The right to object is a data subject right under Article 21 of the GDPR that allows a person to challenge the processing of their personal data when it is based on legitimate interests or on a task carried out in the public interest, and to stop processing for direct marketing at any time and without giving reasons. Among user rights in privacy law it is the main tool for contesting processing that an organization performs without consent.
The right works differently from consent withdrawal. Where processing relies on consent, a person simply withdraws it. Where an organization relies on its own legitimate interests or on a public task, no consent exists to withdraw, so the right to object gives the individual a way to force a renewed balancing of interests, and in the case of marketing, an unconditional stop.
When the right to object applies
The right to object depends on the legal basis of the processing. It applies to processing under Article 6(1)(e), a task in the public interest or official authority, and Article 6(1)(f), legitimate interests, including profiling based on those grounds. It does not apply to processing based on consent, a contract or a legal obligation, where other rights cover the situation.
| Legal basis | Can the person object? | Main alternative right |
|---|---|---|
| Legitimate interests | Yes, on grounds relating to their situation | Right to erasure after a successful objection |
| Public task or official authority | Yes, on grounds relating to their situation | Right to restriction during review |
| Consent | No objection needed | Consent withdrawal |
| Contract | No | Right to erasure once the contract ends |
| Legal obligation | No | Right of access and rectification |
| Direct marketing, any basis | Yes, absolute | Not needed, marketing must stop |
The three forms of objection
Article 21 contains three distinct objection rights with very different strength. Understanding which one applies decides whether the organization may refuse.
| Form | Scope | Can the controller refuse? |
|---|---|---|
| General objection | Processing under public task or legitimate interests | Only with compelling legitimate grounds or for legal claims |
| Direct marketing objection | Marketing and related profiling | No, processing for marketing must stop |
| Research objection | Scientific, historical research or statistics | Yes, if processing is necessary for a public interest task |
For the general objection, the person must give reasons relating to their particular situation. The burden then shifts: the controller must stop unless it demonstrates compelling legitimate grounds that override the person’s interests, rights and freedoms, or needs the data to establish, exercise or defend legal claims. Ordinary business convenience is not enough.
The direct marketing objection is absolute. Once received, the personal data may no longer be processed for marketing purposes, including profiling linked to marketing. The organization may keep minimal data, such as an email address on a suppression list, to ensure that marketing is not resumed.
Controller obligations and timelines
Controllers must make the right easy to exercise. The GDPR requires that the right to object is explicitly brought to the person’s attention at the latest at the first communication, presented clearly and separately from other information. In online services, people may exercise it by automated means using technical specifications, such as a browser signal, where the service supports them.
| Requirement | Rule | Practical meaning |
|---|---|---|
| Response time | Without undue delay, within one month | Extendable by two further months for complex cases |
| Information duty | Separate, clear notice | Not hidden in general terms or long policies |
| Cost | Free of charge | Fees only for manifestly unfounded or excessive requests |
| Restriction during review | Processing may be restricted | Data is held but not used while grounds are assessed |
| Erasure after success | Data may need deletion | No other basis remains for keeping it |
If the controller refuses, it must explain why and inform the person of the right to lodge a complaint with a supervisory authority and to seek a judicial remedy. Requests often arrive as part of a DSAR workflow, so privacy teams usually route them through the same intake process.
Right to object compared with related rights
The right to object is often confused with neighboring user rights. Each answers a different question, and a single request may combine several of them.
| Right | Core effect | Typical trigger |
|---|---|---|
| Right to object | Stops processing based on interests or marketing | Unwanted profiling or marketing |
| Consent withdrawal | Ends consent-based processing | Change of mind about newsletters or cookies |
| Right to erasure | Deletes personal data | Data no longer needed or unlawfully processed |
| Right to restriction of processing | Freezes use while a dispute is resolved | Accuracy or objection under review |
| Right to opt out | Stops sale or sharing under US state laws | Targeted advertising or data sales |
The right to opt out under laws such as the CCPA is functionally similar to a marketing objection, but it is defined around sale, sharing and targeted advertising rather than legal bases, and its scope varies between US states.
Common compliance mistakes
Regulators regularly find that organizations make objection harder than consent, or treat it as a simple unsubscribe. The following mistakes appear often.
- Relying on vague legitimate interests without a documented balancing test, which makes refusal impossible to justify.
- Requiring reasons for marketing objections, although none are needed.
- Stopping email but continuing profiling for marketing segments, which violates the objection.
- Deleting the suppression record, so the person is added back to marketing lists later.
- Missing the one-month deadline because requests arrive through unmonitored channels.
The short version
The right to object lets you say no to certain uses of your personal data. Some companies use your data because they believe they have a good business reason. If you disagree, you can object. The company must then stop, unless its reasons are truly stronger than yours.
For advertising, the rule is even simpler. If you object to marketing, the company must stop. You do not have to explain why.
Where it makes a difference
An online retailer uses purchase history to build profiles for personalized offers, relying on legitimate interests. A customer notices targeted offers about health products based on past orders and sends an objection through the privacy request form, covering both marketing and the related profiling.
Because the objection concerns direct marketing, the retailer has no room to refuse. Within two weeks it removes the customer from all marketing segments, stops profiling for offers and keeps only the email address on a suppression list. Order data needed for warranty and tax purposes is retained under its separate legal basis. The customer receives written confirmation, and the retailer documents the case in its request log.