Abandoned Cart Emails Under GDPR: PECR, Soft Opt-In, and Fines

Sending GDPR-compliant abandoned cart emails requires either explicit prior consent from the shopper or meeting the narrow “soft opt-in” exception for existing customers, and you have to satisfy two separate laws at once: the GDPR, which governs how you handle the shopper’s personal data, and the ePrivacy Directive (or the UK’s PECR), which governs whether you can send the email at all. Getting one right and the other wrong still leaves you exposed to fines of up to €20 million or 4% of global annual turnover. The distinction between a returning customer and a first-time visitor decides almost everything about what you can and can’t do.

Cart Emails Count as Marketing, Not Transactional

Regulators treat abandoned cart emails as direct marketing. A transactional email fulfills an existing obligation: a shipping notification, an order receipt, a password reset. An abandoned cart email doesn’t fit that category because no transaction was completed. Its purpose is to encourage a purchase, which makes it promotional.

The UK’s Information Commissioner’s Office states in its guidance on electronic mail marketing that you must not send marketing emails to individuals unless they have specifically consented or qualify under the existing-customer exception.¹ Retailers who treat cart reminders as service messages and skip the consent machinery are operating outside the law from the first email they send.

Two Laws Apply, Not One

Many retailers focus on GDPR and overlook the ePrivacy Directive (Directive 2002/58/EC), which specifically governs electronic communications including marketing emails. In the UK, this directive is implemented through the Privacy and Electronic Communications Regulations (PECR). Both frameworks have to be satisfied at the same time.

The GDPR requires a valid legal basis to process someone’s email address and cart data. The ePrivacy Directive separately requires consent before you send that person an unsolicited marketing email. The European Data Protection Board confirmed in its 2024 guidelines on legitimate interests that because the ePrivacy Directive requires prior consent for unsolicited electronic marketing, you generally cannot rely on GDPR’s legitimate interests basis alone to justify sending the email.² This is where most e-commerce compliance strategies fall apart.

The Soft Opt-In for Existing Customers

The most useful carve-out for cart recovery emails applies to existing customers. Under Article 13(2) of the ePrivacy Directive and Regulation 22 of the UK’s PECR, you can send marketing emails without fresh consent if three conditions are all met:

The person’s email address was collected during a previous sale or during negotiations for a sale.
The email promotes products or services similar to what the customer originally bought or negotiated to buy.
The customer was given a clear and simple way to opt out when their details were first collected, and again in every subsequent message.

The ICO’s guidance summarizes this as: an existing customer who bought or negotiated to buy a similar product from you, and you gave them a simple way to opt out both when you first collected their details and in every message you sent.¹ A returning customer who previously bought running shoes, left a pair of trainers in their cart, and received an opt-out checkbox at their original purchase likely qualifies. A first-time visitor who entered their email at checkout and left without ever completing a purchase almost certainly does not, because there’s no prior sale to anchor the relationship.

The Court of Justice of the European Union reinforced this framework in a November 2025 ruling, confirming that when the soft opt-in conditions are met, a separate legal basis under Article 6 of the GDPR is not required for processing the email address.

New Visitors Need Explicit Consent

When a first-time visitor enters their email during checkout and abandons the cart, the soft opt-in doesn’t apply. You need explicit consent before sending a recovery email. Under Article 4 of the GDPR, consent must be freely given, specific, informed, and unambiguous, and demonstrated by a clear affirmative action.³

In practice, that means three things:

No pre-ticked boxes. The visitor must actively check a box or take an equivalent affirmative action. Silence, pre-selection, or bundling marketing consent into terms of service acceptance doesn’t count.
Specific disclosure at the point of collection. Before the shopper enters their email, they need to know that if they don’t complete the purchase, you plan to email them about the items they left behind. Burying that in a privacy policy isn’t sufficient; the notice has to be visible where the email is entered.
Granular purpose. Consent to a newsletter is not consent to a cart abandonment email. Each purpose needs its own description and its own opt-in.

This is where cart recovery programs for new visitors typically break down. The checkout flow captures the email to complete the order. Repurposing it for marketing without a separate, clear opt-in violates both the GDPR’s consent standard and the ePrivacy Directive’s prohibition on unsolicited marketing emails.⁴

Why Legitimate Interests and Pre-Contractual Steps Won’t Save You

Two legal bases under GDPR Article 6 tempt retailers looking for a shortcut around consent. Neither works the way most teams hope.

Legitimate Interests

Recital 47 of the GDPR acknowledges that processing personal data for direct marketing “may be regarded as carried out for a legitimate interest.”⁵ That language encourages many businesses to build their cart recovery program on this basis. The EDPB’s 2024 guidelines made the limits explicit: because the ePrivacy Directive already requires prior consent for unsolicited electronic marketing, relying on legitimate interests under Article 6(1)(f) for those same emails is generally precluded.²

Even setting the ePrivacy issue aside, legitimate interests requires a three-part test. The ICO describes it as a purpose test (are you pursuing a legitimate interest), a necessity test (is the processing necessary and not achievable a less intrusive way), and a balancing test (do the individual’s interests override yours).⁶ The balancing test is hard to pass for new visitors with no prior relationship to your brand, since, as the EDPB notes, a data subject’s interests are likely to override yours when they “do not reasonably expect further processing.”⁵

Pre-Contractual Steps

Article 6(1)(b) allows processing that is “necessary for the performance of a contract” or “to take steps at the request of the data subject prior to entering into a contract.”⁷ Retailers sometimes argue that adding items to a cart is a step toward a contract, so the follow-up email is part of that process. The problem is “at the request of the data subject.” The shopper didn’t request the email. They left. Sending a message to bring them back is your initiative, not theirs, and this basis doesn’t hold up under regulatory scrutiny.

Unsubscribe, Objection, and Erasure

Under Article 21 of the GDPR, anyone has an unconditional right to object to processing of their personal data for direct marketing. No balancing test, no exceptions. Once they object, you stop.⁸ The European Commission’s guidance specifies that this objection must be honored free of charge and that you must inform individuals of the right at your first communication with them.⁹

Every abandoned cart email needs a visible unsubscribe link. Your suppression lists must update immediately so no follow-up messages go out after an opt-out. A single extra email after an objection is the kind of mistake that generates complaints to supervisory authorities.

The right to erasure under Article 17 goes further. When someone objects to direct marketing processing under Article 21, they can also demand that you delete their personal data entirely. The controller must erase the data “without undue delay” when the data subject objects to processing for direct marketing under Article 21(2).¹⁰ That means deleting the email address, cart contents, and any behavioral data captured during the visit, not just removing them from a mailing list, unless another lawful basis justifies keeping the data.

Cookies and Tracking Pixels Are a Separate Consent Layer

Session cookies that hold items in a cart during a single browsing session generally qualify as “strictly necessary” under the ePrivacy Directive and don’t require consent. Tracking pixels and persistent cookies used to identify who abandoned a cart and trigger a marketing email are different. Those serve a marketing purpose and require explicit consent through a cookie banner before they’re placed on the user’s device. The EDPB confirmed that when tracking techniques are used in the context of direct marketing, consent under the ePrivacy Directive must be respected, and consent will “likely constitute the appropriate legal basis” for both the tracking and the subsequent processing.²

Alongside cookie consent, Articles 13 and 14 of the GDPR require you to tell people what you’re doing with their data when you collect it. For a cart recovery program, that means disclosing who the controller is, that email addresses entered at checkout may be used to send cart reminders, the legal basis you’re relying on, how long you keep the data, and the rights to object, withdraw consent, request erasure, and complain to a supervisory authority.¹¹¹²

How Long You Can Keep Cart Data

The GDPR doesn’t prescribe a specific retention period, but the principle is straightforward: personal data can’t be kept longer than necessary for the purpose it was collected for. If the purpose is recovering an abandoned sale, that window has a natural shelf life. A shopper who abandoned a cart six months ago has almost certainly moved on, and holding their email address and product preferences past that point becomes difficult to justify.

Many retailers set retention periods of 30 to 90 days for abandoned cart data, which lines up with the timeframe where recovery emails still generate meaningful conversion. Whatever period you choose, document it in your data processing records and disclose it in your privacy policy. When the period expires, the data should be genuinely deleted, not archived somewhere accessible later. A stated retention policy you don’t enforce is worse than no policy, because it creates a documented gap between what you promised and what you do.

Fines and Enforcement

Violations of the GDPR’s core processing principles, including consent requirements, can trigger administrative fines up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹³ Fines aren’t applied mechanically per email sent; regulators evaluate the overall conduct and the infringements it gives rise to, weighing seriousness, aggravating and mitigating factors, and whether the amount is effective, proportionate, and dissuasive.

Enforcement is real, not theoretical. UK authorities have fined companies for sending millions of unsolicited marketing emails without proper consent. The risk isn’t limited to large enterprises: supervisory authorities across the EU accept individual complaints, and a single shopper reporting an unwanted cart reminder can trigger an investigation that uncovers systemic problems. The practical exposure isn’t just the fine. It’s the cost of the investigation, the mandatory remediation, and the reputational damage of appearing in a regulator’s enforcement report. Individuals who suffer damage from unlawful processing can also seek compensation. Building compliant cart recovery from the start is significantly cheaper than retrofitting after a regulatory inquiry.

1
Information Commissioner’s Office. Electronic Mail Marketing
2
European Data Protection Board. Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR
3
General Data Protection Regulation (GDPR). Art. 4 GDPR – Definitions
4
European Data Protection Board. Process Personal Data Lawfully
5
General Data Protection Regulation (GDPR). Recital 47 – Overriding Legitimate Interest
6
Information Commissioner’s Office. Legitimate Interests
7
General Data Protection Regulation (GDPR). Art. 6 GDPR – Lawfulness of Processing
8
General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
9
European Commission. What Happens If Someone Objects to My Company Processing Their Personal Data
10
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure
11
General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected From the Data Subject
12
General Data Protection Regulation (GDPR). Art. 14 GDPR – Information to Be Provided Where Personal Data Have Not Been Obtained From the Data Subject
13
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines