Someone no longer wants newsletters and advertising. Can we still balance interests?

No. For direct marketing the right to object is absolute: the data subject can invoke it at any time and you no longer process the data for that purpose (paragraphs 2 and 3). This also covers profiling you use for marketing, and the objection must be free of charge (recital 70).

Where and when do we have to mention the right to object?

At the latest at the time of the first communication with the data subject, and then explicitly, clearly and separately from any other information (paragraph 4, recital 70). A sentence buried deep in a privacy notice is therefore not enough. For online services the data subject must also be able to object by automated means (paragraph 5).

Article 21: Right to objectAI-relevant

Q: A customer objects to our processing based on legitimate interest. Do we always have to stop?

In principle, yes. Paragraph 1 says you stop the processing unless you demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or you need the data for legal claims. The burden of proof rests with you as the controller, not with the data subject (recital 69).

Praxikon tracks Article 21 (Right to object) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 21 gives you as a data subject the right to object to the processing of your personal data. That right applies when an organisation processes your data for a task in the public interest or on the basis of a legitimate interest (point (e) or (f) of Article 6(1)), including where profiling takes place, for example with an AI model that predicts your behaviour (paragraph 1). For direct marketing the right is absolute: once you object, the data may no longer be used for that purpose (paragraphs 2 and 3). The article exists because under these legal bases you never gave consent, yet you still need a way to stop the processing when your particular situation calls for it (recital 69). The controller must explicitly bring this right to your attention at the latest at the first communication, separately from any other information (paragraph 4).

Key term: Right to object: the data subject can ask the controller to stop processing their data, and the controller must then stop unless it demonstrates compelling legitimate grounds that override the data subject's interests

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Make sure you have a procedure to receive and assess objections for every processing operation based on point (e) or (f) of Article 6(1). After an objection you stop the processing, unless you can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or you need the data for legal claims (paragraph 1, recital 69). For direct marketing there is no balancing: after an objection the processing for that purpose stops (paragraph 3), and you point out this right clearly and separately at the latest at the first communication (paragraph 4).

Data Subject

You can object at any time to processing based on a public interest task or a legitimate interest, if you have reasons that relate to your own situation (paragraph 1). You can always object to direct marketing without giving a reason, and the organisation must then stop (paragraphs 2 and 3). For online services you can also do this through a technical setting (paragraph 5).

Compliance checklist

For every processing operation based on point (e) or (f) of Article 6(1), including profiling, it is recorded how an objection is received and assessed (paragraph 1).After an objection the processing is stopped, unless compelling legitimate grounds or legal claims are substantiated and documented (paragraph 1).An objection to direct marketing, including profiling for marketing, is honoured without any balancing of interests and the data are no longer used for that purpose (paragraphs 2 and 3).The right to object is explicitly brought to the data subject's attention at the latest at the first communication, separately from any other information (paragraph 4).For online services the data subject can also submit the objection through an automated, technical route (paragraph 5).For processing for scientific or historical research or statistical purposes under Article 89(1), it has been assessed whether objection is possible and whether the exception for a public interest task applies (paragraph 6).

Related recitals

(69)

Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the ...

(70)

Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to suc...

Cross-references

Art. 6: Lawfulness of processing Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (3)

7 December 2023 · C-26/22, C-64/22 · CJEU
SCHUFA (debt discharge)
A credit agency may not keep data on a debt discharge longer than the public register does. A supervisory authority's decision on a complaint is subject to full judicial review.
9 March 2017 · C-398/15 · CJEUDirective 95/46
Manni
There is in principle no right to have data erased from the companies register. Member States may only exceptionally, after a long period and case by case, limit access by third parties.
13 May 2014 · C-131/12 · CJEUDirective 95/46
Google Spain
A search engine processes personal data as a controller and falls under EU law through a sales establishment in a Member State. Data subjects can ask for results on their name to be removed, the origin of the right to be forgotten.

Guidelines (2)

8 October 2024 · v1.0 · EDPBConsultation version
Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
Describes the three steps for relying on legitimate interests as a legal basis: a legitimate interest, necessity and a balancing test.
7 July 2020 · v2.0 · EDPB
Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)
Describes on which grounds a person can ask a search engine to delist results about them and which exceptions apply.

Fines (1)

15 July 2021 · CNPD (Luxembourg)€746,000,000
Amazon: targeted advertising without a valid legal basis
Amazon processed personal data for interest-based advertising on the basis of legitimate interest, which was not a valid legal basis. It also fell short on informing users and on honouring rights such as access, rectification and erasure.
The administrative tribunal upheld the fine on 18 March 2025. On appeal, the Administrative Court annulled the decision on 12 March 2026 and sent the case back to the CNPD, because the CNPD had not assessed whether Amazon acted intentionally or negligently and had not weighed which corrective measure was most appropriate. The core findings of infringement were confirmed; the Article 21 complaints were held to fall outside the scope of the inquiry.

Line of case lawLegitimate interests and contract

When may you process without consent?

Rīgas satiksme (2017)Three cumulative conditions for legitimate interests.
Fashion ID (2019)In joint control each party needs its own legitimate interest.
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects (2019)Necessary for the contract is an objective test.
Meta Platforms v Bundeskartellamt (2023)Personalised advertising is not necessary for the contract.
KNLTB (2024)A commercial interest can be legitimate, but necessity stays strict.
Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (2024)The EDPB works out the three steps in guidelines.
Mousse (2025)The interest must have been communicated at collection.

Line of case lawThe right to be forgotten

When must information disappear from search results or registers?

Google Spain (2014)Basis for removing search results on your name.
Manni (2017)No general right to erasure from the companies register.
GC and Others v CNIL (2019)Sensitive and criminal data carry extra weight.
Google v CNIL (2019)De-reference in all EU versions, not necessarily worldwide.
Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) (2020)The EDPB describes the grounds and exceptions for search engines.
TU and RE v Google (2022)For manifestly inaccurate information no court ruling is needed.

Checked on 5 November 2026

Frequently asked questions

← Art. 20: Right to data portability Art. 22: Automated individual decision-making, including profiling →

Connections

Case law

Mousse: asking for Mr or Ms when selling a train ticket is not necessary
2025-01-09 · final, Hof van Justitie van de EU (Eerste kamer), Mousse tegen Commission nationale de l'informatique et des libertés (CNIL) en SNCF Connect

Guidelines

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)
2024-10-08 · under consultation, European Data Protection Board (EDPB)
Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · under consultation, European Data Protection Board (EDPB)

Legislation in motion

Proposal: consent and objection via machine-readable browser signals (new Article 88b GDPR)
2025-11-19 · under negotiation, Europese Commissie
Proposal: legitimate interest for development and operation of AI (new Article 88c GDPR)
2025-11-19 · proposal, Europese Commissie