Many online shops automatically send emails when a customer has added products to their basket but has not completed the purchase. What retailers often describe as a useful service is, in the view of the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia (LDI NRW), in most cases unauthorised advertising.
How the assessment came about
The case arose from a complaint by a customer who, following an abandoned checkout process, received no fewer than three such reminder emails from an online retailer. The retailer did not regard these as advertising, but rather as a form of service communication in the customer’s best interests. The data protection authority took a fundamentally different view and set out its reasoning in detail in its 31st Annual Report for the year 2025.
No longer in a pre-contractual relationship
Anyone who leaves an online shop without making a purchase is clearly indicating that they do not wish to enter into a contract. Although the General Data Protection Regulation (GDPR) permits data processing in the context of pre-contractual measures under certain conditions, this basis ceases to apply as soon as the customer leaves the shop without placing an order. The pre-contractual relationship is therefore terminated.
Reminder emails are advertising, not a service
The LDI NRW clearly classifies cart abandonment emails as direct marketing. According to the definition set out in an EU directive, this applies to any communication made with the aim of promoting the sale of goods or services. Reminder emails are designed to do precisely that: they build on observed purchasing behaviour and are intended to persuade the customer to make a purchase after all. This is classic retargeting.
Under the Unfair Competition Act (UWG), email advertising is, in principle, only permitted with the recipient’s express consent. Such consent can be obtained, for example, via a checkbox that must be actively ticked and a so-called double opt-in procedure, similar to subscribing to a newsletter.
Exception for existing customers
However, the UWG does provide for an exception for existing customers. Anyone who has previously made a purchase from a retailer may, under certain conditions, be contacted by email without having to give new consent. For this to apply, four conditions must be met simultaneously:
- The email address was collected in connection with a previous purchase.
- We only advertise our own, similar products.
- The customer has not objected to the use.
- When the customer’s address was collected, and on every subsequent occasion it was used, the customer was clearly informed that they could object to its use at any time, free of charge.
If these conditions are met, the trader may base the reminder email on what is known as a legitimate interest under the GDPR.
What this means for online retailers
Online retailers who use shopping basket reminders should carefully review their practices. Without the customers’ explicit consent or the above-mentioned requirements for existing customers, they risk fines and formal warnings. Anyone who does not wish to forego this marketing strategy should adapt their registration process accordingly and ensure it complies with the law. It is advisable to seek individual legal advice, as the requirements may vary from case to case.
Source: Haufe: Law
This post and the accompanying image were created with the help of AI and have been editorially reviewed.
