News · European Data Protection Board EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

EDPB gives recommendations to make online shopping more respectful of users’ privacy, discusses the Digital Omnibus proposal and appoints new Deputy Chair

Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites.

Personal Data Lawful Basis Security Processing E-commerce
Dec 4, 2025 Source edpb.europa.eu

Full text

Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites. In addition, the Board had a preliminary discussion on the Digital Omnibus proposal and appointed the new EDPB Deputy Chair. Internet users visit e-commerce websites for a variety of reasons, including making online purchases, taking advantage of promotions, or simply browsing products. When interacting with these websites, they may be asked to create an account, which can result in the collection and processing of personal data, as well as increased privacy and security risks. The EDPB adopted recommendations to clarify when e-commerce websites can require their users to create an account. As a general rule, users should have the option to engage with e-commerce websites, including the ability to make purchases, without creating an account. In such cases, the EDPB recommends that e-commerce websites offer a choice: ei

How it connects

Related across sources

CJEU Google Spain: data subject may require search engine to remove links to outdated Legitimate interest balancing test: Legitimate interest requires balancing of the interest of the controller and third party with the interest of the data subject. In this… May 13, 2014 Personal Data Legitimate Interest Right to Rectification
W137 2333649-1 Federal Administrative Court: retention of job applicant data for potential legal claims The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the… Jul 8, 2026 Storage Limitation Retention Period Right to be Forgotten
Guidelines 2/2018 derogations of Article 49 under Regulation 2016/679 Guidelines on derogations of Article 49 Guidelines ·EDPB May 25, 2018 Privacy Shield Lawful Basis Legitimate Interest
Guidelines 9/2022 personal data breach notification under GDPR Guidelines ·EDPB Apr 4, 2023 Notification Obligation Data Breaches Personal Data
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
Guidelines 01/2022 data subject rights - Right of access Guidelines ·EDPB Apr 17, 2023 Right of Access Personal Data Right to Rectification
Related documents