On 4 December 2025, the EDPB issued recommendations on the legal basis for requiring the creation of user accounts on e-commerce sites. It has asked for comments in relation to these recommendations to be submitted by 12 February 2026.
The recommendations set out examples of situations in which it may or may not be necessary to process the personal data on the basis of contractual necessity, for compliance with a legal obligation and for legitimate interests.
The EDPB states that the requirement to set up a user account can be justified in only a limited number of situations, such as offering a subscription service or access to exclusive offers but also clarifies that the situations set out are not exhaustive.
This is a must read for retailers and can be found here.
