Not compliant with the withdrawal button? Fix it fast

The obligation has been in force since 19 June 2026. If, as you read these lines, your site sells to consumers without a compliant withdrawal mechanism, you are no longer ahead nor on time: you are late. That is no reason to panic, but it is a reason to act today rather than next week, because every day that passes now carries a concrete cost. Here is what kicks in, what does not apply, and how to put things right cleanly.

What kicks in from today

Two mechanisms, and the second hurts far more than the first.

The administrative fine. Sanctions are not harmonised across the EU: each member state sets its own. The absence of a compliant mechanism exposes you to a fine from your national consumer regulator. In Ireland, for example, the CCPC can impose fines of up to EUR 60,000 (Consumer Rights Act 2022), and for widespread infringements the EU Omnibus Directive (EU) 2019/2161 allows fines of up to 4% of annual turnover. It requires an inspection, so it is not automatic.

The extension of the withdrawal period. This is the penalty that lasts. When the information and the mechanism for exercising the right are not provided in accordance with the legal requirements, your customers' withdrawal period goes from 14 days to 12 months and 14 days (Directive 2011/83/EU, art. 10). In concrete terms, every sale concluded without a compliant mechanism becomes challengeable for more than a year, without any prior inspection being required. It is a civil penalty that applies as of right. The detail of the mechanism is explained in our article on the 12-month period.

What does not apply: retroactivity before 19 June

Good news for your past sales: the principle of legality of penalties prohibits penalising you for an obligation that did not yet exist. No fine can be imposed for the absence of a button before 19 June 2026, and contracts concluded before that date remain subject to the old regime.

The practical consequence is simple: the window of exposure begins today and opens a little wider with each uncovered order. The sooner you put things right, the fewer challengeable sales you accumulate over twelve months. It is not "too late", it is "the sooner the better".

The good news: fixing it is quick

Coming into compliance is not a project of several weeks. The obligation rests on four building blocks, and none of them requires heavy development.

1. A dedicated mechanism, accessible from every page throughout the whole period, without any obligation to create an account. Many customers order as guests: a button confined to the customer account is not enough.
2. A clear journey with a confirmation step: the consumer submits their request, then confirms it.
3. An acknowledgement of receipt on a durable medium, timestamped. A confirmation shown on screen is not one.
4. A mention in your T&Cs informing of the existence and location of the mechanism. This is the block most often forgotten. See our guide on the T&Cs mention.

If a single one is missing, the mechanism is not compliant. Also check that your products are indeed concerned: some sales fall outside the right of withdrawal, but the exceptions are to be interpreted strictly.

The absolute priority: proof, not just the button

This is the classic mistake of putting things right in a hurry: you add a button, an email goes out, and you think you are covered. Yet on the day of an inspection or a complaint, what matters is not that the button exists, it is what you can prove.

An acknowledgement sent but not timestamped and not archived does not protect you. What holds up is an enforceable record: a timestamped fingerprint kept for the legal duration, which you can produce a year later to demonstrate that a request was indeed received on a given date and has not been altered. Ideally, this proof should be verifiable by a third party, without anyone having to take your word for it. That is the whole point of the evidential value of proof of withdrawal.

Fixing what is visible puts you in order on the form. Fixing the proof genuinely protects you.

Your plan for today

• Run the diagnosis: does your site let a customer, even without an account, withdraw in a few clicks from any page? Do they receive a durable, timestamped acknowledgement? If in doubt, test your situation in two minutes.
• Put the mechanism in place: a compliant mechanism installs quickly, without touching the code in most cases. The aim is to stop accumulating exposed sales right now.
• Turn on the proof: make sure every request is timestamped and archived, not merely sent.
• Update your T&Cs to mention the mechanism.

Once the mechanism is in place, two reflexes to avoid fixing things by halves: check that your button is genuinely compliant (the 7 points that count) and know what to do when a withdrawal request comes in.

The obligation is here, it will not go away. The only variable you still control is the number of days for which your sales will remain challengeable. Every day of delay adds to it. Putting things right, on the other hand, takes far less time than that.