A: Under GDPR (the EU's data-protection law) both are valid legal bases, but they cover different activities and one is far safer for our world.
Consent means the user actively opts in — a ticked box, freely given, specific, and withdrawable. It's the right basis for marketing, ad cookies, and passing data to third parties (which is exactly what affiliate lead-gen does). It's also the only basis regulators won't second-guess for ad tracking.
Legitimate interest lets you process data without explicit opt-in when you have a genuine business need that doesn't override the user's rights — fraud prevention and basic analytics are classic examples. But it requires a documented balancing test, and it does not stretch to cover selling or sharing leads with advertisers.
Practical split:
— Sharing a lead with an advertiser or network: consent, no exceptions.
— Running fraud checks on that lead: legitimate interest works.
— Ad/marketing cookies: consent, via your banner.
Short version: consent for marketing and any data-sharing, legitimate interest for fraud prevention and internal analytics. Don't use legitimate interest to dodge a consent box for lead-selling.
Still stuck? Drop your case in the comments.
Clean Traffic Desk
@CleanTrafficDesk
Q: For collecting lead data in the EU, should I rely on consent or legitimate interest?
This post was published in the Telegram channel Clean Traffic Desk. Subscribe here: @CleanTrafficDesk.