Web agency and freelancer: your liability for the button

If you manage e-commerce sites for clients, 19 June 2026 does not concern only those clients. It concerns you too. Since that date, the obligation has applied throughout the EU (Directive (EU) 2023/2673): across the 27 EU member states, the withdrawal obligation requires a permanent digital withdrawal function on any site selling to consumers. Most of the sites you have delivered or that you maintain do not have it.

The real question for an agency or a freelancer is therefore not "are my clients exposed?" (they are), but "am I exposed with them?". The answer depends on your contract and your duty to inform, and it deserves to be looked at coolly, without waiting.

What the law has required since 19 June 2026

Directive (EU) 2023/2673EUR-Lex ↗, transposed by each of the 27 member states, requires any trader selling at a distance to consumers to offer an online function, permanent and easily accessible, allowing the right of withdrawal to be exercised. In Ireland, for example, the CCPC enforces this obligation. This is what the rules call the "withdraw from contract here" function.

Concretely, this covers almost all B2C sites: shops selling physical products, distance services, and most especially SaaS and subscriptions, for which the first 14 days after signing up fall under the right of withdrawal. A merchant site without this function on 19 June is in breach, whatever its CMS.

The duty to advise of the agency and the freelancer

A technical provider is not a mere executant. Case law has long recognised that the IT professional is bound by a duty to advise and inform towards their client, including on the regulatory constraints that affect the object of their service. This duty is all the stronger where the client is themselves a layperson in the matter.

This does not mean that an agency automatically becomes liable for the compliance of every site it has touched. The extent of the obligation depends on the contractual scope:

In every case, the risk is not so much having done badly as having said nothing. A client who discovers after the fact that they were in breach, when their agency knew the deadline and kept quiet, has a legitimate grievance. Conversely, an agency that has alerted its clients in writing, proposed a solution, and documented its recommendations has fully met its duty, whether the client followed it or not.

The concrete risk your clients do not yet see

This is where the argument sells itself to your clients, because the stake goes beyond the fine.

The administrative penalty. A failure to meet the obligation to inform on withdrawal is a sanctioned breach. Sanctions are set nationally: in Ireland, the CCPC can impose fines of up to €60,000 (Consumer Rights Act 2022), and for widespread infringements the EU Omnibus Directive (EU) 2019/2161 allows fines of at least 4% of annual turnover. For most of your clients that are companies, this is a serious exposure. You can find the detail on our page dedicated to withdrawal penalties.

The cash-flow risk, far heavier. Failing compliant information on the right of withdrawal, the withdrawal period is not 14 days but automatically extends to 12 months and 14 days (Directive 2011/83/EU, art. 10EUR-Lex ↗). In other words: every sale concluded on a non-compliant site remains contestable for more than a year. The consumer who withdraws within this extended period is entitled to a full refund within 14 days. Across a portfolio of active shops, that is a latent liability which can weigh far more than any single fine.

For your clients, you are the person best placed to explain this risk. This is exactly what turns an obligation to be endured into an opportunity for an engagement.

How to bring a whole portfolio of sites into compliance

Recoding a timestamped archiving infrastructure and a compliant form, site by site, is not realistic. This is precisely why the solution is standardised: a single script, which is put in place in a few minutes via Google Tag Manager, and which works independently of the CMS (Shopify, PrestaShop, WooCommerce, or Stripe billing).

Two steps, designed for portfolio management:

1. Audit first. Our batch audit tool, free and without sign-up, scans all your clients' URLs at once and identifies the exposed sites. You come out of it with a prioritised list, and a costed argument to present to each client.
2. Recommend next, and earn a commission. The referral programme earns you 25% of the subscription of each recommended client, recurrently and for life (paid by quarterly bank transfer). The client creates and manages their own account at the public price; you keep your service fees and add a recurring income, instead of absorbing a constraint.

In summary

19 June 2026 is not just a risk for your clients: it is a test of your duty to advise. The agency or freelancer who alerts, proposes a solution and documents their recommendations protects and enhances their standing. The one who stays quiet exposes themselves, and lets slip an opportunity that their competitors will seize. Auditing your portfolio takes a few minutes: it is the simplest starting point.

Once the risk is covered, this constraint can become a line of recurring income across your whole portfolio. That is the subject of the article: reselling compliance as a recurring income.