Legitimate Interest (Article 6(1)(f)) for AI Training Data

Legitimate interest under GDPR Article 6(1)(f) is the legal basis most companies use to license personal data for AI training, and it holds only if the interest is lawful, the data are strictly necessary for it and the people's interests do not override it. A seller and a buyer each have to pass the test for their own purpose, and a court or regulator that finds a gap can order erasure of a dataset or a model.

The rule sits in Regulation (EU) 2016/679 (CELEX 32016R0679), applicable since May 25, 2018, and forms the legal basis layer of AI training data licensing. Rulings are stated as of November 9, 2026, and the proposed Article 88c is kept apart from the law in force.

What Article 6(1)(f) Allows and Who Relies on It in a Data License

Article 6(1)(f) allows processing that is necessary for the legitimate interests of the controller or of a third party, except where the interests or fundamental rights of the people in the data override them, in particular where "the data subject is a child". It is the usual basis for disclosing customer or user records to an AI buyer and for training on them, subject to the three-step test below. Consent and the other Article 6(1) bases are alternatives.

Two Controllers, Two Tests: The Seller's Disclosure and the Buyer's Training

A training data license involves two separate processing operations, the seller disclosing records and the buyer training on them, and each controller needs its own Article 6(1)(f) assessment for its own purpose. The seller's interest is license income, a commercial interest; the buyer's interest is model development, and the "third party" wording lets the seller's test take the buyer's interest into account.

Whether the seller may use the records for a new purpose at all is a separate Article 6(4) compatibility question. The other steps of a deal are summarized in the GDPR steps for AI training data.

The Three-Step Test Applied to a Training Data License

The three steps are the same for both sides of a deal, but the seller and the buyer answer them with different facts, as the table sets out.

The table compares both sides as of 2026-11-09; the source is Regulation (EU) 2016/679 Article 6(1)(f) and Case C-621/22.

The step names follow the article and C-621/22, not the Opinion's own paragraph wording.

Step One: A Commercial Interest Counts if It Is Lawful

A purely commercial interest, including payment for disclosing personal data, can be a legitimate interest: the Court of Justice held on October 4, 2024 in C-621/22 that the interest need not be laid down by law but must be lawful. In that case the Ninth Chamber decided that a tennis federation (KNLTB) disclosing members' data for consideration may rely on Article 6(1)(f) only if the disclosure is strictly necessary and the members' interests do not override it.

The Dutch Autoriteit Persoonsgegevens had fined the federation EUR 525,000 by a decision of December 20, 2019, as the judgment recounts. The Court did not rule on AI, so its reasoning reaches a license fee for training data by analogy only.

Step Two: Strict Necessity and Whether Less Personal Data Would Do

Necessity asks whether the interest could be served with less personal data or none, and the Court of Justice requires the processing to be strictly necessary. For a seller the question is whether redacted, pseudonymized or aggregated records would meet the buyer's need; for a buyer it is whether the model needs identifiable details at all.

Two German decisions show the question in practice. The Bundesarbeitsgericht (8 AZR 209/21, May 8, 2025) allowed testing with real staff data under Article 6(1)(f) only where dummy data do not suffice, and awarded EUR 200 in damages. The German data protection conference (DSK) resolved on September 11, 2024 that disclosing customer, supplier and employee data to a bidder before signing is in principle not permitted without consent, with legitimate interest possible for key persons in advanced negotiations. National staff-data detail sits on the page on employee data and AI training rules by jurisdiction.

Step Three: Weighing the Interests of the People in the Dataset

The balancing step weighs the controller's interest against the interests, rights and freedoms of the people in the data, and the article names children as a case where their interests weigh more. Expectations, content type and safeguards shape the weighing.

What People Could Expect, and From When

Courts look at what the people in the data could reasonably expect when their data were collected, and in the Meta case the Oberlandesgericht Köln took June 26, 2024 as the date from which users could expect AI training. On May 23, 2025 (15 UKl 2/25) it rejected a consumer group's interim application, holding that AI training can be a legitimate interest and that the balancing favored Meta on summary review. The main proceedings were not found as of November 9, 2026.

For a seller, records collected years before any AI use carry weaker expectations, and the date of a notice can matter.

Children, Private Messages and Sensitive Items in the Balance

Three kinds of content weigh against the controller in the balance: data about children, which the article itself singles out, private communications, and special category data, which need more than a legitimate interest. In its AI Insights Report of September 2026 the Irish Data Protection Commission (DPC) considers it unlikely that a controller can show that people expect their private messages to be used for AI training.

Article 9(1) data need an Article 9(2) exception on top of an Article 6 basis, and in C-252/21 (July 4, 2023) the Grand Chamber held that a set collected en bloc with at least one sensitive item is prohibited absent such a derogation. Depth sits on the page on special category data in AI training.

Safeguards That Move the Balance: Pseudonymization, Filtering, Objections

Safeguards taken before disclosure or training can tip the balance toward the controller, and the EDPB's draft guidelines on pseudonymization say risk reduction may support a legitimate interest. Guidelines 01/2025 exist as a consultation version only, with no final text as of November 9, 2026, and treat risk reduction as capable of supporting Article 6(1)(f) and Article 6(4). Filtering out children's data and special categories are practical options, and the legal effect of anonymization vs pseudonymization for AI training data differs.

Objections are disputed in practice. Meta states that objections are honored at any time (post as recorded March 27, 2026), while noyb's letter of May 14, 2025 says Meta limits the effect to objections made before training starts. The two claims are shown side by side and not resolved here.

What EDPB Opinion 28/2024 Says About Legitimate Interest for AI Models

EDPB Opinion 28/2024, adopted on December 17, 2024 under Article 64(2) at the request of the Irish supervisory authority, sets out how supervisory authorities assess whether a controller can show a legitimate interest for developing and deploying an AI model. It is soft law and does not bind courts. Questions 3 and 4 cover how controllers demonstrate legitimate interest and what unlawful development means for later use of the model.

Corrective measures can include erasure of the whole dataset and/or the model (paragraph 114), which reaches a buyer that trained on unlawfully disclosed data. The Opinion treats a model as anonymous only where extraction and query retrieval of personal data are insignificant, a test explained under when an AI model is anonymous.

National guidance adds to this. The CNIL's how-to sheets 8 and 8 bis on legitimate interest are non-binding (English summary page dated January 5, 2026), and the EDPB adopted Guidelines 03/2026 on web scraping on July 7, 2026 for consultation until October 30, 2026, not final.

Recording the Assessment Before Data Change Hands

A legitimate interest assessment is the written record of the three steps, and regulators look for it: the Irish DPC listed Meta's assessment among the measures it reviewed before Meta's planned EU training start on May 27, 2025, and the Garante fined a company in 2026 in a matter whose claims included a missing prior balancing test. The record usually covers four points:

• the interest and whose it is;
• why less data would not do;
• the balance and the people affected;
• the safeguards and objection handling.

The list is not a legal checklist. The record sits alongside the rights audit before licensing data.

Court and Regulator Decisions That Tested Legitimate Interest

Courts and regulators have tested legitimate interest for AI training and for data disclosure in a small set of decisions, and none concerns a company licensing its own records to an AI buyer.

The table lists seven decisions newest first as of 2026-11-09; status follows the court or regulator record, and the Garante order of 2026-04-17 concerns former-employee mailboxes, not AI.

The Tribunale di Roma upheld OpenAI's opposition; the Garante's notice does not say more, and no grounds or appeal status are stated here.

Pending, Not Law: Proposed Article 88c on AI Development

The Commission's Digital Omnibus proposal COM(2025) 837 of November 19, 2025 would add an Article 88c on legitimate interest for the development and operation of AI, and as of November 9, 2026 the European Parliament lists the procedure 2025/0360(COD) as "Awaiting committee decision". Until it is adopted, Article 6(1)(f) as written is the rule on this page. Procedure detail sits on the page on the EU Digital Omnibus and its GDPR changes.

Relying on Legitimate Interest: Benefits, Risks, Downsides and Alternatives, Including Not Selling

Legitimate interest lets a company license personal data without collecting consent from every person in the set, but the controller carries the burden of the assessment, and licensing only non-personal data or not licensing at all remain valid choices.

Benefits

• A commercial interest can qualify, as C-621/22 holds.
• No consent drive across a whole customer base, which also bears on should you sell or license your data.
• Safeguards such as pseudonymization count in the balance.

Risks

• A fine of up to EUR 20,000,000 or 4 % of total worldwide annual turnover, whichever is higher, under Article 83(5) of the Regulation, applicable since May 25, 2018.
• Erasure of the dataset or the model (Opinion 28/2024, paragraph 114).
• A fine where claims include a missing balancing test, as in the Garante order of April 17, 2026.

Downsides

• The outcome depends on facts, and soft law is still in consultation.
• Objection handling is disputed in practice.
• The Köln ruling was summary review only.

Alternatives

• License anonymized or non-personal data.
• Exclude children's data, private messages and special categories.
• Use consent for a narrower set.
• Wait for the outcome of COM(2025) 837, which may or may not pass.
• Do not sell or license at all; see also alternatives to selling data to AI labs.

Beyond Article 6(1)(f): The Other GDPR Steps and Related Rules

Legitimate interest is the first GDPR step in a data deal, and the steps after it and the related rules have their own pages. The full set is grouped under EU law for AI training data.

• AI training data law by jurisdiction
• Purpose compatibility when reusing data
• GDPR notices before a data sale
• DPIA for an AI data licensing deal
• Employee data under Article 88
• Transferring training data to US buyers
• Is web scraping for AI training legal, including the CNIL sheets on scraped data
• PII removal and de-identification, the step that supports necessity
• Employee notice and consent
• CNIL guidance on AI training data
• UK GDPR after the Data (Use and Access) Act 2025

How This Page Is Sourced and Dated

Every rule here cites the Official Journal text, a court judgment or a regulator's own document, with the date it was checked. The rules on how we source, date and check every figure apply. This page is general information about GDPR Article 6(1)(f), not legal advice for any specific deal.

Frequently Asked Questions

Does EDPB Opinion 28/2024 accept legitimate interest for AI models?

Yes, as a possible basis. Opinion 28/2024 of December 17, 2024 explains how supervisory authorities assess a legitimate interest for developing and deploying AI models. It is soft law, not a blanket approval.

Has a court accepted legitimate interest for AI training?

Yes, on summary review. The Oberlandesgericht Köln held on May 23, 2025 that AI training can be a legitimate interest. The main proceedings were not found as of November 9, 2026.

Does the UK apply the same legitimate interest rule?

Partly. The UK GDPR keeps Article 6(1)(f) and adds recognized legitimate interests in Article 6(1)(ea), in force since February 5, 2026, only where an Annex 1 condition is met.