Requesting you to prove your identity to validate a purchase: is it legal?

Your Italian online seller asks you for a copy of your ID card to validate your order? This is often part of the KYC (for "Know Your Customer") procedures put in place by some traders. Some sellers are just trying to avoid identity theft or payment fraud. Others, however, use your information to assess your creditworthiness, better target you with their marketing or learn more about your buying behaviour. How to deal with these requests? How are they regulated in Europe? Explanations and advice in this article.

It is not uncommon for an e-tailer to ask you for certain information at the beginning of the order process or before confirming your subscription to a service.

This is usually standard data such as your name, postal address, email address or telephone number. The online seller may also check your IP address or even analyse the type of hardware you are using (PC, smartphone, which operating system etc.) via software.

Some sellers also ask for a copy of your identity card or passport, or any other document proving your identity.

The purpose of these checks is to minimise the risk of payment fraud or identity theft.

Social networks, some banks... may also ask you to take a selfie or participate in a video chat, to make sure that your account is not a fake or a robot account.

In the financial, banking and insurance sectors, verification of the customer's identity is common and helps to combat money laundering and terrorist financing. But in this sector, KYC practices ("Know your customer") are very much regulated in Europe. More information in our article on blocked bank accounts.

Your IP address is also an interesting piece of data for the merchant because it allows him to know in which country you are and thus better set the language of the merchant site, the means of payment and possibly block the order.

More information in our article on the End of geoblocking.

When paying by card, online merchants targeting the French market may ask for (not require) proof of identity. But the customer has the right to refuse to provide it. The Commission Nationale Informatique et Libertés has made it clear that if the collection of the cardholder's identity is not necessary for the transaction, it should not be requested.  

Online traders often ask for personal information from buyers to prevent fraud. However, they must respect the data protection principles of the European Data Protection Regulation (EDPR).

For example, the information collected can only be used for a legitimate and legal purpose. Online retailers and social networks may not use your data for any other purpose. Nor may they keep it for longer than a justified and proportionate period. Your data must be updated and corrected, and deleted after a certain time. And only authorised persons should have access to the information requested in the context of "Know your customer" procedures.

You must of course be informed if your data is included in customer lists, you must consent to this and be able to object to it, access it and rectify it.

More information on the Protection of your personal data

The information you give the seller can also be used to query a scoring service in real time.  Scoring is a marketing technique that consists of analysing your data and assigning you a score that ranks you according to your probability of purchase, your creditworthiness, and the gain or risk you can generate.

If your scoring is good, i.e. if the prognosis on your payment behaviour is good, the online seller could offer you more payment methods, for example. And if you become a regular customer, they might even offer you more "risky" payment methods (credit cards, payment on account, SEPA direct debits, etc.).

On the other hand, if your score is poor, you will have no choice but to pay your order in advance.

When booking accommodation in the EU, some hoteliers or accommodation owners ask you to send them a copy of an identity document. But, in principle, you only have to produce it on arrival.

In France, as in Bulgaria, the hotelier is in principle not allowed to copy your identity card or passport, or any other proof of identity. If you are a foreigner (European or not), you will have to present an identity document and fill in an "individual police form". This is for the purposes of preventing public disorder, judicial investigations and searches in the interest of the individual. This form must remain at the disposal of the police/gendarmerie for six months. After this period, the card must be permanently and securely destroyed.

In Germany, the identity card cannot be copied or registered, unlike in Hungary for example.

After a purchase, a trip, a stay, an online service, you have certainly received an invitation to "share your experience", to rate the product, the restaurant, the hotel, the deliveryman, the taxi... And of course, your comments on social networks, your online opinions, will be shared, "liked" etc.

This system of permanent rating required of a consumer in all his or her behaviour in the public space or online is called "social scoring". It is the subject of debate at European level.

On 6 October 2021, the European Parliament adopted a non-binding resolution calling, among other things, for a ban on social rating systems.

In its draft opinion on the proposed EU regulation on artificial intelligence, the European Parliament's Committee on Culture and Education proposes to “ban on deployment of social scoring systems to usage by public and private entities given the inherent threat of discrimination and exclusion of certain groups or individuals.”