Consent & rules

Are abandoned cart emails transactional? Consent, GDPR and what changes with WhatsApp

by Giorgio Terenziani · Updated on 2026-10-10 · 5 min read
Two emails side by side: an order confirmation on the left, a cart reminder with the marketing consent box ticked on the right

In short

Explains why an abandoned cart reminder is a marketing message and not a transactional one, and which legal basis you need in the EU and the US. Shows how to collect and respect consent across the Shopify checkout, Klaviyo flows and WhatsApp.

No: abandoned cart emails are not transactional. In the EU they are marketing messages, so you need the customer's consent or, for someone who has already bought from you, the "soft opt-in" exception with its limits. Transactional emails carry out an order that already exists, such as a purchase confirmation or a shipping notice.

Below you'll find the difference between the two types, what EU rules and one national authority say, a summary table, and the settings to check on Shopify, Klaviyo and WhatsApp.

Why a cart reminder is not a transactional email

What matters is the purpose of the message. A transactional email carries out a contract that has been concluded: the customer paid and needs to know the order is on its way. A cart reminder tries to complete a purchase that didn't happen, so it promotes a product. The fact that the customer typed their email address at checkout doesn't change what the message is.

Two examples from a jewelry store:

Subject: Order #1048 confirmed Hi Emily, we've received your order: sterling silver ring, size 7. We'll ship it within two business days and email you the tracking number.

Subject: Your ring is waiting for you Hi Emily, the silver ring you picked is still in your cart. Shipping is free and you have 30 days to return it. Head back to your cart in one click.

The first is transactional. The second, however friendly, is marketing.

What GDPR, ePrivacy and the regulators say

Promotional email is governed by the ePrivacy Directive (Article 13), which requires prior consent. The only exception is the existing-customer rule, often called "soft opt-in". Italy, for example, implements it in Article 130 of its Privacy Code, and the 2013 guidelines of Italy's data protection authority say a store may write without consent if the address was provided in the context of a sale, if it promotes its own similar products, and if the customer, properly informed, hasn't objected.

Someone who abandons a cart without ever buying hasn't completed any sale. In 2025 the EU Court of Justice (case C-654/23) read the "context of a sale" broadly, but it did not rule on abandoned checkouts: the prudent choice is to ask for consent. In the US, CAN-SPAM works differently: it covers messages whose primary purpose is advertising, and the "transactional or relationship" category is limited to narrow cases such as confirming a transaction already agreed, so a cart reminder is in practice a commercial message. It doesn't require prior consent, but it does require a working opt-out honored within 10 business days and your valid postal address.

Type of email Legal basis (EU) Consent needed? Example
Order confirmation, shipping, return Performance of the contract No "Your package is on its way"
Abandoned cart to someone who never bought Consent Yes "Your ring is waiting for you"
Abandoned cart to an existing customer Soft opt-in (similar products, objection always possible) No, if every condition is met Reorder of a supplement already bought
Newsletters and promotions Consent Yes "End-of-season sale"

On Shopify, the marketing consent checkbox at checkout is switched on under Settings > Checkout, in the marketing consent section. For customers in the EU, leave it unticked by default: Shopify lets you choose in which regions it is pre-selected.

In Klaviyo every profile has a status: "subscribed" (gave consent), "unsubscribed" or "never subscribed". Klaviyo itself warns that never-subscribed profiles can receive flow emails unless they are suppressed. That's why the abandoned cart flow needs a consent filter: "Person can receive email marketing" with the reason "Because person subscribed to email marketing". Tools that write the copy, such as AchillesAI, leave consent and sending to Klaviyo: the filter belongs in the flow.

Email consent doesn't carry over to WhatsApp. Meta requires an explicit opt-in that tells the customer clearly they are agreeing to receive messages and from which store. The cart reminder has to go out as an approved template, which Meta classifies as marketing even when the customer asked for it. So your checkout needs two separate checkboxes, one for email and one for WhatsApp.

Where to start

Check that the consent checkbox in your Shopify checkout isn't pre-ticked for EU customers. Open your abandoned cart flow in Klaviyo and add the email consent filter. If you use WhatsApp, add a dedicated checkbox that names your store.

Further reading: the rules for WhatsApp cart recovery, the abandoned cart flow in Klaviyo and the guide to abandoned cart recovery.

This article is general information and does not constitute legal advice.

Frequently asked questions

Can I send an abandoned cart email to someone who hasn't opted in to marketing?

In the EU the safe answer is no. The reminder aims to complete a purchase that hasn't happened yet, so it is marketing and needs consent; the soft opt-in exception only covers people who have already bought, for similar products, and who haven't objected. In the US, CAN-SPAM doesn't require prior consent, but the email needs a working unsubscribe link.

What is the difference between a transactional email and a marketing email?

A transactional email carries out a contract that already exists: order confirmation, shipping notice, return, invoice. A marketing email tries to sell something the customer hasn't bought yet, and the cart reminder falls in this group.

Does Klaviyo send the abandoned cart flow to 'never subscribed' profiles?

Yes: in Klaviyo, a profile that never subscribed but isn't suppressed can receive flow emails. To send only to people who opted in, add the filter 'Person can receive email marketing' to the flow with the reason 'Because person subscribed to email marketing'.

Does email consent also cover WhatsApp?

No. WhatsApp requires a separate, explicit opt-in that names the store, and the cart reminder must go out as a template that Meta classifies as marketing, even if the customer asked for it.

Sources

gdprconsentabandoned cartklaviyowhatsapp
Giorgio Terenziani
Giorgio Terenziani
Co-founder of AchillesAI · Performance Marketing & Creative Strategist

Performance marketer since 2015, expert in Meta and Google. Combines creative strategy, content production and data analysis with a results-driven approach.

Read in: itenfresde

Recover more sales, automatically

AchillesAI generates and optimizes recovery emails with AI, integrating with your existing tools.

Discover AchillesAI