But if you can argue with legitimate interest (which is more burdensome), the person cannot decline and still use the service.
Choose: either easy basis and accepting that you might not get your way, or difficult basis and getting your way.
That‘s not how it works.
Now If I made a “communication tool” exclusively for registered gun dealers and people with valid (and verified) hunting licenses, it would in fact be perfectly legal. Similarly, if the tool were for use by government agencies and defense contractors or registered weapons manufacturers, it would also be legit.
In the context of “chat tool with personalized ads on the side” - there is nothing specifically illegal about “personalized ads”. Is there? (As long as there is user consent of course). So what’s the specific legal hurdle? Which paragraph of the GDPR prevents this?
Yes indeed, there is a list of reasons. I pick the one based on consent, because it seems the most relevant for a company. Process the users’ data, but get their permission first.
>The one that's useful for most companies is "legitimate interest”.
I would have thought that one was a bit nebulous. No one has given a hard and fast definition of that term. And rather than risk a court’s interpretation or benefit of the doubt, I figured it might be safer to rely on the consent approach.