Right to Object

Legal Framework

The right to object is codified in Article 21 GDPR and gives data subjects a powerful mechanism to halt processing carried out under Article 6(1)(e) (public interest/official authority) or Article 6(1)(f) (legitimate interests). The right operates differently depending on the processing purpose.

For general processing under those legal bases, the data subject may object "on grounds relating to his or her particular situation," and the burden then shifts to the controller:

"The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims."
— GDPR Art. 21(1)

For direct marketing, the right is absolute: once the data subject objects, processing must stop—no balancing test applies. Article 21(3) makes this categorical. Recital 70 reinforces that this right applies "whether with regard to initial or further processing, at any time and free of charge." Controllers must explicitly bring the objection right to the data subject's attention at the latest at the time of first communication, presented clearly and separately from other information (Article 21(4)).

Crucially, the right to object does not apply when processing is based on consent. As the EDPB confirms, withdrawal of consent under Article 7 serves a similar function in that scenario.

Key Developments

The CJEU established early in Google v. Spain that the right to object operates alongside—rather than replaces—the lawfulness assessment under Article 6. The Court confirmed a data subject may "rely in certain conditions on the right to object laid down in subparagraph (a) of the first paragraph of Article 14 of the directive," even when the controller's lawful basis is already under challenge.

In Bavarian Lager, the CJEU addressed the interaction between the right to object and mandatory legal obligations. The Court held that where processing constitutes a legal obligation under what was then Article 5(b) of Regulation 45/2001, "the data subject does not, in principle, have a right to object." However, where an exception to that legal obligation exists, the impact of disclosure on the data subject must still be weighed. This confirms that the right to object is not available against processing required by law, but its protective logic can influence how exceptions to such obligations are applied.

The 2025 Mousse ruling (C-394/23) signals continued judicial engagement with Article 21, specifically in the context of data minimisation and the collection of title and gender identity data in online travel ticket sales—demonstrating that the right to object is being tested against novel data-collection practices.

Status of the Debate

This topic is actively contested in court. The boundaries of Article 21 are being fought over in several directions: the threshold for "compelling legitimate grounds" that override the data subject's objection, the scope of the absolute marketing objection, and how the right interacts with other legal obligations. Bavarian Lager established that mandatory legal processing excludes the objection right in principle, but left open how exceptions should be assessed. Mousse may clarify whether data minimisation failures create a presumption that an objection must succeed. No definitive court split is on record, but the tension between controllers' legitimate-interest arguments and data subjects' particular-situation objections remains unresolved at the CJEU level. A future ruling squarely addressing the evidentiary standard for "compelling legitimate grounds" would resolve the central open question.

Practical Guidance

• Distinguish the legal basis before responding. If processing relies on consent, Article 21 does not apply—direct the data subject to consent withdrawal. If processing relies on Article 6(1)(e) or (f), the objection triggers the Article 21(1) balancing test.
• Treat direct marketing objections as absolute. No balancing exercise is permitted; cease processing immediately upon receipt of an objection under Article 21(2).
• Prepare to demonstrate compelling legitimate grounds. Document the legitimate interest assessment and the specific grounds that override the data subject's situation, as the burden of proof rests on the controller.
• Surface the right proactively. At the latest at first communication with the data subject, present the objection right clearly and separately from other privacy information, as required by Article 21(4).
• Offer automated objection mechanisms for online services. Under Article 21(5), information society services must enable objections by automated means using technical specifications.