Is email verification for account creation in violation of GDPR?

I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and email.

Email is verified at the creation process and is used for password recovery and that is it. Someone had said I may want to look at GDPR (General Data Protection Regulation) and that I may be violating it, opening myself up to liability.

Now, I feel that this is not the case, although I may indeed be wrong. The real question is, where is this line drawn? How is it that this could be illegal (like not stating why I need the email address?) and what can be done if this IS illegal to correct it?

I was not 100% sure where to post this, so I hope this was the correct place if not, I will freely move it/repost it if you think it is better suited elsewhere.

Thank you for reading. Reading about the GDPR is interesting to say the least, as a consumer I love it, as a novice part-time developer I am beyond perplexed by it.

  • 2
    Someone said that chicken can be milked. Just put privacy policy on your site, explain why you collect personal data and what you do with it and that's it.
    – Greendrake
    Aug 21, 2018 at 20:18
  • As simple as that is, I completely did not think to include that. it's probably the smart thing to do in any case where any information is taken. If they are agreeing to it and confirming it, it covers my butt. Thank you. Aug 21, 2018 at 21:40

1 Answer 1


When someone registers at your website, they enter a contract with you. You need an email address, because you need to be able to contact them (at least for the password recovery). You probably want to verify the email address, otherwise you might not be able to contact them in the future. So the email verification is required as part of the performance of the contract. But also anti-spam laws might require you to use confirmed opt-in before you are allowed to send automatic emails.

So at least Article 6(1)(b) (performance of a contract) would apply, but for the confirmed opt-in also Art. 6(1)(c) (compliance with a legal obligation) might apply. That means sending the verification mail is lawful. However you probably want to write this down in the privacy policy as Greendrake commented. Note that there must not be an option for users to agree with the privacy policy, it is just a statement which you make.

  • 1
    I doubt that website registration satisfies the elements of contract formation in every jurisdiction. What, for example, is the consideration? Also, when you say "there must not be an option for users to agree" did you actually mean "there need not be an option for users to agree"? The former says that an option for users to agree is forbidden.
    – phoog
    Aug 21, 2018 at 21:33
  • I had taken it as "There does not need to be an option (like a checkbox, etc) to agree", that being said, I intend to put the classic checkbox: "I have read this" even though they likely haven't. I would imagine this, with a privacy policy, and a confirming of the email should be just fine. If not, I would love to hear your thoughts. Aug 21, 2018 at 23:12
  • @phoog, I think you are probably right. As the question was tagged GDPR, I was assuming Europe here. I believe my answer is valid for mainland Europe. But I am not even sure about the UK. I visited a talk about whether an open source license is a contract, and the answer was different for the US/UK/Europe.
    – wimh
    Aug 22, 2018 at 19:49
  • @WolfMerrik for the Terms of Service it would not hurt to have a checkbox, but for the privacy policy I have read it is pointless, as a privacy policy does not need to become a part of the contract. But I see a lot of large companies doing it anyway. And I cannot find a good reference which supports my view.
    – wimh
    Aug 22, 2018 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .