Cybersecurity Policy Report, EDPB Provides Advice on Legal Basis for Creation of Online User Accounts, (Dec 8, 2025)

By Tony Foley

Recommendations for establishing a legal basis requiring users to create an account prior to accessing offers on an e-commerce website were issued last week by the European Data Protection Board (EDPB).

The recommendations, published on Dec. 3, note that users of e-commerce sites are frequently required to create an online account before being able to access offers or purchase goods and services. Controllers have offered several justifications for such a requirement, including to perform a sale, enable the subscription to services, or grant access to exclusive offers. While EDPB acknowledged that controllers might have a commercial interest in requiring the establishment of user accounts, it added that account creations could also expose data subjects to additional risks to their rights and freedoms.

Specifically, the recommendations instruct controllers operating in the e-commerce sector on the conditions under which they may lawfully require users to create an account in compliance with articles 5(1)(a) and 6 of the European Union’s General Data Protection Regulation (GDPR). They provide examples of situations in which the creation of an account may or may not by necessary for the performance of a contract (article 6(1)(b)), for compliance with a legal obligation (article 6(1)(c)), or for the purposes of a legitimate interest of the controller or a third party (article 6(1)(f)). EDPB analyzed various use cases and determined that imposing an obligation to create a user account can be justified for a limited, albeit non-exhaustive, set of purposes, like offering a subscription service or providing access to exclusive offers. In several other use cases, however, the requirement to create an account does not comply with the conditions for lawful processing under the GDPR.

In cases where legal processing conditions are not met, EDPB concluded that offering users the option of creating an account or purchasing as a guest appeared to be the most efficient way for personal data to be processed on e-commerce websites. EDPB pointed out that this “guest mode” is, in principle, the most privacy-protective option to enable purchases, fulfilling the obligation of data protection by design and default under GDPR article 25.

The recommendations are subject to a public consultation through Feb. 12, 2026. Interested parties can use this form to submit comments.

News: InternationalLegislation DataPrivacy GDPR