Legal basis for processing refers to the lawful grounds under GDPR Article 6 that justify collecting or processing personal data. GDPR provides six legal bases: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Website operators must identify and document the correct legal basis for each processing activity before it begins. Switching between legal bases when one fails is a GDPR violation. For non-essential cookies — analytics, advertising, and personalization — consent is the required legal basis. Strictly necessary cookies may rely on legitimate interests or contract necessity instead and do not require banner consent.