Mandatory customer accounts in online shops: when Article 6 GDPR supports an account, when guest checkout is sufficient and how to document alternatives.
Mag. Bernhard Brandauer, Austrian attorney-at-law
BRANDAUER Rechtsanwälte
Mag. Bernhard Brandauer advises businesses on the legal classification and practical implementation of data protection requirements.
An online shop generally does not need a permanent customer account for a single purchase. The decisive question is whether processing account data is genuinely necessary for the specific purpose and whether an equally effective, less intrusive ordering route is available.
EDPB Recommendations 2/2025, Version 1.0, were adopted on 3 December 2025 as a version for public consultation. They are therefore not binding law and do not create a general statutory right to guest checkout. They provide an orientation for applying Article 6 GDPR to a mandatory account. A shop should measure the account requirement against the purchase type, purpose, data scope and available alternatives.
Answer the questions about the purchase type, the purpose of the account and possible alternatives. The result indicates which documents and checks matter first.
Classify the arrangement by its contract and intended use.
Article 6(1)(b) GDPR permits processing where it is necessary for the performance of a contract. Necessity requires a close connection with the specific subject matter of that contract. The controller must be able to explain why the contract could not be performed without the processing in question. Processing imposed unilaterally because it is useful or convenient does not automatically meet that standard.
For a single purchase, a shop may need a name, delivery address, payment details and contact information. Those details can generally be collected through a guest checkout. The shop does not need to create a personal online space with credentials, a profile and a permanently active record for that purpose.
The EDPB consultation version reaches the view, for the one-time sale described there, that Article 6(1)(b) will generally not justify imposing an account. This remains a case-specific assessment. The document is consultation guidance, not a separate prohibition and not a general statutory guest-checkout rule.
The shop should first identify the processing linked to the account. Completing the purchase, tracking delivery, changing an order, customer loyalty, personalised offers and fraud prevention are different purposes. Each requires its own legal-basis assessment. The account itself is not a purpose of processing.
Article 6(1)(c) GDPR requires a clear, precise and foreseeable legal obligation. Retention rules for invoices and accounting records generally concern specific documents. They therefore do not automatically require the shop to keep the account data used to create those documents in an active customer profile.
Article 6(1)(f) GDPR requires a legitimate interest, necessity and a balancing of that interest against the interests and fundamental rights of the data subject. An economic interest in easier repeat purchases, loyalty or improved analysis does not by itself justify a mandatory account. The balancing exercise must be specific and completed before the processing begins.
A subscription can make an account closer to the subject matter of the contract. If customers must repeatedly authenticate to access subscribed content, track recurring deliveries, change contract details or communicate securely with the shop, account processing may be necessary for that ongoing service. The assessment remains limited to the contract period and the functions that are genuinely needed.
An exclusive offer supports an account requirement only where there is a real restricted community with specific, demonstrable characteristics or an established continuing relationship. A general discount available to anyone who registers does not describe such a closed community. Registration must not manufacture the access condition that is then used to justify registration.
For conditional purchasing, such as sales limited to a professional group, the shop should ask whether status can be verified through a secure form and a one-time document. If that route is equally effective and the data can then be deleted or restricted, it weighs against a permanent account.
Guest checkout enables a purchase through a form without requiring a password or a permanent personal area. It collects only the information needed for the relevant purpose. A later voluntary account can provide additional functions, but the guest route should not be made unattractive through hidden or unrelated disadvantages.
For delivery tracking, later order changes, questions or complaints, a reference number, a protected page with a time-limited link or a secure customer-service route may be sufficient. Identity can be matched to the current order and known contact details. A permanent profile is not automatically the only workable solution.
The shop should compare alternatives in legal as well as technical terms. The record should cover purpose, data fields, authentication, retention, access controls and when the alternative access ends. This shows why the selected route is sufficient for the contract and security.
An active customer account often retains personal data longer than a single purchase requires. This raises the storage-limitation principle in Article 5(1)(e) GDPR. Unused accounts can also be overlooked and become more exposed to unauthorised access.
The shop should therefore distinguish accounts, order records and documents subject to statutory retention. A retention duty for invoices may apply to particular records. It does not automatically mean that the full profile, credentials and every account function must remain active.
An account also does not prevent fraud by itself. Appropriate technical and organisational measures, such as suitable authentication, additional checks for unusual transactions or CAPTCHA, can be used without imposing an account. The measure must fit the risk and should not become a blanket reason for collecting more data.
Article 25 GDPR requires data protection by design and by default. The shop therefore makes an important privacy decision in the interface itself: whether guest checkout is as visible as the account option, which fields are preselected and which information is requested only for optional functions.
A clear interface separates the purchase from voluntary extras. Customers should be able to see which information is needed for delivery and payment and which data is requested only for a voluntary profile, personalised offers or a loyalty programme. Marketing and other additional purposes require their own review and remain separate from the mandatory account question.
Record the decision with screenshots or a flow description, a field list, deletion rules and the comparison of alternatives. When payment providers, customer portals, delivery processes or optional functions change, reassess whether the earlier reasoning and data minimisation still fit.
The review starts with a description of the purchase or subscription model. Add the data flow, account fields, order fields, purposes, recipients, storage locations and the roles of the providers involved. The record should show which data supports the contract and which functions are voluntary.
Keep the comparison of alternatives as well. Describe whether guest checkout, a one-time link, a secure form or another route achieves the same purpose. Record the concrete factual reason for rejecting each alternative. General references to convenience, marketing or internal efficiency are not enough.
For a mandatory account, review security, deletion, deactivation, minimisation and information for data subjects. The page on processors and service providers helps classify the provider data flow. The article on third-country transfers with SCCs and a TIA covers a separate transfer assessment.
Convenience is treated as necessity: Faster repeat purchases, a single customer number or easier internal administration do not show that a permanent account is necessary for the specific contract.
The purpose remains unclear: Purchase handling, loyalty, profiling and fraud prevention are combined in one general account justification. Separate the purposes and assess their legal bases individually.
Guest checkout is hidden: A theoretical guest route is not enough if the interface pushes people towards an account or imposes unrelated disadvantages. The options should be clear and fair.
Invoice retention keeps the whole account active: Statutory documents and an active user profile serve different functions. Assess which data and records are still needed for each purpose.
The consultation version is treated as legislation: EDPB Recommendations 2/2025 provide orientation from a public consultation. Applicable law, the actual contract model and any special legal access conditions remain separate questions.
The GDPR does not contain a general guest-checkout statute. For a single purchase, however, a permanent account will often be unnecessary under the EDPB consultation analysis if the order and delivery can be handled through a form. Special statutory access conditions require a separate assessment.
Only if account processing is necessary for the specific subject matter of the contract. The shop must show why the contract cannot be performed without the account and why no equally effective, less intrusive route is available. Convenience alone is insufficient.
It can, where the ongoing service requires recurring authenticated interactions, such as managing the subscription or accessing the subscribed content. The requirement should remain limited to necessary functions and the contractual period.
Usually, retention of specific invoices or accounting records does not require an active customer account. The shop should assess documents, the profile, credentials and other data separately and retain each only for the purpose that supports it.
No. Version 1.0 was adopted as a version for public consultation. It is not a binding norm. It can structure an assessment under Articles 5, 6 and 25 GDPR, but it does not replace the Regulation or the review of the individual shop.
We review the purchase model, account fields, data flows, alternatives and retention rules with you. The assessment separates what is needed for the contract and delivery from optional functions that can remain voluntary. Send us the current checkout flow, account and form fields and the available privacy documentation. Receive new articles and legal guidance from the firm with BRANDaktuelle Rechtsnews.
Tell us briefly what is happening. We will help classify the situation and discuss which documents and next step are useful for your business.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg Österreich
Phone
+43 662 6280000