Legitimate Interest

Short answer

Legitimate interest is a lawful basis under GDPR that allows personal data to be processed without consent when an organization's interest is balanced against, and not overridden by, the individual's rights and freedoms. Using it requires a documented balancing test, and it is generally not accepted for intrusive tracking or targeted advertising.