Mandatory gender information in online store not legal
In the online purchasing process, it is common to ask for gender in addition to name and shipping address. But why is this the case? After all, a person can only be identified by their name. On January 9, 2025 (case number C-394/23), the European Court of Justice ruled that it is no longer mandatory to ask for the title “man” or “woman”, at least for train ticket purchases.
Facts of the case
In this case, the French train company SNCF Connect always asked customers whether they wanted to be addressed as “Mr.” or “Mrs.” when purchasing train tickets online. It was not possible to omit this information.
Figure: Query of gender at SNCF Connect
Source: https://www.sncf-connect.com/
The association “Mousse”, which campaigns against sexual discrimination, filed a complaint against this on the grounds of a breach of the GDPR. Mousse argued that there was no legal basis for the collection of gender data: Neither was the collection necessary for the “performance of a contract”, nor was the collection necessary to safeguard the legitimate interests of SNCF Connect.
The train company replied that the query made it possible to address customers in a personalized manner. Moreover, it is a general custom in France to be addressed as personally as possible.
Reasons for the decision
The ECJ confirmed Mousse’s legal opinion: there was no legal basis for the data collection.
Processing can be lawful if it is necessary for the performance of the contract pursuant to Art. 6 (1) (b) GDPR. This is the case if the specific data processing is objectively essential, i.e. the contract cannot be fulfilled without the data processing. According to the ECJ, querying gender can generally be such a necessary contractual purpose. However, it is not sufficient to assume that the purpose of the contract is “personal communication”. Specifically, the ECJ argues that the ticket sale could also have been made by requesting a “general and inclusive courtesy formula” that is not related to gender identity.
The ECJ also rejects a legal basis in the form of the protection of legitimate interests (Art. 6 para. 1 letter f GDPR). Processing for this purpose is justified if the processing is necessary for the purposes of a legitimate interest and the interests of the processor override those of the data subject. The court emphasized that commercial and personalized direct advertising can certainly be a legitimate business interest. In this specific case, however, it was not necessary to query gender identity. Such a query would therefore also contradict the principle of data minimization.
Practical advice
The current ruling of the ECJ confirms the view established in the Meta ruling from 2022: The requirements for the necessity of data processing in accordance with Art. 6 GDPR must be interpreted narrowly. This means that data processing that is also possible with less intrusive means must be omitted.
In practice, this means that mandatory gender identity queries require a specific legal justification. Is the query absolutely necessary for the fulfillment of the contract? This may be the case for gender-specific offers, e.g. gender-segregated sleeping areas in a train or hostel. If this is not the case, the only recourse is to “safeguard the legitimate interests” of the company. A voluntary gender query is possible in any case, but must be marked accordingly.
Your own online store should therefore be checked to see whether the query is voluntary or mandatory. This applies to all websites that request this data in a form, regardless of whether it is a newsletter, a contact form or a purchase.
