DATA PROTECTION | EDPB releases recommendations on data processing for creation of user accounts online

On 4 December 2025, the European Data Protection Board (EDPB) released recommendations 2/2025 (Recommendations) on the legal basis for requiring the creation of user accounts on e-commerce websites.

Although users are often required to create online accounts to access services or complete purchases in the digital environment, the creation of such accounts entails several data protection and security risks. In particular, it fosters the development of logged-in environments in which data subjects are systematically identified and their behaviour closely monitored. Moreover, the collection of large amounts of personal data increases users’ exposure to cybersecurity risks, especially in the event of data breaches.

The Recommendations aim to clarify the circumstances in which providers operating in the e-commerce sector may legitimately require users to create an account and, conversely, when users should be given the possibility to browse offers and complete purchases without logging in. In this respect, the EDPB recalls the general principle of data minimisation, which requires data controllers to collect only personal data that is strictly necessary for the purposes of the processing. Against this background, the EDPB takes the view that requiring users to create an account in order to access an online service is justified only in a very limited number of cases.

To this end, the EDPB examines the most common situations in which data controllers require users to create an account and assesses whether such a requirement can be justified under the main legal bases set out in Article 6 of GDPR and relied upon in practice. In particular, the Recommendations provide examples of cases in which mandatory account creation may be considered necessary for the performance of a contract under Article 6(1)(b) of GDPR, required to comply with a legal obligation under Article 6(1)(c) of GDPR, or justified by the legitimate interests pursued by the controller or a third party under Article 6(1)(f) of GDPR.

The Recommendations are open for public consultation until 12 February 2026.

Newsletter n. 113 – December 2025