Legitimate interest is a GDPR Article 6(1)(f) lawful basis for processing personal data without consent. It requires a three-part test: the controller has a real business interest, the processing is necessary to achieve it, and that interest isn't overridden by the data subject's rights. It has to be documented in a Legitimate Interest Assessment (LIA), and data subjects retain the Article 21 right to object. Recital 47 explicitly recognises direct marketing as a possible legitimate interest. But there's a critical limit: for non-essential cookies, ePrivacy Article 5(3) is lex specialis — consent is required, and legitimate interest can't replace it.