Can personal data be processed through cookies based on legitimate interest?

ANSWER

Yes.

A distinction should be made between the obligation to obtain consent for the storage and reading of cookies in a user's browser (arising from telecommunications law) and the processing of personal data through cookies (e.g., analytics, profiling, etc.), which is fully subject to the GDPR.

Therefore, the controller must correctly identify the legal basis for processing personal data. In the context of cookies, this legal basis may be:

• the consent of the data subject;
• the controller's legitimate interest;
• processing necessary for the performance of a contract.

However, if the user does not consent to the storage and reading of cookies for specific purposes, those cookies cannot be used to achieve those purposes, regardless of the legal basis relied upon for the subsequent processing of personal data.