The “Withdrawal Button”: A new compliance risk for (non-)EU businesses

The digital transformation of commercial transactions has fundamentally altered the relationship between consumers and businesses. Within the European Union, the next milestone to enhance consumer rights online is fast approaching: the introduction of a mandatory “withdrawal button” for distance contracts. This new requirement is supposed to make it significantly easier for consumers to exercise their statutory right of withdrawal (also known as the 14-days cooling-off period) from online contracts. Although this is an EU-specific requirement, non-EU businesses targeting the EU market are equally subject to its compliance obligations and should therefore undertake timely preparations for its implementation.

This article provides an overview of the new rules, their legal basis, and the resulting compliance obligations, drawing on recent German and EU developments as leading examples.

1. What is the “withdrawal button”?

The withdrawal button is a function mandated for online businesses offering distance contracts (such as purchases of goods, digital content such as movies or MP3, and subscriptions via e-commerce platforms, apps, or web shops). Its express purpose is to enable consumers to withdraw from online contracts with the same level of simplicity as their initial conclusion, i.e., in just a few clicks.

The measure forms part of an EU-wide initiative to eliminate obstacles consumers may face when submitting a withdrawal request, thereby mirroring earlier reforms such as Germany’s widely discussed cancellation button for subscription services.

2. Legal background

The requirement is set out in Directive (EU) 2023/2673, amending the earlier Consumer Rights Directive (CRD - 2011/83/EU) by adding a new Art. 11a. Member States must transpose the new rules into national law by 19 December 2025; the obligations will apply from 19 June 2026.

Key objectives include: 

• Harmonizing and strengthen consumer protection across the EU single market. 
• Ensuring that the withdrawal process is as straightforward as the contract conclusion itself, particularly via digital platforms.
• Counteract so called “dark patterns” which could appear as design strategies intended to obstruct or dissuade consumers from exercising their rights.

3. Scope of application

Because the Directive requires transposition into national law, we use Germany’s advanced draft implementation as a reference model to examine the requirements for EU-wide compliance.

The withdrawal button must be provided for:

• Distance contracts which are concluded via an online user interface (website, mobile site, or app),
• Involving the purchase of goods, services, digital content and services, and financial services where EU law provides a statutory right of withdrawal.

Not covered are:

• Contracts not concluded via a digital interface (e.g., by phone, email, in person).
• Specific exceptions adopted under EU law, such as bespoke or perishable goods, hotel bookings for specific dates, or digital content and digital services where the withdrawal right has been waived by the consumer.

4. Requirements for technical design and presentation

The new rules are prescriptive as to implementation:

• Prominence and accessibility - the withdrawal function must be continuously and easily accessible on the online user interface, not hidden within general terms, lengthy menus, or after login. Clear visual distinction is required (e.g., via contrasting color or design).
• Labeling - the button must state “Withdraw contract” or an equally clear phrase in the respective language. Ambiguous labels (“Cancel” or “Service inquiry”) are likely deemed insufficient.
• Two-stage process - the new rules require a two-stage process for contract withdrawals.

1. Clicking the first button (“Withdraw contract”) leads to a confirmation page or form requesting only the necessary information (such as name, contract ID, preferred communication channel).
2. The consumer submits the withdrawal via a second clearly labeled button (“Confirm withdrawal”).

• No excessive barriers - passwords or logins should not be a prerequisite for withdrawal unless the contract can be concluded exclusively by setting up a customer account. Even in such cases, it is likely that case law would favor minimizing such friction, as demonstrated by comparable judgments in Germany concerning the “2-click” cancellation law.
• Confirmation of receipt - upon submission, businesses must promptly confirm receipt of the withdrawal on a durable medium (typically by email), including a record of the request and its timestamp.

5. Continuous availability 

In addition, the withdrawal button must remain accessible throughout the statutory withdrawal period (usually 14 days from delivery or contract conclusion). While the provision of the button beyond this point could, in theory, be misconstrued as granting a longer withdrawal right, legislative commentary and German legislative practice make clear that providing the function “as standard” cannot be understood as extending the legal right itself. Tailoring the button’s availability to each consumer’s individual withdrawal window is thus not required due to technical complexity. However, maintaining the withdrawal button beyond the statutory withdrawal period would also impose a disproportionate operational burden, as businesses would be required to receive, assess, and formally reject withdrawal requests that are legally unfounded. 

6. Consequences of non-compliance

Non-compliance bears significant risks such as regulatory fines, cease-and-desist claims from consumer protection associations (CPAs) and potentially extended withdrawal periods.

• Regulatory fines - in Germany, fines up to EUR 50,000 (or 4% of annual turnover for larger businesses) are currently envisaged. 
• Cease-and-desist claims - CPAs and competitors can pursue legal action by way of warning letters requesting a cease-and-desist declaration, followed by seeking for injunctive relief or court order.
• Extended withdrawal periods - consumers may be permitted to withdraw at any time until compliant procedures are implemented.

7. What non-EU businesses should prepare for

Any non-EU-based business targeting or serving EU consumers must comply with these requirements. This includes ensuring that all relevant web shops, SaaS platforms, and apps offer a withdrawal button in accordance with EU standards. The rules apply regardless of the business’s country of establishment if EU consumers are addressed.

Conclusion

The EU’s withdrawal button will significantly reshape how withdrawals are handled and introduce a new layer of operational and legal complexity for businesses. While it aims to enhance transparency and consumer control, businesses should not underestimate the practical compliance risks starting with the correct placement or label of the button. Experience with the German 2-click-cancellation law shows that formal implementation errors are most likely to be identified and pursued shortly after 19 June 2026 (please an overview of recent case law on the fairly new German 2-click cancellation law here). This is particularly the case in Germany, where CPAs actively monitor and enforce consumer protection rules through warning letters and injunctions. Similar enforcement patterns may emerge across other Member States, albeit with varying intensity. Non-EU businesses targeting EU consumers should therefore not only plan for timely technical implementation but also conduct a thorough legal review and enforcement-risk assessment to mitigate exposure from day one.