Three risks that stack, not alternate
From 19 June 2026, the electronic withdrawal button becomes mandatory under Article 11a of the EU Consumer Rights Directive (as amended by Directive 2023/2673) for every online shop that concludes B2C distance contracts with EU consumers. Missing the deadline, installing a button with the wrong label, or failing to implement the required two-step flow exposes shop operators to three risks simultaneously — and these risks do not cancel each other out. They accumulate.
This is not scaremongering. These are the legal consequences the EU legislator explicitly built into the Directive and Member State transpositions to enforce compliance. This article walks through the three layers and identifies which one carries the heaviest commercial weight.
Risk 1: Warnings from competitors and associations
A missing or non-compliant withdrawal button is a breach of a consumer-protection market-conduct rule. Such breaches can be pursued through:
- Competitors selling similar products who face economic disadvantage from the non-compliant shop.
- Trade associations and industry self-regulators (in Germany: Zentrale gegen unlauteren Wettbewerb, IDO; in France: DGCCRF; similar bodies exist in every Member State).
- Qualified consumer-protection bodies — consumer associations with standing to file injunctive claims, empowered under Directive (EU) 2020/1828 on representative actions.
A typical warning letter ("Abmahnung" in Germany, "mise en demeure" in France, "lettera di diffida" in Italy) contains three elements: a demand for a cease-and-desist undertaking, reimbursement of the opposing party's legal costs, and a short deadline for compliance. Cost consequences vary by jurisdiction — in Germany, warning letter fees alone typically range from 250 EUR to several thousand EUR, plus your own legal costs and potential court fees for subsequent breaches.
Particularly unpleasant: once a cease-and-desist undertaking is signed, every further breach triggers a contractual penalty. An accidental regression — for example a theme update that inadvertently removes the button — can cost thousands of euros without any new warning procedure being required.
Experience with the similar "cancellation button" obligation (§ 312k BGB, in force since 2022 in Germany) shows that warnings typically start arriving within weeks of the rule entering into force and disproportionately target shops that stand out in simple Google spot checks.
Risk 2: Administrative fines from authorities
Non-compliance with Article 11a is an administrative offence under the Omnibus Directive's enforcement regime (Directive 2019/2161), which strengthened the CRD's penalty framework across all Member States. Two fine brackets apply:
- Up to 50,000 EUR (or national equivalent) for individual breaches.
- Up to 4 % of EU-wide annual turnover for widespread infringements with an EU dimension, pursued under coordinated enforcement via the Consumer Protection Cooperation (CPC) Regulation.
The 4 % ceiling is no coincidence — it mirrors the GDPR's penalty structure and is designed to produce the same deterrent effect. For a company with 10 million EUR annual turnover, that is up to 400,000 EUR. For a 100-million-EUR shop, up to 4 million EUR.
Beyond state-imposed fines, expect reports from competitors who are annoyed but prefer not to take the legal initiative themselves. Tips received by authorities are taken seriously and can trigger investigations, particularly for an EU-wide compliance topic where multiple national authorities are likely to coordinate.
For small and mid-sized shops, the 50,000 EUR risk dominates in practice. For larger merchants, the 4 % variant becomes realistic as soon as several Member States audit in coordination — likely for a harmonised issue like the withdrawal button.
Risk 3: Extended withdrawal period — up to 12 months and 14 days
The commercially heaviest risk is also the most underestimated: under Article 10 of the Consumer Rights Directive (transposed nationally), the withdrawal period does not begin to run as long as the consumer has not been properly informed about the right of withdrawal.
From 19 June 2026, proper information includes a reference to the electronic withdrawal function and its location on the site. If the reference is missing — or if the button the reference points to does not exist — the information is defective. The consequence: the withdrawal period is no longer 14 days but up to 12 months and 14 days (varies slightly by Member State transposition, but this is the common pattern).
This extension is not theoretical. It kicks in automatically, regardless of whether anyone files a warning or whether authorities open an investigation. A single customer can rely on it to withdraw from a contract concluded a full year earlier — with all downstream consequences: reversal of performance, return of goods, refund of the purchase price, often also shipping cost reimbursement.
A back-of-envelope calculation: a shop with 200 orders per month processes 2,400 transactions per year. If even 1 % of customers invoke the extended period — 24 cases per year — at an average order value of 80 EUR, additional reversals quickly exceed 1,900 EUR in direct costs plus processing time. In practice, shops selling higher-value goods (electronics, furniture, jewellery) are hit far harder because both order values and withdrawal rates tend to be higher there.
The situation becomes particularly uncomfortable if consumer associations publicly flag non-compliant shops as "risk merchants" and actively inform consumers about the extended period. What looked like a theoretical 1 % risk can rapidly become a double-digit percentage.
How the risks stack
The three risks are not alternatives — they are cumulative. A shop without a compliant withdrawal button can simultaneously:
- receive a warning letter from a competitor (cost: ~1,000–3,000 EUR in most jurisdictions),
- receive an administrative fine from the national enforcement authority (50,000 EUR realistic),
- receive withdrawals from customers over a 12-month window long past the normal 14-day period (cost: open-ended, depending on shop volume).
The most expensive combination is a warning letter with a cease-and-desist undertaking, followed by a theme update that accidentally removes the button again: contractual penalty kicks in, and in parallel the 12-month extended window keeps running for the interim period.
Concrete steps before 19 June 2026
Compliance can be reduced to four work items:
- Install a technically compliant withdrawal button — two-step flow, correct labelling ("Withdraw from contract here" / "Confirm withdrawal"), continuous availability, placement in the footer or on a clearly linked subpage. Details: see EU Withdrawal Button 2026: Requirements, Scope, Implementation.
- Automate the acknowledgement email with timestamp — no manual processing, no delay. The acknowledgement must confirm only receipt, not the substantive validity of the withdrawal.
- Update the withdrawal policy — add a reference to the electronic withdrawal function and its location on the site. Legally vetted template wording is typically supplied by specialised legal-tech providers or e-commerce lawyers in your jurisdiction.
- Update the privacy policy — describe processing of data submitted through the withdrawal form (purpose, legal basis under Art. 6(1)(c) GDPR, retention period).
Steps 1 and 2 are the technical piece. With a specialised app like Revoq, they are completed in minutes and cover all Article 11a requirements — including the two-step flow and the traceable timestamp in the acknowledgement email.
Steps 3 and 4 are the legal piece. They should run in parallel with the technical setup, not after. Shops that realise in June that their legal texts are still unchanged are technically compliant but legally still exposed — and the 12-month risk continues to accumulate.
Note: This article provides an overview of the legal consequences of non-compliance and does not constitute legal advice. For specific matters — for example assessing a warning letter you have already received — consult a lawyer specialising in e-commerce in your jurisdiction.
Bottom line
The withdrawal button is not optional. The three risks — warnings, fines, and extended withdrawal period — apply automatically and in parallel. The commercially heaviest risk is the 12-month extension, because it kicks in independently of any warning or investigation and runs silently alongside every single order. The good news: technical implementation itself is a manageable effort for any common shop system. Shops that have not started yet — just weeks before the deadline — still have time. Not much, but enough.