>  Shipping does not require a phone number

First, in many places shipping does require a phone number. Even if not strictly mandatory, it may be part of standard business practices to facilitate the contact of the intended recipient for customs and delivery purposes. In many countries with less standardized or complicated addresses, a phone number is vital for delivery.

> My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task.

This is wrong.

Under GDPR, a data processor requires a lawful basis to handle personal data. Notably, the [lawful basis][1] may include

- consent of the data subject
- processing necessary for the performance of a contract 
- processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party

It is allowed to ask for most personal information, and the processing of such data is legal if freely given, specific, informed and unambiguous consent is given by the data subject, and such consent is not bundled with the provision of goods or services that do not require the personal data.

If the business's shipping partner requires a phone number, then the processing may be considered necessary for the performance of a contract.

If it is not strictly necessary, the analysis would still include whether the processing is necessary for the purposes of legitimate interests. For example, the business may invoke the need to prevent fraud or the need to prevent misdeliveries or customs mishaps as legitimate interests. A balancing is needed between the business's legitimate interests and your interests. Phone numbers still form part of routine business transactions such that your interests to not provide phone number may be considered less important; on the other hand, you may be able to cite the rise of telecom fraud as a reason to be more private with phone numbers.

In any case, it is not obvious that a phone number requirement necessarily violates GDPR.

> (actually, doesn't this apply to email as well?)

Yes, another point is that at least for now, the necessity requirement of GDPR does not appear to contain a duty of accommodating the privacy concerns of certain customers. It is unlikely that GDPR would force a business to receive orders by registered mail in case the customer does not want to provide email or phone number, even if these personal data could also be considered "unnecessary" for the performance of the contract. It may be a matter of legitimate interests (e.g. to reduce costs) that the business chooses only to do business with customers who have an email or phone number.




  [1]: https://gdpr.eu/article-6-how-to-process-personal-data-legally/