EDPB Weighs In: When Is An E-Commerce Account Truly Necessary?

The European Data Protection Board ("EDPB") recently published recommendations relating to mandatory user accounts on e-commerce platforms. These recommendations establish a strict standard for when an organisation can rely on the legal basis of "necessity for the performance of a contract" (Article 6(1)(b) of the GDPR) in order to impose the creation of permanent user accounts.

The necessity principle

At the core of the EDPB's position is the principle of data protection by design (Article 25 of the GDPR). The guidance suggests that a "guest mode" checkout is the most privacy-protective option and should be the default, as it minimizes the amount of data collected and stored persistently.