Mandatory accounts for online purchases: the EDPB’s recommendations
E-commerce websites often require users to register before they can view certain offers or purchase goods and services. Controllers tend to justify this requirement on the basis of operational needs, such as completing a sale, activating a subscription to services, accessing promotions reserved for their users, or facilitating order management.
While recognizing that these purposes serve a commercial interest of e-commerce, the EDPB emphasizes that the obligation to create an account may entail additional risks to users’ rights and freedoms.
For this reason, the EDPB, with Recommendations 2/2025 – adopted on December 3, 2025 – has intervened to provide guidance to controllers active in the e-commerce sector on the conditions under which they may legitimately require their users to create an account, in accordance with Article 5(1)(a) and Article 6 of the GDPR.
Generally, when a website requires the creation of an account to view offers or make purchases, controllers refer to the legal basis of the performance of a contract (Article 6(1)(b) of the GDPR), legal obligation (Article 6(1)(c) GDPR) or legitimate interest (Article 6(1)(f) GDPR).
As regards the legal basis of the performance of a contract, the EDPB points out that it can only be invoked when the processing of data is actually necessary to perform a contract with the data subject.
Furthermore, it is specified that this legal basis must be interpreted restrictively and cannot be invoked when the processing is not actually indispensable for the performance of the contract, but is imposed unilaterally by the controller on the data subject. Therefore, the controller must demonstrate that the contract cannot be performed without that specific processing and that there are no less invasive and practically feasible alternatives to achieve the same result.
In the Recommendations, the EDPB proposes practical examples to clarify in which cases the legal basis of the performance of the contract may justify the obligation to create an account, with the aim of distinguishing cases in which, on the contrary, the creation of an account is merely a commercial choice of the controller.
With regard to the one-off sale of goods or services, the EDPB notes that the data necessary to complete the sale and manage the order can also be collected without requiring registration. The widespread possibility – offered by many e-commerce sites – of purchasing as a guest demonstrates that the purchase can be completed using alternative, less invasive methods.
The case is different for subscriptions and, more generally, services that involve an ongoing relationship over time (recurring payments or periodic services). Here, the creation of an account can actually be considered necessary, because it allows the user to access the subscribed content, monitor deliveries or activities, communicate securely with the supplier, and manage changes to the terms of service. In these cases, the account is not a simple commercial tool, but a functional element for the execution of the contract.
Moving on to the fulfillment of a legal obligation (Article 6(1)(c) GDPR), in order to rely on this basis, controllers must ascertain to what extent their existing legal obligations actually require processing activities related to the mandatory creation of an online account. These obligations must be clearly and precisely formulated, and their application must be predictable for data subjects. Furthermore, processing based on this provision must be proportionate to the legitimate purpose pursued: this implies that there must be no less invasive but equally effective alternatives. Even when the law requires the storage of personal data for contractual, tax, or accounting purposes (typically through documents such as invoices), this does not normally entail the need to also store all the data used to “create” such documents, nor, above all, to oblige the user to open an account. Similarly, the identification and possible authentication of the data subject to manage requests to exercise rights (e.g., the right of access under Article 15 of the GDPR) can be carried out without requiring registration. It follows that, in the circumstances described, it is difficult to rely on Article 6(1)(c) to justify the obligation to create an account, as the requirement of necessity required by that legal basis is rarely met.
The EDPB also clarifies that legitimate interest (Article 6(1)(f) GDPR) can only be invoked to justify mandatory accounts if the controller meets three cumulative conditions. Specifically, there must be a legitimate interest of the controller or a third party, the processing must be strictly necessary to pursue it (and not simply useful or convenient), and, finally, the balance between that interest and the fundamental rights and freedoms of the data subject must be favorable, also taking into account their reasonable expectations based on the context.
Applying these criteria, the EDPB has identified the possible purposes that controllers could invoke to impose the creation of a mandatory account and for which they could attempt to refer to the legal basis of legitimate interest.
In particular, it was noted that purposes such as order tracking or managing subsequent changes can be achieved with less invasive tools (e.g., via email), without storing data beyond the time necessary for delivery or shipment, and therefore are unlikely to pass the necessity and balancing tests. The same applies to loyalty and future purchase facilitation objectives: they often involve activities such as personalization and monitoring that require consent (also in light of ePrivacy legislation) and, in any case, do not make the account mandatory, because the same purposes can be pursued by alternative means, such as purchasing as a guest or creating an optional account, while the user does not reasonably expect their data to be retained longer than necessary for the execution of the purchase or service provided. Even when fraud prevention is invoked, while recognizing that the purpose may fall within the legitimate interest, the EDPB emphasizes that this does not automatically authorize any processing, as it must be demonstrated that the creation of the account is truly indispensable and proportionate, in line with data minimization, specifying which frauds are to be prevented and which data are actually needed. However, in practice, many sites operate without registration, purchase and usage history is not available when an account is used for the first time, and some anti-fraud signals can be ambiguous and may even increase the risks for data subjects. For these reasons, the EDPB concludes that, in most of the cases examined, it is not appropriate to rely on Article 6(1)(f) of the GDPR to require the creation of an account, because it is unlikely that the requirements of necessity and balancing will be met.
In conclusion, according to the EDPB, requiring the creation of an account is the exception, not the rule. Requiring the creation of an account to view offers or complete a purchase is unlikely to comply with the conditions of lawfulness of the GDPR, because, as a rule, the processing linked to the account is not really necessary to achieve the stated purposes. Consequently, even the legal bases most often invoked by controllers are rarely sustainable, precisely because in most cases the same objectives can be achieved with less invasive solutions. For this reason, the EDPB indicates that the preferred approach is to offer users the option of creating an account or continuing to browse and purchase as a guest. This also contributes to creating a more secure online environment in line with the principles of transparency, minimization, and data protection by design and by default.
