The 5 most common mistakes with the withdrawal button

We are seeing the first implementations of the withdrawal button arrive on merchant sites. And above all we are seeing the same mistakes appear again and again, some through lack of knowledge, others through misinterpretation of a text that is nonetheless clear.

Here are the five you will want to avoid.

1. Confusing a "legal notice" with a "dedicated functionality"

Adding a paragraph on the right of withdrawal to your terms and conditions is not enough: the EU rules (Directive (EU) 2023/2673) require a functionality (a button that triggers a form), not a piece of information (an explanatory text). This is by far the most widespread mistake. Or the belief that a "Withdrawal" link in the footer will do the job.

No. The directive is explicit on one point: you need a functionality, not a piece of information. A functionality means the customer must be able, by clicking on a visible element, to fill in a form and submit their request immediately. An explanatory text, even well placed, does not meet this requirement.

2. Hiding the button on product or basket pages

The visibility obligation is permanent, throughout the withdrawal period (14 days after receipt of the goods or conclusion of the contract for services). This means the button must remain accessible after the purchase, not only during shopping.

Some merchants limit the button to the customer account page or to the order confirmation email. That is insufficient: if the customer types the URL of your site while logged out to exercise their right, they must be able to do so.

The simple rule: the button must be present on all commercial pages of the site, or at the very least be a functionality accessible by a direct, clear path, from the home page or any product page.

3. Choosing a "subtle" wording

The EU rules require clear and unambiguous wording; in Ireland the official label is "withdraw from contract here". Any euphemistic wording such as "Cancel my order", "My after-sales steps", "Request a return" risks being judged non-compliant.

The directive requires clear and unambiguous wording. In practice, the recommended expression is the one that mirrors the statute: in Ireland, "withdraw from contract here". Why? Because it is the vocabulary of consumer law itself. Legally, the right of withdrawal is the right to "withdraw" or to "cancel the contract".

A marketing-friendly wording is not unlawful per se; it becomes risky if it introduces the slightest confusion. A customer who thinks "Request a return" only concerns after-sales service, not statutory withdrawal, can argue that they could not find the button. And it is you who will be at fault. This confusion between withdrawal and after-sales service is not trivial; it is precisely why BackToMe positions itself as withdrawal infrastructure and not after-sales software: the two flows must stay clearly separate for the end user.

4. Forgetting the acknowledgement of receipt

The acknowledgement of receipt obligation is in the withdrawal-button rules (Directive (EU) 2023/2673) themselves, and it is independent of the button: as soon as a consumer exercises their right of withdrawal, the trader must send an acknowledgement of receipt on a durable medium.

"Durable medium", in practice, means: an email to the customer, with the date of the request, a reference number, and a reminder of their rights (refund period, return arrangements, etc.). Not a mere confirmation message on the site that disappears when the browser is closed.

5. Underestimating archiving

This is the mistake you do not see, until the day of the inspection.

The button that works today, you still have to be able to prove it in 6 months, 2 years, 5 years. If the CCPC inspects your site and asks you to provide the list of withdrawals handled over the last 12 months, with timestamps of the requests, acknowledgement of receipt dates and proof of refunds, you must be able to export it.

In practice, this involves:

• Reliable timestamping: at the very least a server timestamp coupled with a cryptographic hash (SHA-256) of the content to detect any tampering. For a "certain date" in the strict sense, you must go through a qualified electronic timestamp within the meaning of eIDAS (RFC 3161 provided by a certified trust service provider), which is paid for and rarely necessary in everyday practice.
• 5-year retention: aligned with the general limitation period for commercial claims. A longer duration (e.g. 10 years, modelled on accounting-record obligations) must be justifiable by a specific, distinct purpose under the GDPR minimisation principle.
• Exportable format: timestamped CSV or PDF, viewable by a third party (accountant, solicitor, inspector).

A "quick" in-house development often skips these steps. A database table with a MySQL timestamp does not have the same legal value as a notarised chain of evidence. The day you have to demonstrate it, the difference counts.

Recap

The five mistakes correspond to five different aspects of the text. In order of common occurrence:

1. A statement is not a functionality, you need a clickable button, not a paragraph.
2. The button must remain accessible everywhere, not only during the purchase.
3. The wording must be unambiguous, "withdraw from contract here" is the recommended term in Ireland.
4. The acknowledgement of receipt is mandatory, not an option.
5. Archiving must have probative value, timestamped, with a proof hash of the content, retained for 5 years, exportable.

If you tick all five, your set-up meets the requirements of the directive. If one box is missing, the risk exists, not necessarily an immediate fine, but a fragile case in the event of an inspection or dispute. For the detail of CCPC penalties, see the dedicated page.

BackToMe handles all five points from installation. The 7-day free trial (0 € today, cancellable in one click) is there if you want to test before you commit.