EDPB Consultation on User Accounts for E-commerce Websites

EDPB Public Consultations

Published December 4th, 2025

Detected February 11th, 2026

Summary

The European Data Protection Board (EDPB) has launched a public consultation on its Recommendations 2/2025 concerning the legal basis for requiring user accounts on e-commerce websites. The consultation is open for comments until February 12, 2026.

View original document View source feed page

What changed

The European Data Protection Board (EDPB) is seeking public comments on its Recommendations 2/2025, which address the legal basis required for e-commerce websites to mandate the creation of user accounts. This consultation aims to clarify data protection obligations under GDPR when personal data is processed for account creation, particularly concerning consent and legitimate interests.

Affected entities, primarily e-commerce platforms and technology providers operating within the EU, are invited to submit their feedback by February 12, 2026. While these recommendations are non-binding, they provide significant guidance on compliance. Submissions will be published on the EDPB website, and parties should be aware of potential access requests under Regulation 1049/2001.

What to do next

Review EDPB Recommendations 2/2025 on user accounts for e-commerce.
Submit comments to the EDPB by February 12, 2026.

Source document (simplified)

Start Date: 04 December 2025 End Date: 12 February 2026 Public consultation reference: R02/2025 Public consultation closed Recommendations 2/2025 390.6KB English Download Publication Type:
- Recommendations
Topics:
- Legal basis
- Privacy by design and by default
The European Data Protection Board welcomes comments on the *Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites.*
Such comments should be sent *12th February 2026 at the latest using the provided form.*

Please note that, by submitting your comments, you acknowledge that your comments will be published on the EDPB website.

The EDPB Secretariat staff screens all replies provided before publication (only for the purpose of blocking unauthorised submissions, such as spam), after which the replies are made available to the public directly on the EDPB public consultations’ page. Unauthorised submissions are immediately deleted. The attached files are not altered in any way by the EDPB.

Please note that your contribution may be subject to a request for access to documents under Regulation 1049/2001 on public access to European Parliament, Council and Commission documents. In this case the request will be assessed against the conditions set out in the Regulation and in accordance with applicable data protection rules.

All legal details can be found in our Specific Privacy Statement (SPS) .