Guest checkout: What shop owners need to know in 2026

If you offer guest checkout, you do not require a customer account for the first purchase, and that is exactly what many retailers find difficult. An account promises repeat purchases, customer data and less effort in customer service. Customers, however, want to pay quickly, and German data protection authorities have required guest access in principle since 2022. This article is aimed at shop owners. It puts the legal situation in 2026 into context, uses data to show what forced account creation costs in abandoned purchases and explains the settings in Shopware, WooCommerce and Shopify.

What is guest checkout?

Guest checkout is a way of buying in an online shop where the customer only provides the data needed to process the order and does not create a permanent customer account with a password. The German Data Protection Conference (DSK) describes guest access as an online transaction without setting up an ongoing customer account.¹ For shipping and payment, the shop needs the same details in both cases: Name, delivery and billing address and an email address for the order confirmation.

The difference lies in the purpose of storing the data. A customer account keeps addresses, order history and often payment methods on file for future purchases and requires a login. According to the DSK, guest checkout may only collect the data that is necessary to perform the contract and to meet legal obligations, for example for returns and warranty claims. Data that is no longer needed must then be deleted; what remains are the records that commercial and tax law require you to keep.¹ How the guest option fits into the overall ordering process is explained in the article on the checkout in online shops.

Is guest checkout mandatory? The legal situation in 2026

In the view of German data protection authorities, online shops must offer guest checkout in principle, and a mandatory account remains the well-justified exception. No statute mentions guest checkout explicitly. The authorities derive the obligation from the GDPR. Since 2022, three developments have shaped the situation: The DSK guidance, the ruling of the Hanseatic Higher Regional Court of Hamburg (OLG Hamburg) and the recommendations of the European Data Protection Board (EDPB).

German Data Protection Conference: Guest access as the rule

The German Data Protection Conference (DSK), the body of the independent federal and state data protection authorities in Germany, set out its position in guidance dated 24 March 2022. According to this guidance, online retailers must provide their customers with guest access in principle, even if they also offer customer accounts.¹ The reasoning is based on data minimisation under Art. 5(1)(c) GDPR. In the DSK’s view, an ongoing account is not necessary for a single purchase, so it requires consent.

This consent is only freely given if the customer has a genuine alternative. Here, the DSK relies on Art. 7(4) GDPR, the so-called prohibition on coupling. According to the DSK, guest checkout is only equivalent if the customer suffers no disadvantages whatsoever in terms of ordering effort or access. A guest path with poorer delivery options does not meet this condition.

The DSK guidance also contains three further points on customer accounts:

• Separate consent: If you want to analyse the order history for advertising or store payment methods such as credit cards, you need separate consent for this. Consent to the account does not cover it.
• Exception where necessary: In individual cases, an account may be necessary to perform the contract, for example for specialist retailers that only sell to certain professional groups.
• Deletion after inactivity: Even then, data minimisation applies. Inactive accounts should be deleted automatically after a short period.

On advertising with customer data, the Hamburg Regional Court (LG Hamburg) took a different view, according to activeMind.legal: Use for direct marketing is based on legitimate interests under Art. 6(1)(f) GDPR if customers can object at the time of collection and at any time afterwards.²

OLG Hamburg: The narrow exception for marketplaces

According to a press release from the Hamburg data protection authority (HmbBfDI), the action brought by the North Rhine-Westphalia consumer advice centre (Verbraucherzentrale NRW) was also unsuccessful before the Hanseatic Higher Regional Court of Hamburg (judgment of 27 February 2025, case no. 5 U 30/24).³ According to Onlinehändler News, the consumer advice centre had sued because Otto did not offer guest checkout.⁴ According to these reports, Otto.de does not have to offer guest access. According to the authority’s account, the mandatory account does not violate data minimisation because only the data needed to process the contract is collected and inactive accounts are deleted automatically after a certain period. According to this account, the decisive factor was the special position of Otto.de as a marketplace with many third-party sellers.³

The Hamburg Regional Court had already dismissed the action at first instance, according to activeMind.legal by judgment of 22 February 2024 (case no. 327 O 250/22). As reasons, activeMind.legal cites communication between buyers and third-party sellers as well as guarantee, warranty and return rights. The difference from guest access, it says, lies essentially in the password.²

According to Onlinehändler News, the ruling does not apply to conventional online shops and constitutes an exception.⁴ The Hamburg data protection authority, which was involved in the proceedings through an official opinion requested by the Regional Court, makes clear: A blanket reference to being a marketplace for third-party providers is not enough. In the authority’s view, retailers relying on the exception must substantiate the need with concrete figures. If in doubt, retailers should assume that they have to offer guest access.³ According to the authority, the Hamburg courts were not bound by the DSK guidance, but they took it into account as so-called soft law.³

An inspection in January 2025 shows that the authority is watching closely. Most of the Hamburg shops it checked already offered guest checkout, and a large clothing mail-order company without guest access set it up when asked to.³

EDPB Recommendations 2/2025: Still at the consultation stage

At EU level, the European Data Protection Board (EDPB) adopted Recommendations 2/2025 on the legal basis for mandatory user accounts in e-commerce on 3 December 2025, as a version for public consultation.⁵ The consultation ran until 12 February 2026. On 30 October 2026, no final version had been published on the EDPB’s consultation page.

In substance, the recommendations are clear. In the consultation version, the EDPB writes that for a one-off purchase, an account is as a rule not necessary under Art. 6(1)(b) GDPR. Mandatory accounts could only be considered for a few purposes, such as subscriptions or exclusive offers in closed communities. Users should be able to choose between an account and a guest purchase, and the EDPB regards guest mode in principle as the most privacy-friendly option.⁵

This is not without controversy. In its statement, the German digital association Bitkom calls for guest mode to remain voluntary rather than become mandatory. It points out that guest orders usually require the same categories of personal data as orders placed with an account.⁶

What this means for your shop

For most shops, the answer is clear: Offer guest checkout, on an equal footing with the customer account. Check your checkout against these points:

1. Equivalent guest option: Guests can complete their order with the same effort as account customers and get the same delivery and payment methods.
2. Optional account: Customers who create an account actively choose to do so. According to the DSK, advertising based on order history and stored payment methods each need separate consent.
3. Documented exception: If you consider a mandatory account necessary, for example as a marketplace, for subscriptions or in specialist retail, record the reasons with figures, collect only the data you need and delete inactive accounts automatically.
4. Guest access if in doubt: The Hamburg authority explicitly makes this recommendation.

This article does not replace legal advice. Have special cases such as marketplace or subscription models reviewed by a lawyer before making accounts mandatory.

How forced account creation increases abandoned purchases

A mandatory customer account is one of the most common reasons for abandoning the checkout. In a Baymard Institute survey of 1,026 US adults who had shopped online in the previous three months, 18% said they had abandoned an order because they did not want to create an account.⁷

This puts forced account creation in fourth place in Baymard’s list of reasons for checkout abandonment. Only extra costs that are too high for shipping, taxes or fees (40%), delivery that is too slow (20%) and a lack of trust when entering credit card details (19%) are mentioned more often.⁸ Unlike shipping costs or delivery times, you can remove this reason with one setting in your shop system. The article on the main reasons for abandoned purchases gives an overview of all the causes.

Even so, many shops do not put the guest option front and centre. 62% of the websites benchmarked by Baymard do not make guest checkout the most prominent option.⁷ The guest path then exists, but it is easy to overlook, and to the customer the checkout looks as if an account were mandatory.

The abandonment figures show how much potential lies in the checkout. In the second half of 2025, the cart abandonment rate was 72.32%, a record high. The figures are based on data from around 3,000 online shops.⁹ So out of 100 filled carts, only around 28 are paid for. Any reason for abandonment that you can remove in your own checkout therefore deserves priority.

For Germany, there is only an older figure on preferences. In a GetApp survey from June 2022, 62% of the German online shoppers surveyed said they prefer to pay as a guest when buying from a retailer for the first time.¹⁰ The article on reducing abandoned purchases collects further measures against abandonment.

Customer account or guest checkout: Pros and cons

The customer account is a tool for repeat buyers, and guest checkout is the fastest route to the first purchase. Both have advantages and disadvantages for retailers, and the balance changes when the account is optional rather than mandatory.

What a customer account offers

An account offers customers and retailers real convenience for repeat purchases. The main advantages at a glance:

• Faster repeat purchases: Addresses are saved, and the second checkout is shorter. According to the DSK, you may only store payment methods with separate consent.
• Order overview and returns: Customers see status, invoices and returns in one place. This takes pressure off customer service.
• Communication on marketplaces: Where there are many third-party sellers, the account brings together messages, guarantee cases and returns.
• Data for personalisation: The order history enables relevant recommendations. For analysing it for advertising purposes, however, the DSK requires separate consent.

Customer loyalty does not need a mandatory account

The most common argument for a mandatory account is customer loyalty. The data shows where the bottleneck is: Only 14.77% of buyers return for another purchase, and the second purchase follows after about two weeks on average.¹¹ For customer loyalty, what matters most is therefore whether you contact first-time buyers again within this time window. An email address with consent is enough for this; you do not need a password.

The EDPB also considers a mandatory account not necessary for loyalty purposes. According to its recommendations, collecting the email address once in guest mode can serve this purpose as well.⁵

Where guest checkout creates extra work

Guest checkout also has disadvantages for retailers. In practice, duplicate customer records arise when the same person orders once as a guest and once with an account. Without an account, there is also no order history on which recommendations can build.

Then there is the risk of fraud. Guest checkout interfaces have no login as a barrier, and according to Bitkom, this makes them a preferred target for card testing, meaning automated tests of stolen card data.⁶ Both disadvantages can be limited technically, for example by merging records via the email address and by fraud screening in the payment process.

How to design a guest checkout that sells

A good guest checkout puts the guest option first and moves account creation to after the purchase. The Baymard Institute derives these rules from its studies:¹²

1. Guest first: Place the guest option as the first choice and as a button, not as a text link.
2. Clear labelling: Name the option unambiguously, for example “Check out as guest”.
3. Allow known email addresses: Let guests order even if an account already exists for their email address, instead of forcing a login.
4. Offer an account after the purchase: Offer account creation on the confirmation page. Name and address are already available at that point, so only the password is missing.

Schematic illustration based on the recommendations of the Baymard Institute¹²

Give existing customers a discreet login that does not push the guest path aside. Also check every required field. Phone number, date of birth or company name only belong in the checkout if you really need this information to process the order. This reduces friction and is in line with data minimisation. The article on checkout optimisation shows ten tips for the entire ordering process.

Guest checkout in Shopware, WooCommerce and Shopify

All three shop systems support guest checkout as standard. The differences lie in the default setting in the checkout and in when and how an account is offered.

Shopware 6

In Shopware 6 (from version 6.7.1.0), you will find the options under “Settings”, “Customer”, in the “Login & registration” section (German interface: “Einstellungen”, “Kunde”, “Anmeldung und Registrierung”). The key option is “Create customer account by default” (German: “Standardmäßig ein Kundenkonto anlegen”). If it is switched off, Shopware initially treats customers in the checkout as guests, and anyone who wants an account ticks a box. If it is switched on, an account is created by default, and anyone who only wants to order as a guest has to tick a box.¹³ So that customers actively choose an account instead of deselecting it, leave the option switched off.

Two further options affect guests directly. With an expiry time for guest accounts, Shopware automatically deletes the guest accounts created in the background after the set time. The option “Double opt-in for guest orders” (German: “Double-Opt-In für Gast-Bestellungen”) sends guests an email after the order, which they must use to confirm the order.¹³ Consider whether you need this extra step. The confirmation relates to the order, not to the newsletter.

WooCommerce

In WooCommerce, the settings are under WooCommerce, Settings, Accounts & Privacy. There, enable guest checkout and login during checkout so that existing customers can log in. WooCommerce offers three places for account creation: After checkout, during checkout and on the “My account” page.¹⁴

The option of account creation after checkout matches Baymard’s recommendations. The customer orders as a guest and then creates an account with a few clicks. Have the username generated automatically and a link sent for setting the password. With the option to delete inactive accounts after a set period, you implement the deletion after inactivity that the DSK and, according to the Hamburg authority’s account, the OLG Hamburg name as a building block of data minimisation. Purchases via WooCommerce Subscriptions still require an account.¹⁴

Shopify

Shopify can require customers to log in to a customer account before checkout.¹⁵ Check in your shop settings that no login is required. Only then can guests order without an account.

Shopify’s new customer accounts work without a password. Customers log in with a six-digit one-time code that Shopify sends by email. This removes the need to set a password. Shops that still use the older classic customer accounts can switch to the new version.¹⁶

How to reach guests again after they abandon

You can only contact guests who abandon the checkout by email with legal certainty if you have their consent. Under § 7(2) no. 2 of the German Unfair Competition Act (UWG), email advertising without the recipient’s prior express consent counts as an unacceptable nuisance. The exception in § 7(3) UWG requires, among other things, that the retailer obtained the address in connection with the sale of goods or a service.¹⁷

In the view of the data protection authority of North Rhine-Westphalia, this exception does not apply to shoppers who abandon without completing a purchase. According to Dr. Datenschutz, a German data protection blog, the authority classifies cart reminders as advertising in its activity report for 2025 and rejects the exception for a customer who had already abandoned their first order.¹⁸

For guests who have completed a purchase, opinions differ. In 2022, the DSK took the view that anyone who orders as a guest as a rule indicates that they do not want to receive advertising.¹ The law firm Graf von Westphalen countered that § 7(3) UWG specifically allows advertising for similar goods without consent.¹⁹ According to the case summary by the Federation of German Consumer Organisations (vzbv), the Court of Justice of the European Union (CJEU) gave the soft opt-in exception in the EU ePrivacy Directive a broad interpretation on 13 November 2025 (C-654/23). Under this interpretation, even a free registration can be a collection in connection with a sale. If the conditions of the exception are met, Art. 6 GDPR then does not need to be examined separately.²⁰ As far as can be seen, there is no court decision specifically on guest customers.

You are therefore only on the safe side with consent that exists before the abandonment. It must be given actively. A pre-ticked box is not enough, as Recital 32 GDPR makes clear. Because you must be able to demonstrate consent (Art. 7(1) GDPR), double opt-in has become the standard. The customer confirms their sign-up via a link in an email. The article on double opt-in emails shows how to design this confirmation email.

The best time to obtain consent is while the visitor is still in the shop. uptain is specialised software against cart abandonment and uses newsletter pop-ups for this, which collect email addresses together with consent via double opt-in. If a visitor who has signed up this way later abandons the purchase, cart abandonment emails remind them of their cart. The page Win back cart abandoners shows how this works.

uptain works with a data processing agreement and servers in Frankfurt, without IP tracking in the basic setup. Technical integration takes around seven minutes, and the complete setup about 30 minutes. The pages for Shopware 6, WordPress and WooCommerce, and Shopify show how this works for each shop system.

Frequently asked questions about guest checkout

Is guest checkout mandatory?

In the view of German data protection authorities, yes, in principle. The German Data Protection Conference has required guest access alongside the customer account since 2022. Exceptions only apply in well-founded cases, for example for large marketplaces such as Otto.de, whose mandatory account the Hanseatic Higher Regional Court of Hamburg (OLG Hamburg) considered permissible in 2025. If in doubt, retailers should offer guest access.

Is guest checkout GDPR-compliant?

Yes, if you only collect the necessary data and inform customers about it in your privacy policy. Guest checkout is the more data-minimising option. The legal basis is the performance of a contract under Art. 6(1)(b) GDPR. According to the German Data Protection Conference (DSK), data that is no longer needed must be deleted once the order has been processed, including any warranty claims.

Do guest orders need double opt-in?

Not for the order itself, because processing it is based on the performance of a contract, not on consent. For newsletters and other promotional emails, however, you generally need consent that you can demonstrate. Double opt-in has become the standard for this. The Shopware option for guest orders only confirms the order.

What is the difference between guest access and a customer account?

With guest access, the customer only provides the data for the individual purchase, without a password. A customer account stores addresses and order history permanently and requires a login. Customers gain convenience for repeat purchases, and retailers gain more data. In the view of German data protection authorities, such an account requires freely given consent.

Conclusion

In 2026, guest checkout is the norm in the view of German data protection authorities, and at the same time a conversion lever. The DSK has required it since 2022, the OLG Hamburg has only recognised an exception for a marketplace with many third-party sellers, and the EDPB recommendations point in the same direction. At the same time, forced account creation is a measurable reason for abandonment. So offer the guest path on an equal footing, move the account to after the purchase and secure consent for the follow-up contact.

Sources

¹ Datenschutzkonferenz (DSK): Hinweise der DSK, Datenschutzkonformer Online-Handel mittels Gastzugang, Stand 24.03.2022 [DSK guidance, data protection compliant online retail via guest access, as of 24 March 2022] (2022), https://www.datenschutzkonferenz-online.de/media/dskb/20222604_beschluss_datenminimierung_onlinehandel.pdf [in German] (last accessed: 30 October 2026)

² activeMind.legal: Müssen Onlinehändler Gastaccounts bereitstellen und wofür dürfen sie Kundendaten nutzen? [Do online retailers have to provide guest accounts, and what may they use customer data for?] (2024), https://www.activemind.legal/de/guides/urteil-gastaccounts-onlineshop/ [in German] (last accessed: 30 October 2026)

³ Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI): Gastzugang im Onlinehandel, OLG Hamburg bestätigt HmbBfDI, Pressemitteilung vom 12.03.2025 [Guest access in online retail, OLG Hamburg confirms HmbBfDI, press release of 12 March 2025] (2025), https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Pressemitteilungen/2025/250312_PM_Gastzugang_im_Onlinehandel_OLG_Hamburg_bestaetigt_HmbBfDI.pdf [in German] (last accessed: 30 October 2026)

⁴ Onlinehändler News (Händlerbund): Muss ich Gastbestellungen in meinem Shop ermöglichen? [Do I have to allow guest orders in my shop?] (2025), https://ohn.haendlerbund.de/recht/datenschutz/gastbestellungen-shop-ermoeglichen [in German] (last accessed: 30 October 2026)

⁵ European Data Protection Board (EDPB): Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites, Version 1.0 for public consultation (2025), https://www.edpb.europa.eu/system/files/2025-12/edpb-recommendations-202502-mandatory-user-accounts_en.pdf (last accessed: 30 October 2026)

⁶ Bitkom: Bitkom on the EDPB Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites (2026), https://www.bitkom.org/sites/main/files/2026-02/bitkom-statement-edpb-recommendations-creation-of-user-accounts-on-ecommerce-websites-2-2025.pdf (last accessed: 30 October 2026)

⁷ Baymard Institute: Checkout UX 2025, 10 Pitfalls and Best Practices (2025), https://baymard.com/blog/current-state-of-checkout-ux (last accessed: 30 October 2026)

⁸ Baymard Institute: Cart Abandonment Rate Statistics (2025), https://baymard.com/lists/cart-abandonment-rate (last accessed: 30 October 2026)

⁹ uptain: Kaufabbrüche im Fokus, Zweiter Halbjahresreport 2025 [Abandoned purchases in focus, second semi-annual report 2025] (2026), https://uptain.de/en/blog/e-report-cart-abandonment-second-semi-annual-report-2025/ (last accessed: 30 October 2026)

¹⁰ GetApp: Kunden wollen mehr Klarheit über den Datenschutz beim Online-Einkauf [Customers want more clarity about data protection when shopping online] (2022), https://www.getapp.de/blog/2865/datenschutz-online-verbrauchermeinungen [in German] (last accessed: 30 October 2026)

¹¹ uptain: Wiederkehrende Käufer, Wie viel sind sie wirklich wert? [Returning buyers, how much are they really worth?] (2025), https://uptain.de/blog/e-report-wiederkehrende-kaeufer/ [in German] (last accessed: 30 October 2026)

¹² Baymard Institute: Make Guest Checkout the Most Prominent Option (2023), https://baymard.com/blog/make-guest-checkout-prominent (last accessed: 30 October 2026)

¹³ Shopware: Shopware 6, Einstellungen, Anmeldung & Registrierung, ab Version 6.7.1.0 [Shopware 6, settings, login and registration, from version 6.7.1.0] (n.d.), https://docs.shopware.com/de/shopware-de/einstellungen/login-registrierung [in German] (last accessed: 30 October 2026)

¹⁴ WooCommerce: Accounts and Privacy Settings (2026), https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/ (last accessed: 30 October 2026)

¹⁵ Shopify: CustomerAccountsV2, GraphQL Admin API, field loginRequiredAtCheckout (n.d.), https://shopify.dev/docs/api/admin-graphql/latest/objects/CustomerAccountsV2 (last accessed: 30 October 2026)

¹⁶ Shopify Help Center: Customer accounts (n.d.), https://help.shopify.com/manual/customers/customer-accounts (last accessed: 30 October 2026)

¹⁷ Bundesministerium der Justiz: Gesetz gegen den unlauteren Wettbewerb (UWG), § 7 Unzumutbare Belästigungen [Act against Unfair Competition (UWG), § 7 Unacceptable nuisance] (2026), https://www.gesetze-im-internet.de/uwg_2004/__7.html [in German] (last accessed: 30 October 2026)

¹⁸ Dr. Datenschutz (intersoft consulting): Warenkorbabbrecher-Mails als unzulässige Werbung? [Cart abandonment emails as unlawful advertising?] (2026), https://www.dr-datenschutz.de/warenkorbabbrecher-mails-als-unzulaessige-werbung/ [in German] (last accessed: 30 October 2026)

¹⁹ GvW Graf von Westphalen: Kundendaten im Online-Handel, Pflicht eines Gastzugangs und starke Tendenz zur Einwilligung [Customer data in online retail, obligation to offer guest access and a strong tendency towards consent] (2022), https://www.gvw.com/aktuelles/blog/detail/kundendaten-im-online-handel-pflicht-eines-gastzugangs-und-starke-tendenz-zur-einwilligung [in German] (last accessed: 30 October 2026)

²⁰ Verbraucherzentrale Bundesverband (vzbv): Zur Zulässigkeit von E-Mail-Werbung an Nutzer kostenloser Online-Dienste („Soft-Opt-In“), Urteilszusammenfassung EuGH C-654/23 [On the admissibility of email advertising to users of free online services (soft opt-in), case summary CJEU C-654/23] (2025), https://www.vzbv.de/urteile/zur-zulaessigkeit-von-e-mail-werbung-nutzer-kostenloser-online-dienste-soft-opt [in German] (last accessed: 30 October 2026)