May a webshop keep my account years after I unsubscribe?
Account after erasure request (Art. 17) must go. Only legally required data (Wwft, 7-year-fiscal for invoices) may be retained.
Many webshops keep "for convenience" old accounts — often unnecessary + GDPR-violating. GDPR Art. 17 (erasure): after your request webshop must act within 30 days. Allowed exceptions: (1) Statutory retention — Dutch Tax Act Art. 52 = invoices 7 years. NOT the whole customer account, only invoice data. (2) Wwft obligation for specific transactions >€10k. (3) Pending dispute/lawsuit. (4) Voluntary retention within consent (e.g. "I want to keep my account for later"). What MUST go: contact details, profile data, delivery addresses, marketing consent, wishlist, reviews-with-name, payment methods (bank IBANs), customer-number linkage. Only anonymised transaction data may stay for 7-year fiscal. How to verify? Access request (Art. 15) after erasure request — if you still get found data, erasure wasn't executed. On refusal: AP complaint — since CJEU 2023-2024 also stress + uncertainty = damage Art. 82. Typical amounts €250-€1,500. Recent AP fines 2023-2025: multiple webshops with "we can't fully delete your account" attitude fined €50k-€250k.
Sources
🔎 Common search variants
Recognise your own search? Our answer above covers these too.
- “webshop delete account gdpr”
- “customer account years retention”
- “shop account removal”