UK GDPR legitimate interests analytics: a first-party guide

What to take away

The three-part legitimate interests test as the ICO sets it out

The first limb is easy for many UK marketing teams to articulate. Understanding which pages, campaigns and channels bring people to a site, and whether the site works, is a recognised business interest. The ICO accepts commercial interests, provided they are lawful, clearly articulated and not speculative.

The second limb is where weak assessments collapse. Necessity means no less intrusive route achieves the same result. If aggregate server logs answer your question, collecting a persistent cross-site identifier does not. The ICO expects you to name the less intrusive options you considered and explain why they fall short.

The third limb is the balancing exercise. You weigh the reasonable expectations of the individual against the impact of the processing. Expectations are shaped by context: what the site says, what the person came to do, and what a reasonable person in that position would anticipate.

The legal basis is Article 6(1)(f) UK GDPR. It permits processing necessary for the legitimate interests pursued by the controller or a third party, unless those interests are overridden by the individual's interests or fundamental rights and freedoms.

The ICO sets out its approach in Lawful basis for processing: legitimate interests. Its section “How do we apply legitimate interests in practice?” includes a legitimate interests assessment (LIA) template.

A useful discipline is to write the three limbs as three separate paragraphs before you write anything else. Assessments that merge them read as advocacy rather than analysis, and reviewers notice.

What necessity actually demands

Necessity is not the same as usefulness. The question is whether the processing is a proportionate way to achieve the stated interest, not whether it improves your reporting.

If your interest is stated as understanding campaign performance, you should be able to explain why the specific fields you collect are needed for that. Fields that exist because they were easy to capture are the usual failure point.

Why first-party analytics differs from advertising cookies under PECR

PECR sits alongside UK GDPR and applies to storing information on, or gaining access to information stored in, a user's device. That covers cookies, local storage, pixels and device identifiers. The lawful basis question and the PECR question are separate, and both must be satisfied.

PECR regulation 6 governs storing information, or gaining access to information already stored, on a user's device. It generally requires consent; regulation 6(4) provides an exception where the storage or access is strictly necessary to provide an information society service the user has explicitly requested. The ICO explains the rules in Guidance on the use of cookies and similar technologies.

First-party analytics often sits awkwardly between those poles. It is not strictly necessary in the way a basket cookie is: the site would function without it. But it is also not the same as cross-site advertising measurement, which builds profiles and targets people elsewhere.

That difference matters in practice. Advertising cookies raise expectation problems that first-party measurement usually does not. A visitor to a UK retailer's site expects the retailer to know which pages were viewed. They rarely expect that data to follow them to a newspaper or a social feed.

The distinction is not a free pass. PECR consent is still the default for non-essential storage, and the ICO has been clear that analytics cookies are not automatically exempt. What changes is the analysis you must do and the weight you give to expectations.

Where first-party analytics is genuinely aggregate, short-lived and used to run the service, the case is stronger. Where it feeds individual-level profiles, retargeting lists or long-term identity graphs, it is advertising measurement wearing an analytics label, and it should be treated as such.

This is also where the collection point matters. What you capture at the tag or endpoint determines what you can lawfully do later, which is why UK measurement rules start at the collection point rather than at the reporting layer.

Where PECR and UK GDPR meet

PECR governs the device. UK GDPR governs the personal data once it exists. A single analytics implementation can breach one and satisfy the other, or the reverse.

Across the UK, the same regulator enforces both regimes, and the ICO can issue fines and enforcement notices against marketing teams as well as technology suppliers.

In practice, teams that get this right treat the two as a single design decision rather than two sign-offs. The storage decision and the lawful basis decision are made together.

Applying the balancing test to an English ecommerce campaign

Consider a Manchester-based homeware retailer running a spring campaign across paid search, email and organic social. The measurement question is which channels drive first purchases, and how the path through the site affects conversion.

The worked example

Using a first-party web analytics platform configured for event measurement, the retailer wants to collect page views, referrer, campaign parameters, on-site search terms and purchase events, linked to a pseudonymous identifier that persists for 13 months.

Limb one: legitimate interest. Understanding which marketing channels produce sales, and improving the site experience for UK shoppers, is a genuine commercial interest. It benefits the business and, arguably, customers who get a better site.

Limb two: necessity. The retailer tests three alternatives. Aggregate server logs give channel totals but cannot connect a visit to a purchase. A short-lived session identifier gives path data but loses the return visit that most of its purchases involve. A consent-gated analytics tool would give the same data but with a much smaller sample, and the retailer cannot show that the smaller sample would answer the question. It documents all three.

Limb three: balancing. The retailer lists the reasonable expectations of a shopper arriving from a paid search ad: that the retailer will measure the visit and the sale. It then lists the impacts: persistent identification across 13 months, on-site search terms that could reveal sensitive intent, and any risk of the data being reused for advertising.

It mitigates. The identifier is pseudonymous and stored separately from contact details. On-site search terms are excluded from the analytics set because they can reveal health or personal circumstances.

The retailer reduces behavioural retention from 13 months to 90 days. In this worked example, the assessment records why 90 days is sufficient to answer the stated spring-campaign question; it is a purpose-specific decision, not a general benchmark. Purchase events are retained in aggregate. Retargeting is explicitly out of scope and prohibited by contract with the analytics vendor.

After mitigation, the retailer judges that the individual's interests do not override. The processing is limited, expected and short-lived. The assessment records that judgment and the reasoning behind it.

That example is not unusual. For UK ecommerce measurement, the outcome depends on the actual scope: narrowing collection and use can strengthen the balancing case, while broader tracking can weaken it. The mitigation is the decision.

Purpose limitation, retention and the accountability record

Legitimate interests is not a blank cheque for any later use. Purpose limitation applies: data collected to measure a campaign cannot quietly become a targeting input six months later. If the purpose changes, the basis must be reconsidered.

Retention is where most assessments are weakest. Teams state a period without justifying it. A defensible retention period follows from the purpose: if the question is campaign performance over a season, the data need not persist for years.

The accountability principle requires you to demonstrate compliance, not merely claim it. The ICO's Accountability and governance guidance sets out what that means in practice, including records of processing and the ability to show how decisions were reached.

People must also receive the transparency information required by Articles 13 and 14 UK GDPR, including the legitimate interests pursued. Under Article 21, they can object to processing based on legitimate interests on grounds relating to their particular situation; you must stop unless you can demonstrate compelling legitimate grounds or need the data for legal claims. Tell people about the right to object clearly and separately from other information, at the latest when you first communicate with them.

For measurement teams, the practical artefact is a data flow that a reviewer can follow from tag to report. Turning a measurement data flow into a UK GDPR record a reviewer can follow is the difference between an assessment that survives scrutiny and one that does not.

Keeping the record current

An assessment written once and filed is a liability. Campaigns change, vendors change, and the balancing exercise is sensitive to both.

Review the assessment when you add a channel, change a vendor, extend retention or introduce a new identifier. A short review note is enough if the reasoning has not moved.

When legitimate interests fails and consent becomes the only route

There are clear cases where the balancing test tips against the marketer, and no amount of narrowing saves it.

Session recording is a common failure in UK marketing teams. It can capture more than the team realises, including typed but unsubmitted form content, and the impact on the individual is hard to argue away.

Where consent is the only route, the practical consequence is scale. Consent rates for analytics in the UK are typically well below the whole audience, so measurement built on consent alone will undercount. That is a design problem, not a reason to stretch the basis.

Advertising measurement that uses personal data for targeting sits firmly in the consent camp, and the same logic applies to server-side tracking under UK GDPR, where moving collection off the browser does not change the lawful basis analysis.

The boundary in one line

If the processing would surprise the person it concerns, or if it follows them beyond your own site, assume consent.

Documenting a legitimate interests assessment for UK teams

A legitimate interests assessment is a short document with a fixed shape. It should take an afternoon, not a quarter, and it should be readable by someone who is not a lawyer.

The document should sit alongside your wider launch planning. It is one of the five decisions before you launch any measurement setup, and it is usually the one teams defer longest.

Keep it short. A three-page assessment that a reviewer can follow beats a twenty-page one nobody reads. The test is whether a colleague could reconstruct your reasoning from the document alone.

Finally, note the limits. A legitimate interests assessment does not remove the PECR question, does not authorise later repurposing, and does not protect you if the processing described in the document is not the processing you actually run.

Common questions