone who only identifies companies needs no consent, legitimate interest is enough. The other says: without consent in the cookie banner nothing runs at all. Both sides are partly right, because they are talking about different layers. This article separates the layers and gives you five questions at the end.

It is a sober assessment and not legal advice. For your specific setup, the decision belongs with your data protection adviser.

What applies first: access to the end device

Before the GDPR comes into play, a different question arises: does the script access the visitor's device? The ePrivacy Directive (Art. 5(3)) in principle requires consent for storing information in the end device and for reading such information. Excepted is what is technically necessary for the service expressly requested by the user.

This is implemented in § 25 TDDDG in Germany and in § 165 Abs. 3 TKG 2021 in Austria. Both rules apply regardless of whether personal data arises in the end. The access itself is decisive.

This affects more than cookies:

• An entry in the browser's session storage (sessionStorage) is storing in the end device.
• Reading screen size and browser language is reading information from the end device, even if each individual item seems harmless.
• Recordings of clicks and mouse movements are in any case nothing a visitor needs for the page to be displayed.

The German supervisory authorities take a strict line on this: reach measurement and analytics are generally not regarded as technically necessary. Anyone using a script that makes such accesses should therefore assume that consent is needed. This is not a matter of taste but the prerequisite without which the rest is never even reached.

Art. 6(1)(a) versus (f)

Only after that comes the question of which GDPR legal basis the subsequent processing relies on, to the extent that it is personal.

Whether an IP address is personal data at all is clarified in IP address and GDPR: is it personal data?. How the two tests fit together is shown in Visitor identification and GDPR: a sober assessment.

Consent (point a). It must be freely given, informed, specific and unambiguous. It can be withdrawn at any time. The legal position is clear here as soon as the banner is built properly.

Legitimate interest (point f). Here you check three things: is there a legitimate interest (such as initiating sales in B2B)? Is the processing necessary for it? And do the interests or fundamental rights of the data subjects not override? Recital 47 gives the reasonable expectations of the data subjects as the benchmark. According to the same recital, direct marketing can be a legitimate interest.

In addition there is the right to object under Art. 21: data subjects can object to processing based on point (f). You must make that practically possible. The information obligations under Art. 13 and 14 also apply in both cases.

Why behavioural data makes the balancing harder

A company assignment alone can often still be justified well in the balancing: the information is sparse. The purpose is clear. It becomes harder as soon as behaviour is added. Which pages someone reads, how long they scroll and where they click says a lot about a person, even if they appear only as a visitor from a company. A mouse recording shows even more. The finer the observation, the less visitors expect it. Accordingly it becomes hard to justify that your interest overrides.

A practical problem is added: even if you could win the balancing, it does not help you as long as the consent requirement for device access exists. The consent is then there anyway. There is much to be said for using it as the legal basis for the processing too, instead of maintaining two bases side by side.

The practical route: analytics category, script only afterwards

The solution that works most often in practice is simple:

1. Your banner has its own category, usually „Analytics“ or „Statistics“.
2. The visitor identification script loads only after the visitor has agreed to this category.
3. Without consent there is no access to the device and no request to the service.

Technically this works via your tag manager with Consent Mode or via your banner's consent management. You will find instructions for this in the help centre under Consent in the tag manager. Whovisit, for example, supplies a tag template that waits for the analytics consent to be granted before it loads the script. For the route to hold, however, your banner must actually map the category and pass the decision cleanly on to the tag manager.

Google Analytics as well usually runs behind the same category. What Analytics reveals about companies and what it does not is covered in Identifying companies with Google Analytics: what works and what does not.

Switzerland: opt-out logic

In Switzerland the starting point is different. The Telecommunications Act (Art. 45c) requires that users are informed about the processing of data on their device and can refuse it. So it is an objection solution instead of prior consent. The revised Data Protection Act (since 1 September 2023) also works in principle with transparency and an option to object rather than a general consent requirement.

If you have visitors from Switzerland and from the EU on the same site, the stricter law still applies to the EU visitors. In practice this means: a single banner with consent is usually the simplest route, also because you cannot reliably separate visitors by country.

Your decision path in five questions

1. Does the script access the device? (Storing or reading, including session storage, screen size, language.) If yes, you generally need consent for DE and AT. Continue with question 2.
2. Is the access technically necessary for the requested display of the page? With analytics and visitor identification, almost always no.
3. Does your banner have a category that fits the purpose? If not, adjust it before you add the script.
4. Does the script really load only after consent? Check in your browser's network tab: before consent, no request may go to the service.
5. Is the information in the privacy policy complete? Is there a way to withdraw? Purpose, legal basis, recipients, storage period.

If you answer question 1 with no, you can think about point (f). With procedures that access the end device, that is rarely the case in practice.

Sources

• Directive 2002/58/EC (ePrivacy), Art. 5(3)
• GDPR, Art. 6(1), Art. 13, 14, 21 and Recital 47
• § 25 TDDDG (Germany), § 165 Abs. 3 TKG 2021 (Austria)
• Art. 45c Telecommunications Act (Switzerland), Data Protection Act (Switzerland) as amended on 1 September 2023
• Guidance of the German Data Protection Conference for telemedia providers (current version)