EU withdrawal button: “withdraw from contract here”

The rule

Since 19 June 2026, EU consumer law has asked online shops for one more way out of a purchase: a function on the site itself. Article 11a of the Consumer Rights Directive sets it out. Directive (EU) 2023/2673 inserted the article, and it sits beside the paper-style model form, which stays.

The word “also” in the first sentence matters. Article 11(1), which the 2023 Directive left alone, still lets a consumer withdraw with the model form in Annex I(B) or “any other unequivocal statement”. The function is one more channel. Email, letters and the model form keep working.

The recital doesn’t say the function may sit behind a login. It says a signed-in customer shouldn’t have to identify themselves twice. National guidance has read it strictly, as How to fix it shows.

The duty reaches every online sale that carries a right of withdrawal. Recital 37 says it applies “not only to distance contracts for financial services, but to all distance contracts that are subject to the right of withdrawal under Directive 2011/83/EU”. That takes in goods, services, digital content and subscriptions bought through a website or an app, and Article 3(1b) adds Article 11a to the few rules that apply to financial services sold at a distance. The Directive doesn’t define “online interface”. The Digital Services Act (Art. 3(m)) and the CPC Regulation (Art. 3(15)) both describe it as software, including a website, part of one, or an app.

Some sales are outside it. The Directive protects consumers, so sales to businesses only are not covered, as the Austrian and Frankfurt chambers of commerce point out. The Austrian chamber adds that contracts made only by phone or email are not affected, and the Dutch ACM notes that purchases in a physical shop are outside it. The exceptions to the right of withdrawal in Article 16 are unchanged: where there is no right of withdrawal, there is nothing to withdraw from. German commentators read this narrowly. IT-Recht Kanzlei says the duty lapses only if every offer in the shop falls under an exception, such as made-to-measure goods, perishable food or event tickets for a set date.

The label depends on the language, and national law can change it. Each language version of the Directive has its own words, and several leave out “here” (German, Danish and Croatian among them). Every version allows an unambiguous equivalent.

The idea started smaller. The Commission’s proposal of 11 May 2022 (COM(2022) 204) had a “withdrawal button” only for financial services sold by electronic means, labelled “Withdraw from Contract” and placed on the same interface used to make the contract. The Council’s general approach, agreed on 2 March 2023, moved it into the general part of the Consumer Rights Directive so it would cover every distance contract, with the labels “withdraw from contract here” and “withdraw now”. The European Parliament, with Arba Kokalari as rapporteur, pushed for a technology-neutral “withdrawal function” placed prominently, not tied to one page. The trilogue of 6 June 2023 kept the broad scope, the neutral term and a two-step flow, and the confirm label became “confirm withdrawal”. Parliament adopted the text on 5 October 2023 by 548 votes to 4, with 14 abstentions, and it was signed on 22 November 2023.

Countries had until 19 December 2025 to adopt their laws and had to apply them from 19 June 2026. Many were late. On 29 January 2026 the Commission decided to send letters of formal notice to 21 Member States for not notifying complete transposition. By 14 October 2026, 22 Member States had notified measures; Spain, Poland, Portugal, Luxembourg and Slovenia had notified none.

Germany, France, Italy, Denmark, Sweden and Finland applied the rule from 19 June. The Netherlands followed on 25 June, Belgium from 14 August according to its federal economy ministry, and Austria from 1 October 2026 for contracts made after 30 September. Czechia’s law takes effect on 1 January 2027.

In a country that hasn’t transposed, a directive doesn’t bind traders directly, as the Polish legal news service Prawo.pl notes, so the duty there waits for national law.

Penalties are national. Article 24 of the Directive asks for penalties that are “effective, proportionate and dissuasive”. In a coordinated action by national authorities under Article 21 of the CPC Regulation (EU) 2017/2394, the fines available must reach a maximum of at least 4% of the trader’s annual turnover in the countries concerned, or at least EUR 2 million where turnover figures are missing (Art. 24(3) and (4)). Those are floors for the maximum, not fines anyone has paid. For financial services only Article 24(1) and (6) apply.

National laws add their own routes. Germany’s Art. 246e EGBGB caps the fine at EUR 50,000, or 4% of annual turnover for traders with more than EUR 1.25 million, and allows it only inside such a coordinated action. Ireland makes a contravention an offence. Sweden treats it as unfair marketing under its Marketing Practices Act. And because Directive 2011/83/EU is listed in Annex I of the Representative Actions Directive (EU) 2020/1828, qualified consumer bodies can sue over it.

What PeekWell checks and how

EU-16 asks whether a visitor can find a way to withdraw from an online purchase on the site itself, and what that way looks like. The answer comes from the public pages, not from what the shop software promises.

The check applies when the scan sees that the site makes contracts with consumers online: a cart, a checkout, a booking engine or a subscription sign-up. A site that only shows a catalogue or takes requests for quotes gets Not applicable for EU-16, and so does a site that sells only to businesses.

The scan is automated. It looks across your public pages for a withdrawal link labelled with the statutory words in the site’s language, or a close equivalent, as in the table above. It follows the link as a guest and notes where it lands: a form, a login page, a PDF, an email address, or only the withdrawal instructions. On a form it notes which fields are required, and whether a separate confirm step exists and how it’s labelled. It also reads your terms, any withdrawal or returns page and the checkout’s legal text for the sentence about withdrawing online, with an address that matches the function.

When Peeky can’t find withdrawal instructions, or they don’t say where to withdraw online, the finding says so, and its fix includes the sentence to add in each language.

The scan has limits, and the report says so. When Peeky finds nothing, the finding reads “no withdrawal function found on public pages”, not “missing”, because the function may sit behind a login. Peeky can’t see the acknowledgement email, the item list behind an order lookup, the shop’s app, or what happens after someone submits. It reads wording. Whether an unusual label is “unambiguous” in a given country is a legal question it doesn’t answer. Cancelling a running subscription is a different duty, checked in EU-13. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

Why it matters for a company

So far the action has been in Germany, and it has been private. From August 2026, law firms and a retailers’ association reported the first warning letters over § 356a BGB. The Wettbewerbszentrale wrote to a shop whose only route was an inconspicuous footer link labelled “Widerruf & Rückgabe”, followed by a button and three more questions or steps before the form. It asked for a cease-and-desist declaration backed by a contractual penalty and EUR 417.30 in costs, citing § 356a BGB and § 3a UWG. The Verband Sozialer Wettbewerb wrote to a sweets shop that had no withdrawal function at all, for EUR 416.50 in costs. The Verbraucherzentrale Hessen objected to a footer link “Widerrufsrecht” that only opened the withdrawal instructions, for EUR 365.30. Another reported letter concerned a “Widerruf” button that opened the instructions and let nobody send anything.

All of that comes from reports by IT-Recht Kanzlei and the Händlerbund’s news service, not from the senders. None of the reports names a shop or says whether it signed. No court has ruled on § 356a BGB yet.

Outside Germany there is guidance and an open door for complaints. Konsumentverket asked consumers to report shops where the function is missing or unclear. The Belgian economy ministry says its Economic Inspection may open an investigation after a report, and the Dutch ACM says it can fine. No authority has announced a sweep or a decision, and the CPC network hasn’t run a coordinated action on Article 11a.

The closest court record is the German cancel button. Since July 2022, § 312k BGB has required a two-step online cancel route with similar wording, and German courts have ruled against a login form before the cancel page, a button hidden behind a “more links” control, a confirmation page split into extra steps, and offers placed on the confirmation page. In the Stadtwerke Düsseldorf judgment the court said in so many words that the cancel process has two steps, as the withdrawal process would. Those rulings are listed below as precedents. They are about cancelling, not withdrawing. The Federal Court of Justice hears the login question on 5 November 2026.

The Court of Justice has not had a case on Article 11a. Its older rulings on withdrawal still frame it. In an order-button case it held that only the words on the button count (C-249/21, Fuhrmann-2). In EIS (C-266/19) it held that a trader using the model instructions must give the phone number its website shows for customer contact, so the consumer can withdraw that way.

The cost people quote most is a longer withdrawal period. The ACM warns that retailers who fall short risk the cooling-off period being extended to a year. IHK Frankfurt lists a risk of 12 months and 14 days, and Crowell & Moring writes that the period doesn’t start without the button. Others put the trigger elsewhere: a German lawyer quoted by wortfilter.de ties the extension to withdrawal instructions that leave out the online function, whether or not the button works. No court has decided which reading is right. If an extension does apply, the Court of Justice’s Eisenberger Gerüstbau judgment of 5 March 2026 (C-564/24) lets a trader argue abuse where a late withdrawal doesn’t serve the Directive’s aims and seeks an unfair advantage.

Measurements are thin. A German seller of legal scanning services, rechtsklar24, crawled 934 shops certified by Trusted Shops between 30 July and 23 August 2026. It flagged withdrawal-button problems at 356 of them (38.1%), and 67 had no button although a withdrawal page existed. Its own caveat is that a finding can be a confirmed defect or only a hint.

Smaller companies and larger companies

There is no size threshold. The Directive has no exemption for small traders, and a Belgian law-firm note on the national law says the duty applies whatever the size of the business. One product with a right of withdrawal is enough to bring a shop in, as Thomas Schwenke puts it in his FAQ for German retailers.

In a small company the shop runs on a platform or a plugin, and the gap is usually a setting nobody switched on, or a footer link that says “Returns” and leads to the instructions. The warning letters reported in Germany are about defects of that kind; the reports don’t say how big the shops were. The rechtsklar24 crawl flagged problems more often in its broad sample of shops (40.5%) than among the 65 top-100 retailers it could scan (26.2%).

In a larger company the function has to work everywhere the company sells: each country site, each language, guest checkout as well as accounts, and the app if people buy in it. The labels differ by market. An Irish site needs “cancel contract here”, a Dutch site picks its own words, a German one needs “Vertrag widerrufen” or an equally clear phrase. A company selling subscriptions in Germany also has a cancel button under § 312k BGB, which the Verbraucherzentrale says must be kept apart from the withdrawal function. Customer service needs to know that the acknowledgement confirms receipt and doesn’t rule on whether the withdrawal is valid, a point K&L Gates makes for teams that handle returns.

How to fix it

1. Put a labelled link on every page. Use the statutory words for the site’s language, from the table under The rule, such as “withdraw from contract here” or “Vertrag widerrufen”. Put it in a header or footer element that every page template shares. A clear link is enough; it doesn’t have to look like a button.
2. Set it apart from the legal links. The reasons in the German government’s bill say that a footer placement needs colour, contrast or prominent placement that separates it from the terms and the imprint. A link called “Returns” or “Contact” doesn’t do the job.
3. Make it work without signing in. Guest orders have to be withdrawable too. The Dutch ACM says you may offer a login but may not require an account. The German bill accepts the function inside the customer account only where the contract itself can only be made through an account. A Swedish law firm reads its national rule as allowing a login; the other guidance found so far reads it the other way.
4. Build the two steps. The first page asks for, or fills in, the name, the order or contract, and the email address for the acknowledgement. Add item choice if you let people withdraw from part of an order. A separate button labelled “confirm withdrawal”, or your language’s version, sends it.
5. Ask for nothing else. No required reason, no account, no extra required fields, and no pause offer, exchange offer or survey on the way. The Frankfurt chamber of commerce says no reason may be asked for. In the FitX case the Federal Court of Justice allowed nothing on a cancel confirmation page beyond what the statute lists, and IT-Recht Kanzlei argues the same holds for withdrawal.
6. Send the acknowledgement. Send it without undue delay, by email or another durable medium, with what the consumer submitted and the date and time. Word it as a receipt. The German bill advises against writing that the withdrawal “is hereby confirmed”, because nobody has checked its validity yet.
7. Update the withdrawal instructions. Add the Annex I sentence, “You can also exercise your right of withdrawal online at”, with the real address of the function, and say where the function is in the information given before the order. Keep the model form and the email route as well.
8. Keep it separate from a cancel button. In Germany a subscription site may need a § 312k cancel button too. Two labels, two flows.
9. Check what your platform already does. Shopware added a native function in 6.7.9.0, backported to 6.6. Germanized for WooCommerce has one from version 4.0.0. plentyShop needs LTS 5.0.79, or 2.29.0 for the new shop. Jimdo switched it on in the footer of EU shops. Shopify’s self-serve route runs through customer accounts, and Shopify says using its tools “doesn’t automatically make your store compliant”, so shops with guest checkout often add an app. Test the flow as a guest after every update.
10. Cover the app. If people can buy in your app, the function has to be there too, and the website’s function must not depend on downloading the app.
11. Re-scan. Run a scan again. The finding should clear once the link, the form and the confirm step are reachable on the public pages.

Whether a particular wording counts as unambiguous in a particular country is a question for your legal adviser. Peeky reports what it sees.