The 6 technical requirements of the withdrawal button

Directive (EU) 2023/2673 states the obligation: there must be a "free functionality for exercising the right of withdrawal". But the article itself does not spell out what it should look like. The directive sets out the technical arrangements that each of the 27 EU member states transposes into its own national law. The obligation has applied across the Union since 19 June 2026.

A reading of the requirements, one by one, with the practical implications for online retailers.

The directive in six requirements

Directive (EU) 2023/2673EUR-Lex ↗ is organised around six cumulative requirements:

1. Direct and permanent accessibility
2. Total absence of charge
3. Unambiguous wording
4. A two-step procedure
5. Access without creating an account
6. Acknowledgement of receipt on a durable medium

None is optional. Missing a single one renders the mechanism non-compliant and triggers the automatic extension of the withdrawal deadline to 12 months and 14 days.

1. Direct and permanent accessibility

The directive requires the functionality to be "made available to the consumer in a direct and easily accessible way" throughout the duration of the withdrawal deadline. Direct means without an intermediary (no level-3 drop-down menu, no captcha page, no prior login). Easily accessible means visible without searching.

In practice: a link in the footer of every page of the site, or in the permanent header. A floating button in the bottom right is also accepted. A link buried in the terms and conditions at the bottom of the checkout funnel is not.

2. Total absence of charge

The text is clear: "free of charge for the latter". The absence of charge covers direct costs (nothing to pay to exercise the right) and indirect costs.

Prohibited are:

• Premium-rate SMS to confirm
• Prior subscriptions to activate
• Excessive captchas (complicated image puzzles, phone verifications)
• Deterrent processes (mandatory videos, motivation questionnaires)

An "optional" step that pushes the consumer to provide a reason or to complete a satisfaction survey remains lawful, provided it is explicitly skippable with a single click.

3. Unambiguous wording

The directive recommends "Withdraw from the contract" or "Withdraw from the contract here". The wording is deliberately modelled on the vocabulary of the right of withdrawal itself (Directive 2011/83/EU, "withdraw from the contract") to avoid any ambiguity.

The wordings to avoid:

• "Cancel" (ambiguous: cancel the order or the delivery?)
• "Return request" (suggests a physical exchange, not a legal right)
• "Customer service" (points to after-sales, not withdrawal)
• "Help" / "Contact" (too vague)

This precision is not trivial. Several rulings on the online cancellation button declared non-compliant such circumvented wordings as "My options" or "Manage my subscription". The legal rule is the same: if an average consumer can hesitate over the button's function, it is not unambiguous.

4. Two-step procedure

This is the most structuring contribution of the directive. Withdrawal is done in two distinct clicks:

Step 1: the consumer clicks the "Withdraw from the contract" button. They reach a form that must let them enter or confirm:

• their surname and first name
• the precise references of the contract to be cancelled
• the electronic means for receiving the acknowledgement of receipt (usually their email)

Step 2: the consumer validates by clicking a second button labelled "Confirm the withdrawal". It is this second click that legally materialises their intention. The first click alone, without confirmation, commits to nothing.

This two-stage procedure protects the consumer from an involuntary withdrawal (an accidental click) and the professional from a dispute over the ambiguous nature of a request.

5. Access without creating an account

The directive specifies that the functionality must be accessible "by any consumer", which includes guest customers (who ordered without creating an account). Requiring a prior login amounts to denying access to a portion of consumers: it is non-compliant.

In practice, two technical solutions:

• A direct link to the form, accessible without authentication, where the customer enters their email + order number
• A system that sends a personalised link by email after minimal input

Several rulings on the cancellation button have already penalised mechanisms reserved for logged-in customers. The logic applies to the withdrawal button.

6. Acknowledgement of receipt on a durable medium

As soon as confirmation is given, the professional must send the consumer an acknowledgement of receipt "on a durable medium". The notion of a durable medium is defined in the Consumer Rights Directive (2011/83/EU, art. 2): it is any instrument that lets the consumer store the information, access it later, and reproduce it identically.

In practice, it is an email. Not a message that disappears after a few days in a customer account. Not a push notification that can no longer be found.

The acknowledgement must state:

• the date and time of sending
• the content of the withdrawal declaration
• a reference number

Without this acknowledgement, the professional cannot prove the date the request was received, and it is this date that triggers the 14-day deadline for refunding.

Three requirements the text does not state, but an inspection will

The six points above are what the directive imposes. Three more appear nowhere in the text, and yet they are the ones that decide the outcome of an inspection or a dispute.

Does the request land anywhere? Once the button is clicked and the request sent, where does it arrive? If it gets lost in a shared mailbox, you can neither handle it in time nor prove you received it. A compliant request lands somewhere identified, dated and tracked. That is also what lets you meet the 14-day refund deadline.

Can you still prove it in two years? A button that works today still has to be demonstrable later. If the competent national authority asks you for the list of withdrawals handled over the past twelve months, with timestamps and acknowledgement dates, you must be able to export it. In practice:

• Reliable timestamping: at minimum a server timestamp coupled with a cryptographic hash (SHA-256) of the content, to detect any alteration. For a "certain date" in the strict sense, you need a qualified electronic timestamp under eIDAS (RFC 3161, from a certified trust service provider). Paid, and rarely necessary in everyday practice.
• Retention over several years: aligned with the limitation periods applicable to commercial claims in your country, often five years. A longer period must be justified by a distinct purpose, under the GDPR minimisation principle.
• Exportable format: timestamped CSV or PDF, readable by a third party (accountant, lawyer, inspector).

A quick in-house build often skips these steps. A database table with a timestamp does not carry the same legal weight as a sealed chain of evidence. The day you have to demonstrate it, the difference counts. The mechanism is detailed in evidential proof of withdrawal.

Is the button still there? A button can disappear after a theme update, a plugin conflict or a cache purge. If it no longer shows, you are non-compliant again without knowing it. Monitoring that alerts you when the button is no longer detected closes that silent gap.

The most frequent mistakes

Three misreadings show up on almost every non-compliant implementation observed.

Confusing a legal notice with a functionality. By far the most widespread. Adding a paragraph on the right of withdrawal to your terms, or a "Withdrawal" link in the footer, is not enough: the directive requires a functionality (a button that opens a form) not information.

Restricting the button to logged-in customers. Covered in point 5: guest customers hold the same right, and requiring an account denies it to some of them.

Underestimating archiving. This is the mistake you do not see, until the day of the inspection.

The checklist

1. Visible at all times, across the whole site, without prior login.
2. Wording clear and unambiguous.
3. Free and free of needless friction.
4. Two steps: a distinct second confirmation click.
5. Request received and centralised, not lost in a mailbox.
6. Acknowledgement of receipt sent automatically on a durable medium.
7. Archiving timestamped, evidential, exportable.
8. Monitoring: an alert if the button disappears.

What the directive does not say

Three grey areas remain to be clarified by case law or by national implementing texts:

• The precise location on the page: footer, header, customer account? The directive says "permanent" but does not decide.
• Pre-filling the form for a logged-in customer: allowed but not mandatory.
• The format of the acknowledgement: PDF attachment? Plain-text email? Both meet the "durable medium" criterion but neither is explicitly required.

When in doubt, the prudent approach is to apply the strictest criteria: a button in the footer + an email with a timestamped PDF.

In practice

Directive (EU) 2023/2673 turns an abstract legal obligation into concrete technical requirements. Six points imposed by the text, three more imposed by the reality of an inspection, none negotiable, applicable across the 27 EU member states since 19 June 2026. If you develop your mechanism in-house, count on 3 to 5 days to integrate the first six, and longer for evidential archiving. If you use a ready-to-use solution such as BackToMe, count on five minutes: everything is implemented in compliance with the directive, in the 24 official EU languages. The trial is free for 7 days, cancellable in one click.

For the detail of the penalties incurred in the event of non-compliance, see the withdrawal penalties page. For the table of the legal terms used, see the glossary.