The withdrawal button: what Directive (EU) 2023/2673 really requires

Directive (EU) 2023/2673 states the obligation: there must be a "free functionality for exercising the right of withdrawal". But the article itself does not spell out what it should look like. The directive sets out the technical arrangements that each of the 27 EU member states transposes into national law; France, for example, did so through decree no. 2026-3 of 5 January 2026 (Article D.221-5 of its Consumer Code). The obligation has applied across the Union since 19 June 2026.

A reading of the requirements, one by one, with the practical implications for online retailers.

The directive in six requirements

Directive (EU) 2023/2673EUR-Lex ↗ is organised around six cumulative requirements:

1. Direct and permanent accessibility
2. Total absence of charge
3. Unambiguous wording
4. A two-step procedure
5. Access without creating an account
6. Acknowledgement of receipt on a durable medium

None is optional. Missing a single one renders the mechanism non-compliant and triggers the automatic extension of the withdrawal deadline to 12 months and 14 days.

1. Direct and permanent accessibility

The directive requires the functionality to be "made available to the consumer in a direct and easily accessible way" throughout the duration of the withdrawal deadline. Direct means without an intermediary (no level-3 drop-down menu, no captcha page, no prior login). Easily accessible means visible without searching.

In practice: a link in the footer of every page of the site, or in the permanent header. A floating button in the bottom right is also accepted. A link buried in the terms and conditions at the bottom of the checkout funnel is not.

2. Total absence of charge

The text is clear: "free of charge for the latter". The absence of charge covers direct costs (nothing to pay to exercise the right) and indirect costs.

Prohibited are:

• Premium-rate SMS to confirm
• Prior subscriptions to activate
• Excessive captchas (complicated image puzzles, phone verifications)
• Deterrent processes (mandatory videos, motivation questionnaires)

An "optional" step that pushes the consumer to provide a reason or to complete a satisfaction survey remains lawful, provided it is explicitly skippable with a single click.

3. Unambiguous wording

The directive recommends "Withdraw from the contract" or "Withdraw from the contract here". The wording is deliberately modelled on the vocabulary of the right of withdrawal itself (Directive 2011/83/EU, "withdraw from the contract") to avoid any ambiguity.

The wordings to avoid:

• "Cancel" (ambiguous: cancel the order or the delivery?)
• "Return request" (suggests a physical exchange, not a legal right)
• "Customer service" (points to after-sales, not withdrawal)
• "Help" / "Contact" (too vague)

This precision is not trivial. Several rulings on the online cancellation button declared non-compliant such circumvented wordings as "My options" or "Manage my subscription". The legal rule is the same: if an average consumer can hesitate over the button's function, it is not unambiguous.

4. Two-step procedure

This is the most structuring contribution of the directive. Withdrawal is done in two distinct clicks:

Step 1: the consumer clicks the "Withdraw from the contract" button. They reach a form that must let them enter or confirm:

• their surname and first name
• the precise references of the contract to be cancelled
• the electronic means for receiving the acknowledgement of receipt (usually their email)

Step 2: the consumer validates by clicking a second button labelled "Confirm the withdrawal". It is this second click that legally materialises their intention. The first click alone, without confirmation, commits to nothing.

This two-stage procedure protects the consumer from an involuntary withdrawal (an accidental click) and the professional from a dispute over the ambiguous nature of a request.

5. Access without creating an account

The directive specifies that the functionality must be accessible "by any consumer", which includes guest customers (who ordered without creating an account). Requiring a prior login amounts to denying access to a portion of consumers: it is non-compliant.

In practice, two technical solutions:

• A direct link to the form, accessible without authentication, where the customer enters their email + order number
• A system that sends a personalised link by email after minimal input

Several rulings on the cancellation button have already penalised mechanisms reserved for logged-in customers. The logic applies to the withdrawal button.

6. Acknowledgement of receipt on a durable medium

As soon as confirmation is given, the professional must send the consumer an acknowledgement of receipt "on a durable medium". The notion of a durable medium is defined in the Consumer Rights Directive (2011/83/EU, art. 2): it is any instrument that lets the consumer store the information, access it later, and reproduce it identically.

In practice, it is an email. Not a message that disappears after a few days in a customer account. Not a push notification that can no longer be found.

The acknowledgement must state:

• the date and time of sending
• the content of the withdrawal declaration
• a reference number

Without this acknowledgement, the professional cannot prove the date the request was received, and it is this date that triggers the 14-day deadline for refunding.

What the directive does not say

Three grey areas remain to be clarified by case law or by national implementing texts:

• The precise location on the page: footer, header, customer account? The directive says "permanent" but does not decide.
• Pre-filling the form for a logged-in customer: allowed but not mandatory.
• The format of the acknowledgement: PDF attachment? Plain-text email? Both meet the "durable medium" criterion but neither is explicitly required.

When in doubt, the prudent approach is to apply the strictest criteria: a button in the footer + an email with a timestamped PDF.

In practice

Directive (EU) 2023/2673 turns an abstract legal obligation into concrete technical requirements. Six boxes to tick, none negotiable, applicable across the 27 EU member states from 19 June 2026. If you develop your mechanism in-house, count on 3 to 5 days to integrate all six. If you use a ready-to-use solution such as BackToMe, count on five minutes: the six points are implemented in compliance with the directive.

For the detail of the penalties incurred in the event of non-compliance, see the withdrawal penalties page. For the table of the legal terms used, see the glossary.