Guest checkout instead of a mandatory account: EDPB advice

In December 2025, the European Data Protection Board (EDPB) published a draft that questions a widespread habit in online retail: the mandatory account before a purchase. Under Recommendations 2/2025, customers should as a rule be able to order as a guest, and an account should be a free choice (EDPB). The supervisory authorities consider a mandatory account justifiable only in a few cases, such as a subscription or offers for a closed group. The text is a draft and not legally binding, but it shows how the European supervisory authorities read the GDPR on this point. In Germany, the Data Protection Conference has taken the same line since 2022 (DSK). This article puts the draft into context, shows the cases in which a mandatory account remains justifiable, including closed user groups in B2B commerce, and describes how a data-minimizing guest checkout can be implemented in a Shopware store.

What the EDPB recommends in the draft

The EDPB adopted Recommendations 2/2025 on the legal basis for requiring user accounts on e-commerce websites at its plenary session and announced them on December 4, 2025 (EDPB). The document is marked version 1.0 and carries the adoption date December 3, 2025 (EDPB). It addresses online stores and marketplaces where merchants sell to consumers and explicitly includes web applications and mobile apps. Platforms for sales between private individuals, social networks, search engines and news websites, among others, are not covered (EDPB).

As a general rule, users should have the option to engage with e-commerce websites, including the ability to make purchases, without creating an account.

European Data Protection Board, announcement of Recommendations 2/2025

From this, the draft derives its basic rule: stores should offer a choice, either a guest mode in which customers order without an account, or a voluntary account (EDPB). The EDPB bases this on data protection by design and by default under Art. 25 GDPR. In principle, guest mode is the most privacy-protective option to enable purchases (EDPB). A mandatory account, by contrast, can only be justified for a very limited, non-exhaustive set of purposes, such as a subscription or access to exclusive offers (EDPB).

For store operators, the topic is not new, but the angle is. Our articles on customer accounts and registration and on checkout optimization dealt with conversion: a mandatory account costs sales. This article covers the legal side, that is Art. 25 GDPR, the legal bases under Art. 6 GDPR and the question of when a mandatory account can remain permissible, including closed user groups in B2B commerce.

How binding the draft is

The EDPB is the body in which the data protection supervisory authorities of the member states work together. Under Art. 70(1)(e) GDPR, it issues guidelines, recommendations and best practices to ensure the consistent application of the regulation (GDPR). Recommendations are therefore interpretation aids, not legal norms in their own right. Whether a mandatory account is unlawful is decided by the courts in a dispute. Such papers still carry weight, because they show how the authorities that also impose fines carry out their reviews.

In Germany, the direction has been clear for some time. The Data Protection Conference (DSK), the joint body of the German supervisory authorities, adopted its guidance on GDPR-compliant online retail via guest access as of March 24, 2022 (DSK). Under this guidance, online merchants must as a rule provide guest access for orders, regardless of whether they also offer a customer account (DSK). Guest access may only collect the data required to perform the contract and to meet legal obligations (DSK).

Without guest access or an equivalent way to order, the voluntary nature of consent cannot be ensured.

German Data Protection Conference (DSK), guidance on GDPR-compliant online retail via guest access (own translation)

The EDPB draft takes this line to the European level. Anyone who requires an account today without a specific reason is therefore already departing from the published guidance of the German supervisory authorities, not just from a possible final version. Then there is the range of fines: for infringements of the principles and conditions of processing under Art. 5, 6 and 7 GDPR, the regulation provides for fines of up to €20 million or up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (GDPR). That is an upper limit, not a standard rate.

What risks the EDPB sees in mandatory accounts

The draft does not justify its position with legal provisions alone, but with concrete risks for the people concerned. The most important point is the retention period: accounts keep data in an active database even if they have not been used for a long time. As long as nobody requests erasure, the data stays there, and in the EDPB's view this is not in line with the principle of storage limitation under Art. 5(1)(e) GDPR (EDPB). Orphaned accounts are also more exposed to attackers (EDPB).

• Reused passwords: People forced to create an account often pick a password they already use elsewhere. Secure methods such as passkeys are rarely offered, according to the EDPB (EDPB). How such credentials are used against stores is shown in our article on defending against account takeovers.
• Profiling: Logged-in sessions make it easier to record browsing behavior and to combine data from different purchasing channels. Without a proper legal basis, this breaches the GDPR (EDPB).
• Last-minute consent: If the account is required between cart and payment, stores can ask for consent to further purposes at that very moment, often with deceptive design (EDPB).
• Pressure after the purchase: The EDPB also describes such patterns after the order, for example a profile marked as “incomplete” or a button in the order confirmation that merely confirms an account already created in the background (EDPB).

The draft also rejects a common argument: an account does not protect against bots that buy up scarce goods. Accompanying measures such as CAPTCHA tests are more likely to stop them, and they work without an account too; bots also create accounts themselves (EDPB). How automated traffic in a store can be detected and managed is described in our article on handling bot traffic.

Customers are not against accounts as such. In a representative survey commissioned by Bitkom, only 27% of online shoppers said they exclusively use functions that do not require creating an account (Bitkom). 62% trust that merchants do not misuse their data (Bitkom). The survey covered 1,120 internet users in Germany aged 16 and over, including 1,072 online shoppers (Bitkom). Shopping online is part of everyday life anyway: 85% of internet users aged 16 to 74 in Germany bought something online within twelve months in 2025, compared with an EU average of 78% (Destatis).

The three legal bases at a glance

A mandatory account is a form of data processing that requires a legal basis. The draft examines the three that merchants typically invoke: performance of a contract under Art. 6(1)(b) GDPR, a legal obligation under point (c) and legitimate interests under point (f) (EDPB). It does not address consent under point (a) for the compulsion itself, because nobody can consent freely when the purchase depends on it (EDPB).

For all three legal bases, necessity is decisive: the merchant must be able to show that the purpose cannot be achieved just as effectively by less intrusive means. This is where most justifications for a mandatory account fail.

Purposes and assessment in the draft

The draft is cautious in its wording: in these cases, the necessity test is “unlikely” to be met. It is up to the merchant, however, to demonstrate that the processing is lawful, and a justification that the EDPB classifies as not sufficient is hard to defend before a supervisory authority.

When a mandatory account remains justifiable

The clearest case is a subscription. Anyone who signs up for ongoing deliveries, such as a monthly box of cosmetics, needs continuous access to track shipments, change delivery terms or communicate with the merchant. Here the account may be necessary to perform the subscription contract (EDPB). The draft attaches conditions: the contract must require recurring authenticated interactions, there must be an actual subscription contract, and the legal basis only applies for the duration of the contractual relationship (EDPB). When the subscription ends, so does the justification for the account. How subscription models can be implemented technically is described in our article on subscription commerce in Shopware.

Access to exclusive offers is more difficult. The draft distinguishes two situations. A discount for members who only have to create an account does not establish a closed community; in that case the account is not necessary (EDPB). It is different for a sales event to which only loyal customers with a long business relationship are invited. There, the account may be necessary for the contract with the eligible customers (EDPB). What matters is whether access is tied to proven characteristics and whether membership of this community becomes the actual subject matter of the contract.

Provisions that themselves require an account for certain regulated products remain unaffected. The EDPB names alcohol, gambling and pharmaceuticals as examples (EDPB). Merchants with such product ranges check the obligation against the specific provision concerned and not against the draft.

Closed user groups in B2B

One paragraph of the draft is particularly important for B2B commerce. As a possible criterion for a closed community, the EDPB explicitly names verifying a professional status during registration and throughout the business relationship, alongside referral, invitation or selection of members (EDPB). The DSK names specialist dealers serving certain professional groups as an exception in which an ongoing account may be necessary to perform the contract. Even then, it requires data minimization, for example by deleting the account automatically after a short period of inactivity (DSK).

This does not mean that every B2B store justifies a mandatory account. The draft distinguishes the case of conditional purchasing: a merchant who sells medical and laboratory equipment only to licensed doctors and certified laboratories can check the status via a secure form during checkout without creating a permanent account, and delete the documents as soon as they are no longer needed (EDPB). A one-time status check alone does not justify a mandatory account. In our assessment, an account is more likely to be appropriate where there is an ongoing business relationship with its own terms, such as customer-specific prices, approvals or purchase on account, as is typical of many B2B stores. The legal assessment of the individual case remains a matter for your data protection advisor.

• Is access tied to verified characteristics, such as proof of business registration or a dealer agreement?
• Is there an ongoing business relationship with individual prices, assortments or approvals?
• Is the status reviewed during the relationship and not just once at registration?
• Are inactive accounts deleted after a defined period?
• Do occasional buyers have a way to order without a permanent account?

How new business customers can be verified at registration is shown in our article on onboarding new B2B customers. If you show prices behind a login and still want to be found, our article on the wholesale store with login prices has suggestions.

Reasons the draft does not accept

Most arguments for a mandatory account concern the processes around the order. The draft goes through them one by one and reaches the same conclusion each time: the purpose can be achieved without an account.

A common misunderstanding concerns retention obligations. A business must keep invoices for eight years (Sec. 14b UStG), and books and records for ten years and accounting vouchers for eight years (Sec. 147 AO). These obligations apply regardless of whether the purchase was made via an account or as a guest. The EDPB points out that they usually relate to specific documents such as invoices and do not require storage in the customer database; the documents belong in a separate archive with restricted access (EDPB). How retention periods, deletion classes and blocking interact is described in our article on the deletion concept for online stores. Which invoices Shopware itself creates in ZUGFeRD format is covered in the article on native ZUGFeRD in Shopware.

According to the draft, customer loyalty and more convenient repeat orders do not justify compulsion either. The interest in them may be legitimate, but whether there will be another order is up to the customer, and at the time of purchase the customer does not expect the data to be kept longer than needed to perform the contract (EDPB). Personalization and tracking of activity require consent in many cases anyway (EDPB).

Implementing guest checkout in line with data protection

Art. 25(2) GDPR requires that, by default, only the data necessary for each specific purpose is processed; this applies to the amount of data collected, the extent of processing, the period of storage and accessibility (GDPR). According to the draft, guest mode is a suitable way to meet this obligation at checkout (EDPB). It only works, however, if it also stays data-minimizing in the background. The DSK requires that data no longer needed after the contract has been performed is deleted without undue delay and that data held only because of retention obligations is separated from the operational database (DSK).

1. Guest checkout as the default: The option appears at checkout on an equal footing with sign-in and is not hidden behind a small text link.
2. Limit the form to what is necessary: Delivery and billing address, payment details and a contact address for the order. Any further required fields need a justification.
3. Separate consent: Newsletter, personalization or storing payment methods are separate, voluntary decisions next to the purchase and do not appear in the last step before payment.
4. Only offer an account after the purchase: An offer on the confirmation page is possible if it is clearly separate from the purchase and no account is created in the background beforehand.
5. Define retention periods: Guest data is deleted or blocked after the contract has been performed, inactive accounts are cleaned up after a defined period and invoices are archived separately.
6. Inform transparently: The privacy notice describes both paths, guest mode and account, with purposes and retention periods.

When it comes to storing payment data, the situation has been clear for some time: the DSK requires informed consent and refers to the EDPB recommendations on storing credit card data (DSK). Which payment methods make sense at checkout and what they cost the store is covered in our article on calculating the cost per payment method.

The account offer after the purchase deserves a closer look. The draft describes as deceptive design the case in which an account has long been created in the technical background and the customer merely confirms it by setting a password (EDPB). If you want to offer an account after the purchase, create it only when the customer explicitly chooses it, and explain beforehand what the account offers. Further patterns that supervisory authorities and consumer advocates view critically are listed in our article on dark patterns at checkout.

What this means in Shopware

In Shopware 6, the setting “Create a customer account by default” under log-in and sign-up controls which path is preselected at checkout. If it is inactive, the customer is treated as a guest when registering at checkout and can choose an account via a checkbox; if it is active, an account is created by default, and the customer has to tick the checkbox to place a guest order (Shopware documentation). The setting can be configured globally or per sales channel (Shopware documentation). For a store that wants to follow the draft, it should usually be inactive, in every sales channel.

Technically, Shopware creates a customer record flagged as a guest even for a guest order. These records have a configurable expiry time; according to the source code, however, the automatic cleanup only covers guest customers without an order, and if no expiry time is set, nothing is deleted automatically (Shopware source code). Guest customers with orders therefore remain in the database until a separate deletion or anonymization concept takes effect. Only then does guest checkout meet the DSK requirement to delete data that is no longer needed.

What the final version may still change

The consultation showed how controversial the draft is in the industry. The feedback published on the consultation page includes business associations and companies from several member states (EDPB). The German E-Commerce and Distance Selling Trade Association (bevh) submitted a statement dated February 12, 2026 (bevh). In it, the association invokes the freedom to conduct a business and freedom of contract, as well as security advantages of accounts, for example through two-factor authentication (bevh).

Guest checkout must remain a voluntary design option and must not be regarded as an obligation.

German E-Commerce and Distance Selling Trade Association (bevh), statement in the EDPB consultation (own translation)

Whether and how the EDPB will adjust the text is open. For merchants in Germany, this changes little about the starting point, because the DSK holds its position independently of the draft. It therefore makes sense to review the checkout now and set up guest checkout as the default instead of waiting for the final version. For mandatory accounts that are meant to stay, for example in a subscription or a closed B2B channel, it is worth documenting the reasons in writing.

How we support the switch

We review checkout and customer accounts in Shopware and other store systems against the points in this article: default setting per sales channel, required fields, consent in the ordering process, the account offer after the purchase and the deletion routines for guest data and inactive accounts. For closed B2B channels, we implement registration, approval and status checks so that the reason for the account remains traceable in the system. The legal assessment of the individual case remains with your data protection advisor; we deliver implementation and documentation, as part of our e-commerce consulting or directly through our Shopware agency.