Purpose limitation is one of GDPR's seven data processing principles, established in Article 5(1)(b). It requires personal data to be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those original purposes. Organizations must define the purpose before collection, communicate it to data subjects, and restrict subsequent use to that declared purpose. Compatible secondary purposes such as scientific research may be permissible under Article 89, but commercial repurposing requires a new lawful basis and typically new consent. For cookie consent, analytics consent cannot be extended to justify marketing targeting with the same data.