European Union: European Data Protection Board closes consultation on recommendations on legal basis for requiring accounts on e-commerce websites (2/2025)

On 12 February 2026, the European Data Protection Board (EDPB) closes the consultation on the recommendations concerning the legal basis for requiring the creation of user accounts on e-commerce websites (2/2025). The recommendations address the common practice of e-commerce websites mandating user account creation to access offers or complete purchases. While controllers cite commercial interests such as facilitating sales or managing orders, the EDPB notes that such requirements can expose data subjects to additional risks to their rights and freedoms. The EDPB’s recommendations guide e-commerce controllers on the conditions for lawfully requiring account creation under Articles 5(1)(a) and 6 of the General Data Protection Regulation (GDPR). Specifically, they provide examples where mandatory account creation may or may not be necessary for contract performance (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), or for pursuing legitimate interests (Article 6(1)(f) GDPR). The EDPB concludes that mandatory account creation is justifiable for a very limited set of purposes, such as subscription services or exclusive offers. In many other scenarios, offering users the option to browse and purchase as a guest is presented as the most efficient and privacy-protective approach, aligning with the data protection by design and by default obligations under Article 25 GDPR.