Withdrawal Button Obligation 2026: what online shops need to know now

Online shops in the EU must offer a so-called withdrawal button wherever the national transposition is in force – in Germany since 19 June 2026. This obligation affects a large number of traders – regardless of size or shop system. Anyone who fails to act risks an unfair-competition warning letter. In this article we explain everything you need to know.

What is the withdrawal button?

The withdrawal button is a legally mandated function that lets consumers withdraw from contracts concluded online directly via the trader’s website. The legal basis is EU-wide: Directive (EU) 2023/2673, which inserts Article 11a into the Consumer Rights Directive (2011/83/EU). In Germany, this is transposed by the new § 356a BGB.

In concrete terms, it is a two-step process: in the first step the consumer clicks a clearly visible button labelled „Withdraw from contract“ (or an equivalent wording). In the second step they fill in a short form and confirm the withdrawal with a further click on „Confirm withdrawal“.

Important: the entire process must work without a login or registration. Consumers must not be forced to create a customer account in order to exercise their right of withdrawal.

When does the obligation apply?

The application date was 19 June 2026. Directive (EU) 2023/2673 gave member states until 19 December 2025 to transpose it and requires them to apply the new rules from 19 June 2026. Where the national transposition is in force, shops selling to consumers must provide the withdrawal button.

Germany has already transposed the directive with the new § 356a BGB, in force since 19 June 2026 without a transition period. Other member states are following at different speeds – Austria, for example, since 1 October 2026, while Spain has not yet transposed the directive. We recommend implementing the integration promptly.

Who is affected?

The obligation affects every B2C online shop that concludes contracts with consumers where a right of withdrawal exists. This includes:

• All shop systems: WooCommerce, Shopify, Shopware, Magento, JTL, Gambio, Wix, Jimdo and custom-built solutions
• All sectors: fashion, electronics, furniture, food, digital products – provided a right of withdrawal exists
• All company types: from sole traders to corporate groups
• Marketplaces: also sellers on Amazon, eBay and similar platforms when they run their own shops

What happens in the event of a breach?

A missing or faulty withdrawal button has practical consequences. First, the fine question: a fine is provided for – Art. 246e § 1 Abs. 2 Nr. 14a EGBGB names the missing withdrawal function expressly, with up to €50,000, more for high-turnover businesses (Art. 246e § 2 Abs. 2 and 3 EGBGB). It can only be imposed by the Federal Office of Justice, however (Art. 246e § 2 Abs. 6 EGBGB), and only within a coordinated European enforcement action under Art. 21 of Regulation (EU) 2017/2394 (Art. 246e § 2 Abs. 5 EGBGB). For an individual shop that is rarely the main risk. What matters in practice:

• Unfair-competition warning letters from competitors or competition associations – in the cases documented so far under § 356a BGB around €417 per case; a competitor’s lawyer can charge more
• Extended withdrawal period: if you do not inform consumers about the existence and placement of the withdrawal function, the withdrawal period does not start to run and expires only 12 months and 14 days after the regular start of the period – for goods, from receipt of the goods (§ 356 Abs. 2 to 4 BGB together with Art. 246a § 1 Abs. 2 S. 1 Nr. 1 EGBGB)
• Loss of trust: customers who cannot easily exercise their right of withdrawal lose confidence in your shop

What must the withdrawal button look like?

The law sets clear requirements for the design of the two-step withdrawal process:

Step 1: The button

• Label: „Withdraw from contract“ or an equivalent, unambiguous wording
• The button must be prominently placed and easy to find – the navigation or footer is a common place for it
• It must be available throughout the entire withdrawal period (at least 14 days from receipt of the goods)
• No login or registration required

Step 2: The form

• Confirmation button: „Confirm withdrawal“
• Mandatory details (§ 356a(2) BGB): name, details identifying the contract (e.g. order number or a description of the order) and the email address or other electronic means for the acknowledgement of receipt
• Optional field: free text
• Acknowledgement of receipt must be sent without undue delay by email

Which data may be requested?

When designing the withdrawal form, you must observe the principle of data minimisation (GDPR). The following data may or must be requested:

• Mandatory: the consumer’s name, details identifying the contract (an order or contract number is just one way to provide them) and the email address or other electronic means for the acknowledgement of receipt
• Optional: free text for additional information about the withdrawal
• Prohibited: reasons for the withdrawal must not be requested as a mandatory field

Checklist: 10 points for implementation

Use this checklist to verify whether your shop is ready:

• Button labelled „Withdraw from contract“ (or equivalent) is present
• Button prominently placed and easy to find (navigation or footer)
• No login or registration required for the withdrawal
• Two-step process: first the button, then the confirmation form
• Form contains the mandatory details: name, contract, email for the acknowledgement
• Confirmation button: „Confirm withdrawal“
• Automatic acknowledgement of receipt by email is set up
• Withdrawal button available throughout the entire withdrawal period
• GDPR-compliant: no unnecessary data requested
• Tested on all devices (desktop, tablet, smartphone)

Conclusion

The withdrawal-button obligation applies in Germany since 19 June 2026: B2C online shops within its scope must offer a two-step withdrawal process. The requirements are clearly defined.

With WiderrufButton you can set up the withdrawal button in just a few minutes – for any shop system, GDPR-compliant and with the statutory wording kept up to date.