An organization processes personal data to train an AI model for targeted advertising. Under GDPR, which legal basis is MOST appropriate for this processing activity?
Select an answer to reveal the explanation.
Short Explanation
You need consent because GDPR treats artificial-intelligence-based advertising profiling as a high-risk use of personal data. Get it freely, specifically, and clearly, and give people a real way to opt out.
Full Explanation
Consent, obtained freely and specifically for AI-based advertising profiling, with opt-out mechanisms, is most appropriate. GDPR requires explicit, freely given, specific, informed, and unambiguous consent for profiling used in targeted advertising, especially automated decision-making or profiling under Article 22. Legitimate interest without explicit consent requires a balancing test and is often challenged by regulators for advertising profiling. Contractual necessity does not apply because AI training for advertising is not necessary to fulfill a user service contract. The vital-interests claim that personalized advertising improves wellbeing applies only to life-threatening situations.