What happens if your store does not have the EU withdrawal button yet

Since June 2026 every online store selling to EU consumers must give them a two-step electronic withdrawal function, and most stores still do not have one. The uncomfortable part is not the fine. It is that in the prevailing legal reading, the 14-day cooling-off clock does not start until the button exists, which means orders you shipped in June can still be cancelled next spring. This is a risk assessment: what is actually exposed, how likely each consequence is, and what the patchy national transposition does and does not protect you from.

In this article:

• The 12-month cancellation window that opens when the button is missing
• Five risks ranked, up to €2 million or 4% of annual turnover
• Why Belgium's and Ireland's late transposition protects you less than it looks

Why this matters now

Directive (EU) 2023/2673 inserted a new Article 11a into the Consumer Rights Directive 2011/83. Member States were required to transpose it by 19 December 2025, and the obligations apply from 19 June 2026. The policy principle is one sentence: withdrawing from a contract must not be harder than concluding it.

Three features make this bigger than a UI task.

There is no size threshold. The requirement applies regardless of turnover or headcount, with no exemption for small businesses.

Non-EU sellers are fully in scope. Any business directing commercial activities at EU consumers needs a compliant function, which may mean an EU-specific interface on a global platform. UK, US, Canadian and Australian brands are not outside this.

Transposition landed unevenly. Germany implemented it as § 356a BGB, published in the Federal Law Gazette on 5 February 2026. France and Italy completed transposition. Belgium had not transposed at all as of late June, and Ireland's transposition was also outstanding. That gap is where most of the false comfort is coming from.

The risks, ranked by what they actually cost

1. The withdrawal window stops closing. Highest commercial impact, high likelihood.

This is the one that matters. Multiple firms take the same position: if the button is absent or does not meet the technical requirements, the 14-day period does not begin to run, extending the right to cancel for up to twelve months. The reasoning runs through Article 10 CRD, which already extends the withdrawal period by up to 12 months where the required withdrawal information is not properly given, as applied through national transpositions.

Practically: a non-compliant seller can face cancellations on purchases made months earlier, on goods long since worn, on stock long since written off, at a point where the customer has no obligation to have kept anything in resaleable condition beyond ordinary handling. One analysis calls the extended period the single most damaging commercial consequence of non-compliance, and that is the right assessment.

Worth being precise about the uncertainty: this is the prevailing practitioner reading rather than settled case law. Whether a missing button is legally equivalent to missing withdrawal information will eventually be decided by a court. Planning as if it is correct costs you a development sprint. Planning as if it is wrong costs you a year of open cancellation rights.

2. Withdrawals count whether or not you process them. High impact, high likelihood.

If you do not provide a compliant function, a consumer's withdrawal may still be valid even if you never process it. The customer who declared withdrawal by email, chat or a form you ignored has exercised a statutory right. Your position that they did not follow your returns procedure is not a defence, because your procedure was not lawful.

This is also where the dispute risk sits: "I withdrew in time, you never confirmed" is unanswerable without a timestamped acknowledgement.

3. Regulatory enforcement and fines. Moderate likelihood, wide range of impact.

National consumer authorities can order you to cease the practice and impose administrative fines. Under the enforcement regime strengthened by the Omnibus Directive 2019/2161, penalties can reach up to €2 million or 4% of annual turnover depending on the member state, with the 4% figure attaching to widespread cross-border infringements. Realistically, a first finding against a mid-sized brand is far more likely to produce an order to fix it than a headline fine. But the ceiling exists and it scales with turnover, not with the size of the mistake.

4. Competitor and consumer-association actions. Market dependent, fast moving.

In Germany this is the practical enforcement channel rather than the regulator. Warnings and injunctions from competitors, consumer associations or enforcement bodies are one of the three stacked risks identified for non-compliant traders. If you sell into DE, assume a missing or badly worded button gets noticed by someone with a commercial interest in noticing.

5. Getting the button wrong, which is not much better than not having it.

The technical requirements are specific and the failure modes are predictable.

• Two steps, not one. An initial step declaring the intention to withdraw, then a separate confirmation step.
• An automatic acknowledgement on a durable medium, typically email, including the date and time of submission.
• Wording that signals a statutory right, not a service request. Labels such as "check" or "review" carry notable compliance risk because they suggest an exploratory step. The safe formulation is "withdraw from contract" or an equally unambiguous statement.
• Prominent and permanently available throughout the withdrawal period, not buried in the terms or reachable only after login.
• Multilingual, per market, which is one of the three most commonly underestimated elements alongside the two-step flow and the tamper-proof timestamp.

The transposition question, answered properly

The tempting read is: our biggest market is Belgium, Belgium has not transposed, therefore nothing applies to us. That read is wrong in three ways.

Directives do not bind private parties directly, but that protection is narrower than it sounds. A consumer in a non-transposed state generally cannot sue you on the directive itself. However, national courts and regulators are obliged to interpret existing consumer protection legislation in line with the directive's principles, and existing law already contains a great deal of material about obstructing consumer rights.

Transposition is arriving, and your June orders will still be inside a 12-month window when it does. A late transposition does not retroactively cure a missing function for contracts still within an unexpired withdrawal period.

You are almost certainly selling into transposed states too. If any meaningful share of your EU revenue comes from Germany, France or Italy, the exposure is live now, regardless of what Belgium has done. Since most online activity is borderless, the advice from Belgian counsel is not to wait for local transposition.

How the process should work

Step 1. Establish which of your products carry the right at all. The requirement covers goods, digital content and services subject to a statutory right of withdrawal, and the existing CRD exceptions still apply: bespoke or personalised goods, sealed goods unsealed for hygiene reasons, perishables and certain time-sensitive services.

Step 2. Place the function where the contract was concluded. Website and app both, prominent, available at all times during the withdrawal period, not gated behind a login the customer no longer remembers.

Step 3. Build the two-step flow. Declaration, then confirmation. Capture name and order identification at the confirmation step so the withdrawal is attributable.

Step 4. Send the acknowledgement automatically, on a durable medium, with a timestamp. This is your evidence, and the only thing that resolves a date dispute in your favour.

Step 5. Separate withdrawal from returns in the interface. A withdrawal is a legal right governed by EU law. A return is a commercial process governed by your policy. Consumers must be able to tell the two apart, which means your generous 60-day policy cannot be presented in a way that obscures the statutory 14-day route, and your statutory route cannot be dressed up as a customer service ticket.

Step 6. Route the confirmed withdrawal straight into the physical returns flow. The legal declaration and the parcel movement should be one system. A withdrawal that lands in a legal inbox and a return that lands in logistics is how refund deadlines get missed.

Step 7. Log everything and keep it. Timestamps, acknowledgements, what was declared and when. Maintain compliance logs evidencing timely receipts.

What this looks like inside the business

The order from last summer that comes back next spring. If the extended window applies, your returns forecast, your stock provisioning and your revenue recognition are all built on a 14-day assumption that is not true. That is a finance problem before it is a legal one, and nobody will flag it until the first one arrives.

The withdrawal that was never logged as a withdrawal. It came in as a support email, got handled as a goodwill gesture, and no timestamped acknowledgement exists. Six months later the customer's version of events is the only version on the record.

The button that was built to reduce cancellations. Softened wording, extra steps, a placement that requires three clicks to find. Every one of those choices is legible as a dark pattern, and the directive exists specifically to counteract design strategies that dissuade consumers from exercising rights. A hard-to-find button is worse than none, because it evidences intent.

The cross-border return that now arrives more often, and costs more than it did in June. More completed withdrawals mean more parcels moving. If those parcels cross a border on the way back, each one is a customs event, and the €3 import duty already paid on the outbound leg does not come back on an ordinary change-of-mind return. A longer withdrawal window and a non-refundable duty are a bad combination on the same order.

The market you thought was safe. Belgium and Ireland were behind at the deadline. That is a timing gap, not a permanent exemption, and it does nothing for your German revenue.

What to check before you scale

• Whether a compliant two-step withdrawal function is live on both your website and your app, in every EU market you sell to.
• Whether the label reads as the exercise of a right rather than as a request for help.
• Whether the acknowledgement email fires automatically and carries a date and time.
• Whether it is available in the local language of each market, not just English.
• Whether withdrawal and returns are visibly distinct in the customer's journey.
• Whether you can produce, today, a log of every withdrawal declared in the last 60 days with timestamps.
• Which of your SKUs fall under the CRD exceptions, documented rather than assumed.
• What your returns and stock forecast looks like if the withdrawal window on pre-compliance orders is 12 months and 14 days rather than 14 days.
• Where those returned parcels physically travel, and whether any of them cross a customs border.

How ShopReturns helps

The compliance question ends when the customer confirms the withdrawal. The operational one starts there, and it is the half that costs money. ShopReturns takes the confirmed withdrawal into a domestic return flow: local return addresses in nine European markets, a carrier the customer already uses, no border crossing on the way back and therefore no customs event on the return leg. Parcels are verified in the Wrocław hub within 48 hours with a barcode scan and photo-documented check, which gives you a dated record of what came back and in what condition, then dispositioned in-market. If the withdrawal window on your older orders turns out to be longer than you planned for, the cost of each of those returns is the variable you can still control.

FAQ

Do I need the button if I already have a returns portal? Probably yes. A returns portal is a commercial process. Article 11a requires a function that lets the consumer exercise a statutory right, in two steps, with an automatic timestamped acknowledgement, labelled unambiguously as withdrawal. Most returns portals meet none of those tests as built.

We are a UK company. Does this apply? Yes, if you direct commercial activities at EU consumers. Establishment in the EU is not the trigger.

Our main EU market has not transposed the directive. Are we safe? Not meaningfully. Courts there must still interpret national law consistently with the directive, transposition is coming, and any sales into Germany, France or Italy are exposed now.

What is the realistic worst case? Not the headline fine. It is a population of past orders on which the withdrawal right has not yet expired, cancellable for up to a year, on goods you cannot resell at full value and on which any import duty is already spent.

Does the button apply to every product we sell? No. The existing CRD exceptions survive, including bespoke and personalised goods, sealed goods unsealed for hygiene reasons and perishables. Map your catalogue rather than assuming either extreme.

Not sure what your current setup is costing you?

Send us your numbers and we'll run them against the new regime: where the duty hits twice, what return freight costs against the goods you recover, and how much is avoidable.