ICTRecht published a piece on 16 September with a short answer to a question most e-commerce teams stopped asking years ago. Can you email someone who filled a basket and left? No, not without prior consent or an existing customer relationship.
The Hessian data protection authority got there first, setting out the position in its 2024 activity report after complaints about webshops mailing people who had never bought anything. The reasoning is the same in both countries. A retargeting mail has commercial intent, so it is direct marketing and sits behind an opt-in. The customer relationship exception needs a completed purchase and a similar product, and neither exists when someone walks away from a checkout.
The CJEU’s Inteligo Media ruling last November held that a free account registration can count as obtaining details in the context of a sale, letting a freemium publisher send its newsletter under the soft opt-in with no money changing hands. Useful if you run a free tier. It needs a registration the user completed, which an abandoned checkout is not.
The bit that is actually broken
Most coverage stops at “add a checkbox” so the checkbox is usually already there.
Shopify’s checkout has one, and the abandoned checkout record includes a buyer_accepts_marketing boolean next to the email address. It is often false. The record is still available either way, so whatever integration passes it to Klaviyo or Omnisend is the thing that has to read the flag, and plenty do not.
Then there is pre-submit capture. Identity resolution vendors sell tags that read the email field on blur, collecting the address before anyone clicks submit. That is how the tag finds carts you had no record of. The user never handed over the data, so on an EEA checkout there is no lawful basis for processing it, and the vendor’s own product description says so if you read it carefully enough.
What reaches you first
Cart recovery normally sends from the same domain as your order confirmations and dispatch notices. Mail people don’t recognise gets marked as spam, and Google wants bulk senders under 0.3% complaints, ideally under 0.1%. Mail to people who never agreed to hear from you complains heavily, and cart recovery usually sends from the same domain as your order confirmations.
