Wishlist and Registries

Subtitle: Why “Share My Wishlist” and Registry Features Still Require Privacy Protections

Sending someone your wishlist or sharing a gift registry feels personal—and harmless.
It doesn’t involve rewards, contests, or viral invites.

But the moment your platform helps users send a wishlist to their contacts (even just by email), you’re still processing third-party personal data—and that triggers legal obligations under various privacy regulations.

Key Principle: Contact sharing without marketing incentives is still regulated if you process a friend’s or family member’s email address. The absence of commercial incentives doesn’t exempt you from privacy compliance requirements.

This article explains how to build wishlist, registry, and invite-only sharing features that are user-friendly and privacy-compliant, balancing the personal nature of these features with necessary privacy protections.

Foundation

This article continues from:
Privacy Compliance Playbook for Contact-Based Referral Programs

Key related articles:

The Consent Playbook – Understanding different types of consent and when each is required
Don’t Touch That Data – Principles of data minimization in contact handling
Your App, Their Data – Legal responsibilities when processing third-party data

What Features This Covers

Wishlist and registry sharing features come in various forms, but all involve similar privacy considerations:

Feature	Description	Common Implementation	Privacy Implications
Wishlist Sharing	User emails a personal shopping list to contacts	“Email my wishlist” button on product collections	Processing recipient email addresses; sending system-generated messages
Gift Registries	Wedding, baby, or graduation gift lists shared by email	Dedicated registry pages with sharing options	Processing multiple recipient emails; potentially storing preferences
Private Link Sharing	User creates an invite-only event or deal, sends link	“Share this private sale” with email option	Processing recipient data; tracking who accessed private content
Save-for-Later Carts	User shares cart contents with friends or family	“Email my cart” functionality	Processing recipient data; storing cart contents linked to non-users

All of these features involve three critical privacy touchpoints:

Third-party email collection – Gathering contact information for people who haven’t directly engaged with your platform
Sending a system-delivered message – Your platform, not just the user, is involved in the communication
Handling private, personal data flows – The content being shared often contains personal preferences and interests

Technical Implementation Considerations:

When implementing these features, you’re typically creating data flows that involve:

Contact data collection – Capturing email addresses or other contact information
Message generation – Creating the email or message that will be sent
Delivery infrastructure – Using your email sending system to deliver the message
Tracking and analytics – Potentially monitoring opens, clicks, or conversions
Data storage – Storing both the shared content and recipient information

Each of these steps creates specific privacy obligations that must be addressed in your implementation.

Privacy Requirements for Wishlist and Registry Features

To implement wishlist and registry sharing features compliantly, follow these best practices at each step of the process:

Step	Best Practice	Implementation Guidance
Collecting contacts	Ask clearly who they’re inviting and why	Use clear form labels; avoid pre-filled fields; limit to necessary information only
Consent	Include checkbox: “I confirm I have permission to share this.”	Make this an active opt-in (not pre-checked); document consent
Message preview	Show the user the exact invite that will be sent	Display a complete preview including sender information, content, and footer
Opt-out	Provide opt-out links in every message	Make opt-out mechanisms prominent and easy to use; honor opt-outs globally
Data retention	Delete unused contact data quickly	Implement automatic deletion after sending or after a short retention period
Suppression	Honor unsubscribe requests globally	Maintain a suppression list to prevent future messages to opted-out recipients

Detailed Implementation Guidance:

1. Contact Collection Interface:

<!-- Good Implementation Example -->
<div class="share-wishlist-form">
  <h3>Share Your Wishlist</h3>

  <p>Send your wishlist to friends or family members:</p>

  <div class="recipient-fields">
    <div class="recipient-field">
      <label for="recipient1">Recipient Email:</label>
      <input type="email" id="recipient1" required>
    </div>
    <button type="button" class="add-recipient">+ Add another recipient</button>
  </div>

  <div class="message-field">
    <label for="personal-message">Add a personal message (optional):</label>
    <textarea id="personal-message" maxlength="200"></textarea>
  </div>

  <div class="consent-checkbox">
    <input type="checkbox" id="consent" required>
    <label for="consent">I confirm I have permission to share my wishlist with these recipients.</label>
  </div>

  <button type="submit">Preview Message</button>
</div>

2. Data Retention Policy:
Implement a clear policy for handling recipient data:

Store contact information only for the time needed to send the message
Delete contact data within a reasonable timeframe after sending (e.g., 30 days)
Document your retention policy and ensure it’s technically enforced

3. Suppression List Implementation:


def can_send_wishlist(recipient_email):
    # Hash the email for privacy-preserving lookup
    hashed_email = secure_hash(recipient_email.lower())

    # Check if in suppression list
    if is_in_suppression_list(hashed_email):
        return False, "This recipient has opted out of receiving messages."

    return True, ""

For more detailed guidance on implementing these practices, see: Post-Send Obligations

Example Message Footer for Wishlist Sharing

The footer of your wishlist sharing messages plays a crucial role in compliance. It should include:

This wishlist was sent to you by [User Name] through [Platform Name].
You are receiving this because [User Name] wanted to share their wishlist with you.
We respect your privacy and won't send you further messages unless you sign up.
[Unsubscribe Link] | [Privacy Policy Link]

This footer satisfies several key requirements:

Sender identity – Clearly identifies both the user and your platform
Reason for message – Explains why the recipient received the message
Single-send commitment – Assures the recipient they won’t receive further messages
Opt-out mechanism – Provides a way to decline future communications

Implementation Best Practices:

Make the footer visually distinct but still readable (avoid tiny gray text)
Ensure the unsubscribe link is functional and processes opt-outs immediately
Link to a relevant privacy policy section that explains your wishlist sharing practices
Test the footer across email clients to ensure it displays properly

Legal Standards You Still Must Meet

Even though wishlist and registry sharing features feel personal rather than commercial, they still trigger various legal requirements:

Region	Key Requirements	Implementation Guidance
GDPR (EU/UK)	Lawful basis, transparency, opt-out rights	Establish legitimate interest or consent as your lawful basis; provide clear privacy notices; implement data subject rights
PECR (EU/UK)	Rules for electronic communications	Identify the sender clearly; provide opt-out mechanisms; don’t disguise marketing content
CASL (Canada)	Express consent required if message is “commercial electronic message”	Determine if your message qualifies as commercial; if so, implement express consent mechanisms
CCPA/CPRA (California)	Disclose collection and allow opt-out of data sharing	Include wishlist sharing in your privacy policy; provide opt-out mechanisms
CAN-SPAM (USA)	Sender ID + opt-out in commercial emails	Include accurate header information; provide clear opt-out; honor opt-outs within 10 business days

Key Legal Considerations:

Is it a “commercial electronic message”?
- Under CASL, messages that encourage participation in a commercial activity may qualify
- Even if the primary purpose is personal sharing, promotional elements could trigger requirements
- When in doubt, implement the stricter requirements to ensure compliance
What is your lawful basis under GDPR?
- Legitimate interest may apply if the processing is necessary for sharing the wishlist
- Document your legitimate interest assessment
- Consider the reasonable expectations of the data subject
What disclosures are required?
- Your privacy policy should explain how you process data for wishlist sharing
- Be transparent about any tracking or analytics applied to shared wishlists
- Disclose retention periods for recipient data

For more comprehensive guidance on applicable laws, see: Other Privacy Laws

Risky Patterns to Avoid

Certain implementation patterns create significant legal and reputational risks:

Risky Design	Why It’s a Problem	Better Alternative
Auto-emailing entire contact lists	Overreach and breach of data minimization principles	Require manual selection of each recipient
Pre-selecting all invitees	Undermines the “freely given” aspect of consent	Require active selection of recipients
No way to opt out after receiving invite	Violates multiple laws including CAN-SPAM and GDPR	Implement prominent, easy-to-use opt-out mechanisms
Keeping contact data indefinitely	Retention rule violations under GDPR and other laws	Implement automatic deletion after a defined period
Using wishlist data for marketing	Secondary use violation	Only use data for the specific purpose disclosed
Hiding the platform’s role in the message	Misleading recipients about who’s processing their data	Clearly identify your platform as the sender alongside the user

Case Study: Williams-Sonoma Registry Sharing

Williams-Sonoma implemented a registry sharing feature that allowed users to share their registry via email. However, they initially:

Didn’t clearly identify the company as the sender
Lacked prominent unsubscribe options
Sent follow-up reminders without explicit consent

After customer complaints and regulatory scrutiny, they redesigned the feature to:

Clearly identify “Williams-Sonoma” in the sender line
Add prominent unsubscribe links
Require explicit consent for any follow-up messages
Implement proper suppression list management

This redesign not only improved compliance but also increased user trust and engagement with the registry feature.

Summary: Private Sharing Still Needs Privacy

Just because your feature isn’t flashy, viral, or incentivized doesn’t mean it’s unregulated. Wishlist and registry sharing features still require robust privacy protections:

Feature Aspect	Privacy Practice	Implementation Approach
Sending invites	Let users pick and preview recipients	Design interfaces that require deliberate recipient selection
Consent	Require user confirmation	Implement clear consent checkboxes and preview screens
Messaging	Identify sender, explain reason, allow opt-out	Design compliant message templates with all required elements
Storage	Delete unused contacts after invite sends	Implement automatic deletion workflows
Non-user rights	Support opt-out and suppression globally	Build robust suppression list management

Best Practices for Wishlist and Registry Features:

Design for intentionality
- Make sharing a deliberate action, not an automatic one
- Require users to specifically select each recipient
- Show clear previews of what will be sent
Respect recipient privacy
- Treat every recipient as a person with privacy rights
- Provide clear opt-out mechanisms
- Honor privacy preferences globally
Implement proper data handling
- Minimize the data you collect about recipients
- Delete data promptly after it’s no longer needed
- Document your compliance measures

Best Practice: Even if it’s “just a wishlist,” it still deserves real-world privacy protections. Implementing these protections not only ensures compliance but also builds trust with both users and recipients.

Up Next

Next, we’ll dive into incentivized referrals—where the stakes get even higher once rewards enter the picture.

Read Incentivized Referrals to learn about the additional compliance requirements when offering rewards for referrals.

Or revisit consent and collection practices:
The Consent Playbook