EU Directive 2023/2673: The Complete Guide to the Withdrawal Button for Online Shops

Everything webshop owners need to know about EU Directive 2023/2673, the new withdrawal button requirement. Learn what the directive says, who it applies to, technical requirements, penalties, and the enforcement timeline starting June 2026.

What Is EU Directive 2023/2673?

EU Directive 2023/2673, formally known as the directive amending Directive 2011/83/EU on consumer rights as regards financial services contracts concluded at a distance, introduces a significant new requirement for online retailers across the European Union. At its core, the directive mandates that all webshops selling to EU consumers must provide a clearly labeled withdrawal button on their website, enabling customers to exercise their right of withdrawal digitally and without unnecessary friction. The directive was adopted on November 22, 2023, and represents the EU's continued push to strengthen consumer protection in the digital economy. While the original Consumer Rights Directive already guaranteed a 14-day withdrawal period for most online purchases, the practical reality was that many consumers found the process of withdrawing from a contract confusing, buried in fine print, or dependent on sending emails or letters. Directive 2023/2673 eliminates these barriers by requiring a standardized, accessible, and unmistakable mechanism directly on the merchant's website.

Who Does the Directive Apply To?

The directive applies to all traders who sell goods or services to consumers within the European Union through an online interface. This includes webshops based in EU member states as well as non-EU businesses that target EU consumers. If your webshop is accessible to customers in any EU country and you offer goods or digital services, you are subject to the directive. The scope is deliberately broad. It covers traditional e-commerce stores selling physical products, digital service providers, subscription-based businesses, and marketplace sellers. The only notable exceptions are contracts that are already exempt from the right of withdrawal under the existing Consumer Rights Directive, such as sealed goods that have been opened for hygiene reasons, perishable goods, and bespoke or clearly personalized items. If your products or services fall within the standard withdrawal right, the button requirement applies to you.

What Must Merchants Actually Do?

The directive imposes three primary obligations on online merchants. First, you must provide a withdrawal button on your website that consumers can use to exercise their right of withdrawal. This button must be clearly labeled, easy to find, and available throughout the entire withdrawal period. Second, when a consumer clicks the withdrawal button, you must implement a two-step confirmation process to prevent accidental withdrawals. Third, once the withdrawal is confirmed, you must immediately send a confirmation to the consumer on a durable medium, typically email, acknowledging receipt of the withdrawal request. Beyond these core requirements, merchants must also maintain records of withdrawal requests. While the directive does not specify an exact retention period, legal experts across the EU recommend keeping records for at least 10 years to align with general commercial record-keeping obligations in most member states. The withdrawal process must be at least as easy as the original purchase process, meaning you cannot add unnecessary steps, require phone calls, or force the consumer to navigate complex forms.

Technical Requirements: The Withdrawal Button

The withdrawal button itself must meet several specific technical criteria. The labeling must be unambiguous. The directive requires text along the lines of "Withdraw from this contract" or an equivalent clear phrase in the consumer's language. Vague labels like "Cancel" or "Contact us" do not meet the requirement. The button must be prominently placed and visually distinct, meaning it cannot be hidden in a footer, buried within terms and conditions, or styled in a way that makes it difficult to notice. Best practice is to place the button in the customer's order history or account area, where they naturally go to manage their purchases. The button must be accessible for the full duration of the withdrawal period, which is 14 days from receipt of goods or conclusion of a service contract. It must function on all devices, including mobile, and must not require the consumer to log in if they did not need an account to make the purchase. Accessibility standards also apply, meaning the button should work with screen readers and keyboard navigation.

The Two-Step Confirmation Process

To prevent accidental withdrawals and ensure that consumers act deliberately, the directive mandates a two-step process. When the consumer clicks the withdrawal button, they must be presented with a confirmation step before the withdrawal is finalized. This can take the form of a confirmation dialog, a summary page showing the details of the order being withdrawn, or a similar mechanism that requires an explicit second action. The key requirement is that the consumer must take two distinct actions: initiating the withdrawal and then confirming it. A single click is not sufficient. However, the confirmation step must not be designed to discourage the consumer from proceeding. Dark patterns such as guilt-tripping language, confusing button placement, or countdown timers are explicitly prohibited. The confirmation should be neutral, informative, and straightforward.

Durable Medium Confirmation

Once the consumer confirms their withdrawal, the merchant must immediately send a confirmation on a durable medium. In practice, this almost always means email, though other formats such as PDF downloads or messages within a permanent account inbox can also qualify. The confirmation must include the date and time of the withdrawal, identification of the contract or order being withdrawn, and a clear statement that the withdrawal has been received and will be processed. The concept of a durable medium is important: it must be a format that the consumer can store, retrieve, and reproduce unchanged. An SMS might qualify in some interpretations, but email remains the safest and most universally accepted option. A notification within your website that disappears after the session ends does not qualify. The confirmation must be sent without undue delay, which regulators generally interpret as immediately or within minutes, not hours or days.

Penalties for Non-Compliance

The consequences of failing to comply with Directive 2023/2673 are substantial. The most immediate penalty is the automatic extension of the withdrawal period. If a merchant does not provide the required withdrawal button, the consumer's withdrawal period extends from the standard 14 days to up to 12 months. This means a customer could return a product nearly a year after purchase, and the merchant would be obligated to process the return and issue a full refund. Beyond the extended withdrawal period, member states are required to establish financial penalties that are effective, proportionate, and dissuasive. While the exact amounts vary by country, fines can reach up to 50,000 euros or more per infringement in several jurisdictions. In some member states, repeated violations can result in even higher penalties or trading restrictions. National consumer protection authorities have the power to conduct audits, order corrective measures, and in severe cases, restrict a merchant's ability to sell online.

Timeline: Transposition and Enforcement

Understanding the timeline is critical for planning your compliance efforts. EU member states were required to transpose the directive into national law by December 19, 2025. This means that by that date, each country should have adopted the necessary national legislation to implement the directive's requirements. The enforcement date is June 19, 2026, which is when the rules become fully applicable and enforceable. After June 19, 2026, consumer protection authorities across the EU can begin investigating and penalizing non-compliant merchants. Some member states have indicated they will conduct proactive sweeps of major e-commerce websites in the months following the enforcement date. The gap between transposition and enforcement is intended to give merchants time to implement the necessary changes, but that window is closing rapidly. If you have not yet started working on compliance, the time to act is now.

Platform-Specific Considerations

The path to compliance depends significantly on your e-commerce platform. If you run a custom-built webshop, you will need to implement the withdrawal button, confirmation flow, and email notification from scratch or integrate a third-party solution. For merchants on Shopify, the platform does not currently provide a native withdrawal button feature, meaning you will need a theme app extension or third-party integration. WooCommerce merchants face a similar situation, requiring either custom development or a plugin. Regardless of your platform, the solution must integrate cleanly with your existing order management workflow. A withdrawal request should be visible in your admin panel, linked to the relevant order, and trigger any necessary inventory or refund processes. This is where purpose-built solutions like regrettable.eu become valuable: rather than spending weeks building custom functionality, you can integrate a pre-built, compliant withdrawal button that works across Shopify, WooCommerce, and custom platforms with minimal development effort.

How regrettable.eu Solves Compliance

regrettable.eu was built specifically to help webshop owners comply with EU Directive 2023/2673 without the complexity of building a withdrawal system from scratch. The service provides a lightweight, embeddable withdrawal button that meets all the directive's requirements out of the box: correct labeling, prominent placement, two-step confirmation, and automatic durable medium confirmation via email. The widget is under 20KB, loads asynchronously to avoid impacting page performance, and uses Shadow DOM to prevent style conflicts with your existing site. It integrates with Shopify via a theme app extension, with WooCommerce via a dedicated plugin, and with any custom platform via a simple JavaScript snippet. All withdrawal requests are logged with full audit trails, timestamps, and email confirmations, giving you the record-keeping foundation you need. The merchant dashboard provides a clear overview of all withdrawal requests, their status, and associated order details. Rather than treating compliance as a one-time development project that needs ongoing maintenance, regrettable.eu handles the regulatory complexity so you can focus on running your business.