What is the EU withdrawal button?
The EU withdrawal button is an electronic function that online shops must provide so consumers can withdraw from a distance contract without friction. Legally, it is called an electronic withdrawal function; in practice, retailers and developers refer to it as the "withdrawal button". It follows the same logic as other EU consumer-law buttons: a clearly labelled, prominently placed, always-available element that makes a consumer right as easy to exercise as the action it reverses.
The principle is simple: withdrawing from an online contract should be no harder than concluding one. A clear button, a two-step process, an automatic acknowledgement email — nothing more.
The legal basis is EU Directive 2023/2673 of 22 November 2023, which amends the Consumer Rights Directive 2011/83/EU by inserting a new Article 11a. Member States had to transpose the Directive into national law by 19 December 2025; the new rules apply from 19 June 2026. In Germany, the implementation is called § 356a BGB (published in the Federal Law Gazette on 5 February 2026). Other Member States have followed with similar national transpositions.
Who has to comply?
The obligation applies to any trader that concludes distance contracts with consumers via an online interface. "Online interface" explicitly includes websites, web shops, customer portals, and mobile applications.
Three conditions must be met cumulatively:
- The contract is concluded through an online interface.
- The customer is a consumer (B2C).
- At least one product or service in the catalogue is subject to a right of withdrawal.
Not in scope: pure B2B operations, shops selling only goods or services excluded from the right of withdrawal (custom-made items, perishables, sealed hygiene products after opening — see Article 16 CRD), and contracts concluded via phone, fax, or order card.
Crucially, the obligation is not limited to EU-established traders. Any non-EU business that directs commercial activity at EU consumers must comply. A US or UK shop shipping to Germany, offering EUR pricing, German-language content, or a .de domain falls under the rule. This has significant implications for international Shopify merchants.
What Article 11a CRD actually requires
The Directive — and its national implementations — define five core requirements:
Button label
The withdrawal function must be labelled "Withdraw from contract here" or an equivalent unambiguous wording. National implementations use direct translations: "Vertrag widerrufen" in German, "Résilier le contrat" in French, "Recedere dal contratto" in Italian. Ambiguous labels such as "Cancel", "Contact", or "Service request" are not acceptable — they obscure the function and are legally non-compliant.
Placement and availability
The button must be continuously available, prominently placed, and easily accessible throughout the entire withdrawal period (typically 14 days per contract). The law does not prescribe an exact location, but the legislative reasoning makes clear it should be reachable from every subpage. In practice, this means placement in the footer, main navigation, or on a dedicated withdrawal page linked from a prominent position.
The mandatory two-step flow
Article 11a paragraphs 2 and 3 require two distinct steps:
Step 1 — input: The consumer enters the data needed to identify the withdrawal. The only fields that may be mandatory are: name, contract identifier (e.g. order number), and a means of electronic communication for the acknowledgement (typically email). Any further mandatory field — especially a withdrawal reason — is explicitly prohibited. Requiring a reason would hinder the withdrawal and is non-compliant.
Step 2 — confirmation: A second button labelled "Confirm withdrawal" (or an equivalent clear wording) submits the declaration. Only this second click constitutes a legally valid withdrawal.
The separation into two clearly labelled steps is one of the most common failure points in DIY implementations. A standard contact form with a single "Submit" button does not meet the requirement.
Acknowledgement on a durable medium
Once the consumer activates the confirmation function, the trader must immediately send an acknowledgement of receipt on a durable medium — in practice, an email. The acknowledgement must contain:
- the content of the withdrawal declaration (name, order reference, contact email provided),
- the date and time the declaration was received by the trader.
Important: the acknowledgement confirms receipt only, not the substantive validity of the withdrawal. Phrases like "Your withdrawal has been accepted" are legally problematic and should be avoided. The valid phrasing is closer to "We have received your withdrawal declaration on [date, time]".
Deemed timely submission
Article 11a paragraph 5 clarifies: the withdrawal declaration is deemed to have reached the trader within the withdrawal period if the consumer activated the confirmation function before the deadline. This protects consumers against delayed processing and gives traders a clear legal reference point for deadline calculations.
What else must change
The button alone is not sufficient. Two further adjustments are mandatory in most Member States:
Withdrawal policy / withdrawal instructions: The standard consumer information must reference the new online withdrawal function, including its location. Traders who fail to update their policy risk an extended withdrawal period of up to 12 months and 14 days under national transpositions of Article 10 CRD. That extended period is the single most damaging commercial consequence of non-compliance.
Privacy policy: The withdrawal button processes personal data (name, email, order reference). The privacy notice must describe this processing activity — purpose, legal basis (Art. 6(1)(c) GDPR: legal obligation), retention period. A generic reference to "customer data" is not enough.
Specific legal wording for both documents is typically provided by legal-tech services or specialised e-commerce lawyers. For the technical implementation of the button itself, the generic requirements from Article 11a are sufficient.
Risks of non-compliance
Traders that fail to provide a compliant withdrawal button face three stacked risks:
- Warnings and injunctions from competitors, consumer associations, or national enforcement bodies. Costs typically range from several hundred to several thousand euros per case, plus mandatory cease-and-desist undertakings.
- Administrative fines: up to 50,000 EUR for smaller breaches, and under the Omnibus Directive's enforcement regime up to 4 % of annual turnover for widespread infringements with an EU dimension.
- Extended withdrawal period of up to 12 months and 14 days — commercially the most severe risk, as consumers can withdraw from contracts concluded a full year earlier.
More detail on these risks is in the dedicated article Ignoring the withdrawal button: warnings, fines, and 12-month withdrawal rights.
Implementation options
Shop operators have three paths to compliance:
Custom development: Maximum control, but significant engineering effort. The two-step flow, the acknowledgement with a tamper-proof timestamp, and multilingual support are the three areas most commonly underestimated. Realistic only for large shops with in-house development capacity.
DIY via native shop tools: On Shopify, some operators try to assemble a solution using Shopify Forms, Shopify Flow, and Flow Mail. This works technically, but the mandatory two-step flow from Article 11a paragraph 3 cannot be cleanly represented, and Flow Mail does not produce a reliable legal timestamp in the sense of paragraph 4. Viable for very small shops with low withdrawal volume, legally thin.
Specialised app or plugin: Installed in minutes, all compliance requirements covered, maintenance and legal updates handled by the provider. For Shopify merchants, this is the lowest-friction path — see Withdrawal button for Shopify.
Note: This article provides an overview of the legal framework and does not constitute legal advice. For specific questions about your shop configuration, consult an e-commerce lawyer or specialised legal-tech provider.
Bottom line
19 June 2026 is a hard cut-off. Shops without a compliant button and updated legal texts by that date are exposed on three fronts at once. The technical implementation itself is a matter of hours for any common shop system, especially with a specialised solution. The larger effort often lies in updating the withdrawal policy and privacy notice — those should be handled in parallel, not sequentially.
Shopify merchants can implement a compliant withdrawal button with Revoq in minutes — two-step flow, automatic acknowledgement with timestamp, eight languages, free in the Starter plan.