On 5 February 2026, Germany passed a new law transposing EU-Directive 2023/2673. Of particular importance are the new requirements regarding the right of consumers to withdraw from contracts via a new online interface: the so-called “withdrawal button”. These obligations will enter into force across the whole European Union at the latest on 19 June 2026. Although this obligation pertains to the area of consumer rights, its implementation may also touch on data protection.
Withdrawal as Easy as Conclusion
Directive 2023/2673 adds a new Article 11a to the Consumer Rights Directive (Directive 2011/83) which introduces the “withdrawal button”. This is a new means to withdraw from contracts concluded online between business and consumers (B2C) that does not replace the current other mandatory methods. The legal requirements for this new functionality can be summarized as follows:
- mandatory provision of a new withdrawal function (“withdrawal button”)
- mandatory procedure for submitting the withdrawal statement
- obligation to acknowledge the receipt of the withdrawal statement
Firstly, the new withdrawal function must be set up on the company’s website and particularly on its online shop. It must be designed as follows:
- clearly labelled with the words “withdraw from contract here” or an equivalent unambiguous phrase
- permanently available
- prominently displayed and easily accessible
In order to be fully compliant, the “withdrawal button” should be placed in the footer or header of the website. This ensures that consumers can always access the withdrawal function with ease. A “withdrawal button” only accessible after logging into a customer account or located in a drop-down menu would not be legally compliant, as it would fail to be constantly and easily accessible.
Although it is colloquially known as a button, it may also be integrated in the form of a traditional link. However, it should remain prominently displayed and therefore clearly distinguishable from other mandatory links such as the legal or privacy notice. As such, a prominent button or a link in a different color or bigger font is required.
Secondly, the procedure for submitting a statement of withdrawal is clearly defined.
The withdrawal function must allow the following details to be entered:
- the consumer’s name,
- details identifying the contract or parts of the contract from which the consumer wishes to withdraw, and
- the consumer’s email address for the purpose of acknowledging receipt.
Once these details have been entered, the consumer must be given the opportunity to review their details and confirm them by clicking a button labelled ‘confirm withdrawal’ or a similarly worded button (known as the “two-step procedure with confirmation function”).
Finally, once the withdrawal has been confirmed by the consumer, an acknowledgment of receipt must be sent immediately, containing the details of the withdrawal statement as well as its time and date. An appropriate and time-saving method would be to send an automated email containing the aforementioned elements.
This acknowledgment of receipt merely confirms that the statement of withdrawal has been received. Businesses remain fully capable of processing and therefore contesting a withdrawal in accordance with the applicable regulations.
Consequences for Related Documents
This new cancellation function also brings new information requirements for businesses. In particular, the withdrawal policy must specify the existence and location of the “withdrawal button”.
An incorrect notice, which, for example, does not include the withdrawal functionality or refers to one that does not exist, will have significant consequences for the cancellation period. This is because the withdrawal period does not begin until the customer has been informed in legally compliant terms. Should the information be incorrect, the consumer’s right of withdrawal will, in most cases, only expire one year and 14 days after full receipt of the order. The financial and operational risks for businesses therefore go beyond the risk of fines by the local authorities as non-compliance may lead to contract withdrawals way beyond the expected time frame.
In addition to these new obligations regarding the wording of the withdrawal policy, there may also be a need to amend privacy policies. This is because the withdrawal form contains personal data which, depending on the wording, may not yet be included in the privacy policies.
Conclusion
With the deadline for implementation of the new “withdrawal button” nearing, there are several things to consider. Businesses should start to review their online presence and shops and consider involving their Data Protection Officer with regard to possible changes to the privacy policy.