Investigating Deceptive Design in GDPR’s Legitimate Interest

Legitimate interest is one of the six grounds for processing data
under the European Union’s General Data Protection Regulation
(GDPR). The flexibility and ambiguity of the term "legitimate inter-
ests" can be problematic; coupled with the lack of enforcement from
legal authorities and different interpretations from the various data
protection authorities, legitimate interests can be taken advantage
of as a loophole to collect more user data.
Drawing insights from multiple disciplines, we ran two studies
to empirically investigate the deceptive designs being used when
legitimate interests are applied in privacy notices, and how user
perceptions line up with these practices. We identified six deceptive
designs, and found that the ways legitimate interest is applied in
practice does not match user expectations.