Someone no longer wants newsletters and advertising. Can we still balance interests?

No. For direct marketing the right to object is absolute: the data subject can invoke it at any time and you no longer process the data for that purpose (paragraphs 2 and 3). This also covers profiling you use for marketing, and the objection must be free of charge (recital 70).

Where and when do we have to mention the right to object?

At the latest at the time of the first communication with the data subject, and then explicitly, clearly and separately from any other information (paragraph 4, recital 70). A sentence buried deep in a privacy notice is therefore not enough. For online services the data subject must also be able to object by automated means (paragraph 5).

Article 21: Right to objectAI-relevant

Q: A customer objects to our processing based on legitimate interest. Do we always have to stop?

In principle, yes. Paragraph 1 says you stop the processing unless you demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or you need the data for legal claims. The burden of proof rests with you as the controller, not with the data subject (recital 69).

Praxikon tracks Article 21 (Right to object) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 21 gives you as a data subject the right to object to the processing of your personal data. That right applies when an organisation processes your data for a task in the public interest or on the basis of a legitimate interest (point (e) or (f) of Article 6(1)), including where profiling takes place, for example with an AI model that predicts your behaviour (paragraph 1). For direct marketing the right is absolute: once you object, the data may no longer be used for that purpose (paragraphs 2 and 3). The article exists because under these legal bases you never gave consent, yet you still need a way to stop the processing when your particular situation calls for it (recital 69). The controller must explicitly bring this right to your attention at the latest at the first communication, separately from any other information (paragraph 4).

Key term: Right to object: the data subject can ask the controller to stop processing their data, and the controller must then stop unless it demonstrates compelling legitimate grounds that override the data subject's interests

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Make sure you have a procedure to receive and assess objections for every processing operation based on point (e) or (f) of Article 6(1). After an objection you stop the processing, unless you can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or you need the data for legal claims (paragraph 1, recital 69). For direct marketing there is no balancing: after an objection the processing for that purpose stops (paragraph 3), and you point out this right clearly and separately at the latest at the first communication (paragraph 4).

Data Subject

You can object at any time to processing based on a public interest task or a legitimate interest, if you have reasons that relate to your own situation (paragraph 1). You can always object to direct marketing without giving a reason, and the organisation must then stop (paragraphs 2 and 3). For online services you can also do this through a technical setting (paragraph 5).

Compliance checklist

For every processing operation based on point (e) or (f) of Article 6(1), including profiling, it is recorded how an objection is received and assessed (paragraph 1).After an objection the processing is stopped, unless compelling legitimate grounds or legal claims are substantiated and documented (paragraph 1).An objection to direct marketing, including profiling for marketing, is honoured without any balancing of interests and the data are no longer used for that purpose (paragraphs 2 and 3).The right to object is explicitly brought to the data subject's attention at the latest at the first communication, separately from any other information (paragraph 4).For online services the data subject can also submit the objection through an automated, technical route (paragraph 5).For processing for scientific or historical research or statistical purposes under Article 89(1), it has been assessed whether objection is possible and whether the exception for a public interest task applies (paragraph 6).

Related recitals

(69)

Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the ...

(70)

Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to suc...

Cross-references

Art. 6: Lawfulness of processing Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Frequently asked questions

← Art. 20: Right to data portability Art. 22: Automated individual decision-making, including profiling →

Connections

Case law

Mousse: asking for Mr or Ms when selling a train ticket is not necessary
2025-01-09 · final, Hof van Justitie van de EU (Eerste kamer), Mousse tegen Commission nationale de l'informatique et des libertés (CNIL) en SNCF Connect

Guidelines

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)
2024-10-08 · adopted, European Data Protection Board (EDPB)
Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · adopted, European Data Protection Board (EDPB)

Legislation in motion

Proposal: consent and objection via machine-readable browser signals (new Article 88b GDPR)
2025-11-19 · under negotiation, Europese Commissie
Proposal: legitimate interest for development and operation of AI (new Article 88c GDPR)
2025-11-19 · proposal, Europese Commissie