It found e-receipts, which are used by many big-name retailers, include unwanted marketing information.

Under GDPR rules, retailers must not send direct marketing to new customers by email unless they’ve consented to receive it.

Which? sent mystery shoppers to 11 high street retailers: Topshop, Clarks, Gap (including GAP Outlet), New Look, Dorothy Perkins, Arcadia Group (Miss Selfridge, Outfit, Burton), Schuh, Mothercare, Halfords, Currys PC World and Nike.

Each retail group was visited a minimum of three times and in each case the mystery shoppers requested an e-receipt but told the retailer they did not want to receive any additional marketing.

If a retailer asks for an email address at the point of sale and plans to send marketing information, they must give shoppers the option to opt out.

E-receipts issued by Mothercare, Schuh, Halfords and Gap contained promotional marketing, indicating that the retailers may be breaking data protection rules.

One shop sent a marketing email with the e-receipt attached, while others included prompts to sign up for the store’s newsletter or invitations to complete a survey in return for money off a future purchase.

However, the investigation also identified some good practice. In all three Topshop stores visited, there were signs displayed at the tills which included information on how customer details would be used and a prompt to find out more on the website.

Alex Neill, managing director of home products and services at Which?, said: “More and more shops are offering e-receipts, which can be convenient for shoppers, but our investigation suggests not all shops are aware of the law.

“Retailers must do everything possible to ensure shoppers can have confidence that they won’t be bombarded with unwanted marketing emails and that their personal details are safe.”

The consumer champion launched its investigation after conducting a survey of more than 2,000 people, which found 70% were concerned about how retailers might use their data.

Almost three in five (59%) were concerned that if they received an e-receipt their email address might be shared with third parties, and just over two in five (42%) were concerned e-receipts made it easier for companies to target them with personalised marketing.