The "Legitimate Interest" Myth: Why It Doesn't Cover Email Tracking

The myth, stated plainly

The myth goes like this: "Tracking email opens is a reasonable business activity. GDPR lets me process personal data under legitimate interest without consent, as long as I balance it against the recipient's rights. So I can run open-tracking pixels under legitimate interest and skip the consent hassle." It sounds reasonable. It's also the single most common misconception among senders — and it's wrong, for a reason that has nothing to do with how reasonable your interest is.

Why it's wrong: the two-layer problem

Email tracking triggers two separate laws at once:

Here's the trap: legitimate interest lives in layer 2. But the pixel's problem is in layer 1. You can have the most watertight legitimate-interest case in the world for using engagement data, and it does nothing to authorize the device access that ePrivacy governs. Layer 1 demands consent, and it demands it first — before you ever get to the GDPR question. Skipping consent because you have a legitimate interest is like having a valid driver's license but no car key: the license is real, it's just not the thing that starts the engine.

ePrivacy Article 5(3) has no legitimate-interest option

This is the crux, and it's blunt: ePrivacy Article 5(3) provides only two paths — consent, or a narrow "strictly necessary" exemption. There is no legitimate-interest basis in that provision at all. It doesn't exist. GDPR's six lawful bases (including legitimate interest) govern data processing; they are not available to satisfy ePrivacy's device access requirement. So when the pixel loads, your only lawful options are (a) the recipient consented, or (b) the pixel is strictly necessary to deliver a service they requested — and marketing performance measurement is not strictly necessary. Legitimate interest simply isn't on the menu.

Where legitimate interest does have a role

To be fair to the basis: legitimate interest isn't useless here. Once you've lawfully collected open data (i.e., with consent for the pixel), legitimate interest can be a valid GDPR basis for some downstream uses of that data. And for email sending itself to existing customers, the ePrivacy "soft opt-in" can apply in some jurisdictions. The point isn't that LI is meaningless — it's that it cannot substitute for the pixel consent. Get the consent for the device access first; then LI may have a role in what you do with the resulting data.

"But I did a legitimate interest assessment"

Some senders point to a documented legitimate interest assessment (LIA) as their justification. An LIA is good practice for GDPR processing — but it's answering the wrong question for the pixel. An LIA weighs your interest against the individual's rights for data processing under GDPR. It cannot create a legal basis that ePrivacy doesn't offer. A perfect LIA for open tracking is a well-argued answer to a question the law isn't asking at layer 1. It doesn't move the needle on whether the pixel needed consent — it did.

What to do instead

The fix is straightforward once the myth is cleared: get consent for the pixel, or don't fire it. Concretely — add a tracking opt-in at signup, re-permission your existing list, send pixel-free to non-consenters, and rely on aggregate or click signals where you want insight without per-recipient consent. For the practical decision path, see do you need consent to track email opens?, and for the full architecture of why the two layers exist, see the ePrivacy two-layer problem explained.

Frequently asked questions