Balancing interests in EdTech when is the lawful basis of "legitimate interests" justified?

As of September 2, 2021, all organisations that provide online services that are likely to be accessed by children must comply with the Age-Appropriate Design Code (the Code). One of the key points the Code provides concerns choosing an appropriate lawful basis for data processing activities. Organisations must have a valid lawful basis to process personal data. Establishing the lawfulness of the processing is a starting point before assessing whether other rules under the UK General Data Protection Regulation (UK GDPR) apply. This means organisations can’t start processing personal data without having an appropriate lawful basis.