Is email verification for account creation in violation of GDPR?

Question

Is email verification for account creation in violation of GDPR?

I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and email.

Email is verified at the creation process and is used for password recovery and that is it. Someone had said I may want to look at GDPR (General Data Protection Regulation) and that I may be violating it, opening myself up to liability.

Now, I feel that this is not the case, although I may indeed be wrong. The real question is, where is this line drawn? How is it that this could be illegal (like not stating why I need the email address?) and what can be done if this IS illegal to correct it?

I was not 100% sure where to post this, so I hope this was the correct place if not, I will freely move it/repost it if you think it is better suited elsewhere.

Thank you for reading. Reading about the GDPR is interesting to say the least, as a consumer I love it, as a novice part-time developer I am beyond perplexed by it.

Answer 1

When someone registers at your website, they enter a contract with you. You need an email address, because you need to be able to contact them (at least for the password recovery). You probably want to verify the email address, otherwise you might not be able to contact them in the future. So the email verification is required as part of the performance of the contract. But also anti-spam laws might require you to use confirmed opt-in before you are allowed to send automatic emails.

So at least Article 6(1)(b) (performance of a contract) would apply, but for the confirmed opt-in also Art. 6(1)(c) (compliance with a legal obligation) might apply. That means sending the verification mail is lawful. However you probably want to write this down in the privacy policy as Greendrake commented. Note that there must not be an option for users to agree with the privacy policy, it is just a statement which you make.