Many companies do not ask for your consent to use your data: they say they do so on the basis of their "legitimate interest". That is a legal basis recognised by the GDPR, but it is not an unlimited pass. The right to object, governed by Article 21 of Regulation (EU) 2016/679, is the tool designed precisely to restore the balance.
Two very different forms of objection
Article 21 actually contains two rights with different rules.
Objection on grounds relating to your particular situation
You can object at any time to the processing of your data when it is based on:
- the legitimate interests of the controller or a third party (Article 6(1)(f));
- the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e)).
In this case you must give grounds relating to your particular situation. The controller must stop processing the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or that the processing is needed for the establishment, exercise or defence of legal claims. The burden of proof lies with the controller, not with you.
Objection to direct marketing
Here the rule is much clearer. If your data is processed for direct marketing purposes, you can object at any time, including to profiling related to such marketing, without giving any reason. Once you have objected, the data may no longer be processed for that purpose. There is no balancing test and there are no exceptions.
Practical examples
- The loyalty card operator analyses your purchases to send you targeted coupons. You can object to profiling for promotional purposes without explaining why: the card will keep working for collecting points.
- Your energy supplier sends you promotional emails about its new services, arguing that you are already a customer. You can object and the emails must stop.
- An association you belong to publishes on its website the list of names of people who attended an event, invoking legitimate interest. You can object by explaining, for example, that publishing your name exposes you to unwanted contacts: it will be up to the association to demonstrate an overriding interest.
The duty to inform you
Article 21(4) requires the controller to bring the right to object explicitly to your attention, at the latest at the time of the first communication with you, presenting it clearly and separately from any other information. In commercial emails this usually takes the form of the unsubscribe link at the bottom of the message. A company that contacts you for marketing without offering a simple way to object is already breaching the rule.
In the context of online services, you can also exercise the right to object by automated means using technical specifications: for example, a profile setting that turns off personalised advertising.
How to object effectively
- Use the quickest channel. For emails, the unsubscribe link almost always works. For phone calls and text messages, tell the operator you object and then confirm in writing.
- Write to the controller when the quick channel is not enough. Give the details that identify you (email, phone number, customer code) and state that you object under Article 21 to processing for direct marketing and profiling.
- Specify the channels. Stating "email, SMS, phone calls, post and push notifications" avoids narrow interpretations.
- Keep evidence. If you receive further promotional messages after objecting, their dates and content will be useful for a complaint.
The controller must respond within one month, as Article 12 requires.
Objection versus withdrawal of consent
The two look alike but are not the same.
| Withdrawal of consent | Objection | |
|---|---|---|
| When it applies | Processing is based on consent | Processing is based on legitimate or public interest |
| Reason required | No | Only outside direct marketing |
| Effect | Consent-based processing stops | Processing stops unless there are compelling grounds; for marketing it always stops |
If you do not know which legal basis the company relies on, you can cite both in the same request: "I withdraw any consent I may have given and I object under Article 21".
After objecting
An objection blocks processing for the purpose you challenged, but it does not automatically mean all data is erased: the company might keep it for other legitimate purposes, such as managing your contract. If you also want erasure, you can request it in the same message: Article 17 expressly lists objection among the grounds that justify it.
In short
- Article 21 GDPR lets you object to processing based on legitimate or public interest, giving reasons relating to your situation.
- Against direct marketing and related profiling, the objection is absolute and needs no reason.
- The controller must inform you of this right clearly and separately, from the first communication.
- List every contact channel and keep evidence of any later messages.
- You can combine the objection with a request for erasure.