Recommendations on Legal Basis for E-Commerce User Accounts

Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites

This recommendation outlines the EDPB’s position on the legality of requiring users to create an account in order to access services or content, particularly in the context of consent under the GDPR. It highlights that making account creation a condition for accessing a service may not always comply with the requirements of freely given consent under Article 7 GDPR. The document also clarifies the criteria for assessing whether such practices are necessary for the performance of a contract under Article 6(1)(b) GDPR.