EU consumers have had the right to cancel an online purchase within 14 days, no reason required, since the 2011 Consumer Rights Directive. Most Shopify merchants selling to Europe are at least vaguely aware of this. What many do not realize is that a new directive, EU 2023/2673, changes how customers exercise that right. Starting June 19, 2026, every online store selling to EU consumers must provide a dedicated digital withdrawal function, a "withdrawal button," that lets shoppers cancel a purchase in two clicks from the same interface where they bought it.
The right itself is unchanged. What is changing is the customer experience of using it. A clause buried in the terms and conditions no longer qualifies. Neither does a "contact us to cancel" email address. The directive requires a clearly labeled, easily accessible button that works without requiring the customer to log in, call anyone, or fill out a lengthy form. And the penalties for getting this wrong are not abstract: non-compliant merchants face fines of up to 4% of annual turnover and an automatic extension of the withdrawal period from 14 days to 12 months plus 14 days for every affected order.
For Shopify merchants who sell to European customers, this is not a "maybe later" compliance item. The deadline is June 19, 2026, and consumer protection associations across the EU are expected to monitor the rollout closely using injunctive relief under the Representative Actions Directive.
Here is a summary of the customer experience that is required:
A button or link on your site must clearly link to where the customer can withdraw. This should be unambiguously labelled "Withdraw from contract here" or something very similar. Labels like "Cancel," "Contact," or "Service request" are not acceptable and legally non-compliant
This button or link must be continuously available throughout the entire withdrawal period (14 days from delivery). Practically speaking, placing this link in your site footer is generally deemed an accaptable way to fulfill this requirement.
The withdrawal must be a two-step process: one step to input information to identify the withdrawal (which can be interpreted as an order lookup, as long as that lookup is simple and only requests the minimum information needed), and a second step to confirm the withdrawal. The withdrawal process is only complete once that second step is complete.
An acknowledgement must be sent on a "durable medium", which can be interpreted to mean an email. The acknowledgement must contain the content of the withdrawal (such as an order number), and the date.
Merchants must also ensure that their consumer information such as terms and conditions, privacy policy, etc. consider these requirements.
The right of withdrawal is not new, but the rules just changed
The EU right of withdrawal has existed since 2011 under the Consumer Rights Directive (2011/83/EU). Any consumer who buys something online from an EU-based seller, or from a seller outside the EU who targets EU consumers, can cancel that purchase within 14 days of receiving the goods. They do not need to give a reason. The seller must issue a refund, including standard delivery costs, within 14 days of receiving the returned goods or proof that the consumer shipped them back.
This right has always been broader than most commercial return policies. It is a statutory consumer protection, not a business policy. The merchant cannot waive it, restrict it with conditions beyond what the directive allows, or charge a restocking fee. The consumer pays for return shipping only if the merchant informed them of that cost before the purchase.
What has changed is Directive (EU) 2023/2673, adopted in November 2023, which amends the original Consumer Rights Directive by adding a new Article 11a. That article introduces the mandatory withdrawal function. EU Member States were required to transpose the directive into national law by December 19, 2025. Most did not. In January 2026, the European Commission opened infringement procedures against 21 Member States for failing to communicate complete transposition measures. Only France, Denmark, and Lithuania had transposed on time. Germany published its implementing legislation on February 5, 2026, creating new Section 356a of the German Civil Code (BGB), with the enforcement date set to June 19, 2026 across all EU member states regardless of transposition status.
The short version: the 14-day right has not changed. What changed is that you now need a button for it. And most of Europe is scrambling to get the rules in place.
What the withdrawal button actually requires
The directive specifies four things the withdrawal function must do, and it specifies them with enough precision that many common patterns no longer qualify.
First, the button must be clearly visible and easily accessible within the online interface where the contract was made. It must remain accessible throughout the 14-day withdrawal window. A link buried in your footer that says "Terms and Conditions" with a withdrawal clause on page three does not count.
Second, the button must be clearly and unambiguously labeled. The directive is specific here: labels like "Return" or "Get a refund" are not sufficient on their own. The wording must reference "withdrawal" in a way that distinguishes it from a commercial return. The Hogan Lovells analysis of the directive notes that the first step should say "withdraw from contract here" and the confirmation step should say "confirm withdrawal."
Third, the function must use a two-step mechanism. The first click takes the consumer to a page that identifies the order and captures an explicit withdrawal statement. The second click confirms the withdrawal. This two-step design prevents accidental cancellations while keeping the process simple enough that it does not create friction.
Fourth, the merchant must send a timestamped acknowledgment of receipt on a durable medium, which in practice means a personally addressed email, without undue delay. The directive wants a documented record that the withdrawal was received, not just an on-screen confirmation that disappears when the browser tab closes.
There is also a pre-purchase requirement. Merchants must inform consumers about the existence and location of the withdrawal function before the purchase, for example during checkout or in pre-contractual information. And the withdrawal button cannot replace other contact channels. You must continue to offer alternative ways for consumers to exercise their withdrawal right alongside the button.
Who this applies to
The withdrawal button requirement applies to any business selling goods, services, or digital content to consumers in the EU through a distance contract, which covers essentially all ecommerce transactions. It does not matter where the merchant is based. As Bird & Bird puts it in their analysis: "If you are based in Turkey, the UAE, the UK, or the US and you sell to consumers in Germany via your website or app, this applies to your store." Arnold & Porter's advisory specifically addresses US online sellers, confirming the requirement "applies regardless of where the seller is located."
The scale of cross-border exposure is significant. 77% of EU internet users bought goods or services online in 2024, and roughly 27% of EU consumers purchased from a retailer in another EU country. European cross-border ecommerce reached EUR 275.6 billion in 2024, representing 36% of the overall online market. If your Shopify store accepts orders from EU shipping addresses, you are in scope.
The law also makes no distinction based on company size or turnover. There are no exemptions for micro-enterprises or sole proprietorships. A one-person Shopify store that sells a single item to an EU consumer is subject to the same rules as a multinational retailer.
B2B transactions are excluded. The right of withdrawal applies only to contracts between a business and a consumer (B2C). If you sell exclusively to other businesses and can verify that your buyers are acting in a commercial capacity, the withdrawal button requirement does not apply.
Products exempt from the right of withdrawal
Not every product sold online is covered. The Consumer Rights Directive lists specific exemptions from the right of withdrawal.
- Sealed goods that were unsealed after delivery and are not suitable for return due to health protection or hygiene reasons are exempt. This covers products like cosmetics, skincare, supplements, and underwear where the seal has been broken.
- Perishable goods or goods that expire rapidly are exempt. Fresh food, flowers, and similar products do not carry a 14-day withdrawal right.
- Custom or personalized products are exempt. An item made to the consumer's specifications or clearly personalized for them cannot be withdrawn.
- Digital content is exempt once download or streaming has begun, but only if the consumer gave prior express consent and acknowledged that they would lose their right of withdrawal by starting the download.
- Sealed audio, video, or computer software that has been unsealed after delivery is exempt.
Several other narrow categories are also excluded: newspapers and periodicals (except subscriptions), goods purchased at public auctions, urgent repairs or maintenance, and accommodation, transport, catering, or leisure services provided on a specific date.
For most Shopify merchants selling physical goods, the exemptions will not apply to the majority of their catalog. Standard apparel, electronics, homeware, toys, sporting goods, and similar products all carry the full 14-day right of withdrawal when sold to EU consumers.
How a withdrawal differs from a return
This distinction matters more than most merchants initially think. Your return policy is a commercial decision you make. The right of withdrawal is a legal obligation set by EU law. The two overlap in practice, but they are not the same thing, and the directive requires that consumers be able to tell them apart.
A return is governed by your store's policy. You decide the window (30 days, 60 days, 90 days), the conditions (unworn, tags attached, original packaging), and the resolution (refund, exchange, store credit). You can require a reason. You can charge restocking fees. You can exclude sale items.
A withdrawal under EU law has none of those restrictions. The window is 14 days from delivery, set by statute. The consumer does not need to give a reason. The merchant cannot charge a restocking fee. The refund must include standard delivery costs. The consumer pays return shipping only if the merchant disclosed that cost before purchase.
In operational terms, many merchants will process withdrawals through the same infrastructure they use for commercial returns. That is fine. But the withdrawal step must be clearly labeled and clearly separate from any commercial return flow. Retention offers and friction cannot be placed in the withdrawal path. Retention offers are permitted only after the withdrawal is completed and confirmed.
If you run your returns through Corso's Returns & Exchanges platform, the withdrawal pathway needs to exist alongside that flow, clearly marked. A customer exercising their legal right of withdrawal should not see upsell attempts, "are you sure?" prompts, or exchange-first screens that delay or obscure the refund path. Those features are appropriate for commercial returns. They are not appropriate for a statutory withdrawal.
When the 14-day clock starts
For physical goods, the 14-day withdrawal period begins the day after the consumer takes physical possession of the goods. That means the day after delivery, not the day of purchase.
If multiple items in a single order are delivered separately, the 14-day clock starts the day after delivery of the last item. If goods are delivered in regular batches over an agreed period (a subscription), the clock starts the day after the first delivery.
The consumer can also exercise the right of withdrawal before delivery. The withdrawal period is anchored to physical possession, but the right itself exists from the moment the contract is concluded. If a consumer clicks "withdraw from contract" while the package is still in transit, the merchant must process the withdrawal. The consumer's obligation is to return the goods within 14 days of submitting the withdrawal statement, which in practice means they either refuse delivery or send the items back once they arrive.
Merchants are not legally obliged to intercept or recall a shipment that is already with the carrier. You may choose to do so to avoid unnecessary delivery and return shipping costs, but the directive does not require it.
The refund timeline is also fixed. Once the consumer withdraws, the merchant must refund all payments, including the cost of standard delivery, within 14 days. For goods, the merchant may withhold the refund until the goods are received back or the consumer provides proof of return shipment, whichever comes first. If the consumer chose a delivery method more expensive than the cheapest standard option, the merchant only needs to refund the cost of the cheapest option.
Penalties for non-compliance
The penalties have two parts, and the first one is automatic.
If a merchant fails to provide a compliant withdrawal function, or if the function is not easily accessible, the consumer's right of withdrawal extends from 14 days to 12 months plus 14 days from the day after delivery. This extension applies per order, to each affected consumer individually. The 14-day clock does not start until the merchant provides the compliant function. If the merchant never provides it, the extension is capped at 12 months after the original delivery date, plus the standard 14 days.
The financial exposure is real. Imagine a merchant who ships 1,000 orders per month to EU consumers and does not implement a withdrawal button. Every one of those orders carries a 12-month-plus-14-day withdrawal window instead of a 14-day one. A customer who bought a winter coat in November could withdraw the following October, 11 months later, and the merchant would have no legal basis to refuse the refund.
On top of the extended window, member states can impose fines. Greenberg Traurig's analysis puts the ceiling at fines of up to two million euros or 4% of annual turnover. In Germany specifically, Freshfields notes that fines can reach EUR 50,000 for companies under EUR 1.25 million in turnover, and up to 4% of turnover for larger companies. BCLP points out that "a multinational retailer faces the prospect of divergent rules as well as cumulative fines for non-compliance across the EU countries in which it operates", meaning penalties can stack across multiple member states.
Non-compliance also creates exposure to competitor enforcement. Bird & Bird notes that in Germany, failure to provide a compliant withdrawal button may constitute a competition law violation under the UWG, exposing businesses to cease-and-desist claims from competitors, not just consumer groups.
Consumer protection associations across the EU are also expected to pursue enforcement through warning letters, cease-and-desist claims, and injunctive relief under the Representative Actions Directive (EU) 2020/1828. Taylor Wessing warns that "experience with the German 2-click-cancellation law shows that formal implementation errors are most likely to be identified and pursued shortly after 19 June 2026". Enforcement will not rely solely on individual consumer complaints. Organized consumer groups, competitor companies, and national regulatory bodies can all take action against non-compliant merchants.
What a compliant withdrawal flow looks like
Strip the requirements down to their essentials and a compliant flow needs four parts).
A clear entry point. A button or link labeled with withdrawal-specific language (such as "Withdraw from contract"), accessible from the online interface where the purchase was made, and visible throughout the 14-day window. The button does not need to require a login. It should be available to any visitor.
A withdrawal statement step. After clicking, the consumer reaches a page that identifies the order being withdrawn (typically by order number, name, and email) and captures an explicit statement of withdrawal. The consumer must actively confirm that they are withdrawing from the contract. This is the "confirm withdrawal" step.
A confirmation step. This captures the channel on which the consumer wants to receive the acknowledgment of receipt, typically their email address.
An acknowledgment of receipt. An automatic, timestamped email sent to the consumer confirming that the withdrawal was received. This must be a durable medium, meaning a personally addressed communication the consumer can store and reproduce, not just a transient on-screen message.
One important legal detail: William Fry confirms that "a withdrawal submitted through this process within the statutory period is legally valid, even if the trader fails to process it". Once the consumer clicks "confirm withdrawal," the clock starts on the merchant's refund obligation regardless of what happens on the back end.
Several common patterns no longer qualify. Email-only or phone-only cancellation is not sufficient; the function must be digital and accessible from the same interface. Retention pop-ups and "are you sure?" prompts cannot appear in the withdrawal path. Friction loops that require multiple unrelated steps, account creation, or login do not meet the standard. And any interface that uses visual hierarchy or misleading design to steer shoppers away from exercising the right is considered a "manipulative interface" under the directive and is explicitly non-compliant. As Quastels summarizes: "The underlying principle is that consumers must be able to withdraw from a contract as easily as they were able to enter into it."
Implementation options for Shopify merchants
Shopify merchants have several ways to implement a compliant withdrawal button.
Noerr's analysis of the German implementation notes one nuance worth knowing: "the legislative materials for section 356a of the German Civil Code permit a log-in-only solution for the withdrawal button at least where the underlying contract itself requires the establishment of a customer account". In other words, if your store requires an account to purchase, you can put the withdrawal button behind that same login. But if you allow guest checkout, the withdrawal function must be accessible without logging in.
Build it yourself. The requirements are specific but not technically complex. You need a page or modal with the withdrawal entry point, a form that captures the order details and explicit confirmation, a confirmation step that records the consumer's preferred acknowledgment channel, and an automated email with a timestamp. If your team has development resources, this is straightforward to build. The harder part is maintaining documentation, keeping an audit trail, and making sure the flow stays accessible across site updates and redesigns.
Use a dedicated compliance tool. Products like Regrettable.eu offer drop-in withdrawal buttons that handle the two-step flow, the confirmation email, email delivery tracking, and a 10-year audit archive. These tools work across platforms including Shopify and can be installed in minutes. The tradeoff is a monthly subscription cost (starting around 9 EUR per month) against other costs you might or might not incur with other solutions.
Integrate with your existing post-purchase platform. Some delivery and returns platforms have added withdrawal support, including Corso. If you already use a returns management platform, check whether they are adding withdrawal compliance features ahead of the deadline. If they aren't compliant, consider Corso as an option. Details for Corso merchants on how to implement this for your EU customers can be found at our related help page.
Use Shopify's own guidance. Shopify has published compliance documentation covering the withdrawal button requirement, including what the button should look like, where it should appear, and how to handle the confirmation process. If you run a Shopify store and are unsure where to start, that documentation is a practical first step.
Regardless of the implementation path, there are a few non-negotiable elements. The withdrawal function must remain accessible for the full 14-day window after delivery. It must be clearly labeled with withdrawal-specific language. It must not require a login. It must produce a timestamped confirmation on a durable medium. And it must not include any friction that could be interpreted as discouraging the consumer from exercising the right.
What this means for your post-purchase operations
The withdrawal button is a compliance requirement, but it also changes how post-purchase operations work for merchants selling to the EU.
You need to separate withdrawal processing from return processing in your operations. A withdrawal is a legal obligation with a fixed 14-day refund timeline and no restocking fees. A commercial return is governed by your policy. If you process both through the same queue without distinguishing them, you risk applying return policy restrictions (restocking fees, condition requirements, exchange-first routing) to withdrawals, which would put you out of compliance.
You need an audit trail. The directive expects timestamped documentation of every withdrawal request and acknowledgment. If a consumer files a complaint or a consumer protection association investigates, you need to produce records showing that the withdrawal was received and acknowledged on specific dates and times. Ad hoc email handling does not produce this kind of documentation.
You need to inform consumers about the withdrawal function before purchase. This is a pre-contractual information requirement. Mention the existence of the withdrawal button in your checkout flow, order confirmation, or pre-purchase disclosures. This is not optional under the directive.
You need to keep the withdrawal pathway clean. This is where the tension with commercial return optimization shows up. Many merchants, including those using Corso's Returns & Exchanges platform, have invested in exchange-first flows, retention offers, and friction-reduction features designed to keep revenue in the business. Those features are valuable for commercial returns. But they cannot appear in the withdrawal path. The directive explicitly prohibits manipulative interfaces, and any design pattern that steers a consumer away from exercising their statutory right will be treated as non-compliant.
The practical solution is to maintain two distinct pathways: a withdrawal flow for the statutory right, with no friction, no retention, and no exchange prompts, and your regular return flow for everything else. The withdrawal flow should be clearly labeled and easy to find. Your return flow, with its exchange-first features and Corso integration, handles everything outside the 14-day statutory window and everything that falls under your commercial policy rather than EU law.
For Shopify merchants who already have a strong post-purchase operation, adding a compliant withdrawal button is not a major overhaul. It is a specific, well-defined addition to your existing infrastructure. But it does need to happen before June 19, 2026, and the cost of missing the deadline is months of extended withdrawal exposure on every EU order you ship.
