Key Points at a Glance
From June 19, 2026, the withdrawal button is mandatory for all B2C online shops in Germany. The basis is the new Section 356a of the German Civil Code (BGB). It covers contracts for goods, services, and financial products. The button needs a clear label, a two-step flow, and an automatic acknowledgment of receipt. Anyone not prepared by the deadline risks cease-and-desist warnings.
Nine days separate today from the effective date. That is enough time for a clean implementation, but tight for complex shops. We show what has to happen in the code, in the withdrawal policy, and in your internal process.
What changes legally
On December 19, 2025, the Bundestag passed the Act Amending Consumer and Insurance Contract Law. This transposes the EU Consumer Rights Directive (EU 2023/2673) into national law. The centerpiece is the new Section 356a of the German Civil Code (BGB). It requires an electronic withdrawal function for every distance contract concluded via an online user interface (IHK Frankfurt).
An online user interface means a website, part of a website, or a mobile app. Contracts concluded by phone, order card, or fax are not affected. Pure B2B business is also outside the rule.
The 14-day withdrawal period stays unchanged. The only addition is the extra route via a button.
Who the obligation applies to
The obligation applies regardless of size, revenue, or legal form. It affects:
Online shops with physical goods
Providers of digital services (streaming subscriptions, online courses, e-book downloads)
Financial services and insurance with a statutory right of withdrawal
Merchants on marketplaces and platforms
On marketplaces, the technical implementation lies with the platform operator, because the merchant has no influence over the interface (IHK Dresden). Anyone running their own shop has to act themselves.
Technical requirements for the button
The button must meet four criteria:
Label: “Withdraw from contract” or “Declare withdrawal.” Terms such as “cancel” or “return” are not permitted.
Visibility: Prominently placed, clearly legible, high-contrast. Distinguishable from the terms and conditions, legal notice, or privacy policy.
Availability: Reachable on the main page, without login. The function must be available throughout the entire 14-day withdrawal period.
Accessibility: Meet the requirements of the Accessibility Strengthening Act (BFSG), meaning font size, contrast, and keyboard operability.
A blanket provision is enough. Showing or hiding the button per customer depending on the remaining withdrawal period is not necessary (IHK Stuttgart).
The two-step process
The legislator wants to prevent unintentional withdrawals. That is why two steps are mandatory.
Step 1: Withdrawal page
After the click, the consumer lands on a dedicated page. There, the shop may request only three details:
The consumer’s name
Identification of the contract (order number or similar)
A communication channel for the acknowledgment of receipt (usually email)
No further mandatory fields are allowed. In particular, the shop may not ask for the reason for withdrawal.
Step 2: Confirmation
The withdrawal page needs a second button labeled “Confirm withdrawal.” Only this click triggers the withdrawal.
Acknowledgment of receipt
Immediately after confirmation, the shop sends an email with the content of the withdrawal, plus the date and time. This confirmation serves only as proof of transmission, not as confirmation of effectiveness (IHK Hannover).
What changes in the withdrawal policy
The legislator is updating the model withdrawal policy as of the effective date. Anyone who switches over today risks a faulty policy before June 19. We recommend:
Until June 18, 2026: keep using the current policy
-
June 2026: activate the new policy and take the button live at the same time
Review the withdrawal clauses in your terms and conditions and align them with Section 356a BGB
Add the new process to your privacy policy
The existing option to declare withdrawal by web form or email remains. The button is an additional obligation, not a replacement.
It is also worth noting: the statutory withdrawal form in the appendix to the policy stays in place. The new policy points to both the form and the button. Anyone offering both routes in parallel is on the safe side. The legislator will provide the model text for the new policy shortly before the deadline. Until then, it pays to prepare your own policy text now so that only the reference to the button needs to be added.
What specifically needs to be done in the shop
We recommend six steps in this order.
Assessment: Which contracts run through the shop? Which fall under B2C? Are digital products involved?
Template adjustment: Integrate the button in the header, footer, or account area. Visible at least on the homepage.
Build the withdrawal page: Form with name, order number, email. No mandatory fields beyond that.
Set up the confirmation email: Automated trigger after the click on “Confirm withdrawal.” Content, date, and time are mandatory.
Define the backend process: Which employee handles incoming withdrawals? How is receipt documented?
Test run: Walk through the entire process with an internal account. Check the email too.
If you use a common shop system (WooCommerce, Shopware, Magento), you can wait for the vendors’ plugins. As of today, they are not yet available for all systems. Anyone who wants to be safe builds the function themselves.
Technical implementation in WordPress and WooCommerce
In WordPress, three building blocks come together. First: a block or shortcode for the button that links to a dedicated page. Second: a custom post type or a dedicated page with a form that maps the three permitted fields. Third: a mail trigger that, after the confirmation click, sends an email with date, time, and withdrawal details to both the customer and the shop.
In WooCommerce, a custom template for a /widerruf/ page is often enough, combined with the WooCommerce mailer for the confirmation. The order data can be pre-filled into the form via the WooCommerce Order API when the customer is logged in. For guest orders, manually entering the order number is enough.
Important: no double opt-in email. A direct acknowledgment of receipt is enough and is in fact mandatory.
Cease-and-desist risk and fines
Anyone without a working button on June 19 risks cease-and-desist warnings from competitors and associations. As with the cancellation-button obligation under Section 312k BGB from 2022, the wave of warnings will start early. Consumer protection associations have announced targeted checks (IHK Regensburg).
On top of that, fines from market surveillance authorities loom. The amount varies by federal state but is in the four-digit range per violation.
What service providers often overlook
We see three mistakes especially often:
Button hidden in the footer. The obligation requires prominent placement. A gray link next to the legal notice is not enough.
Login required before withdrawal. The withdrawal function must in principle be reachable even without an account. Guest buyers must not be locked out.
Forgotten confirmation email. The automated acknowledgment of receipt is often overlooked. But it is mandatory and proof at the same time.
Wrong label. We see buttons with “Cancel order” or “Return item.” Neither is allowed. Only “Withdraw from contract” or “Declare withdrawal” are permitted.
Cookie banner blocks the button. If the cookie layer covers the button, the requirement of constant accessibility is violated. This can be solved with z-index and a whitelist in the cookie script.
FAQ
Does the withdrawal-button obligation also apply to B2B shops?
No. Purely B2B business is exempt. But if a shop also sells to consumers, the obligation applies to all ordering processes in which a consumer can place an order.
Is a simple link enough instead of a button?
No. The law explicitly speaks of a button. It must be prominently placed and easily accessible to the consumer. A normal text link is not enough.
What if the plugin vendors don’t deliver by June 19?
Then the shop operator is responsible. A custom implementation with a button, a two-step form, and an automatic confirmation email is feasible in any common system. We recommend starting the in-house build now instead of waiting for the vendor.
How long must the confirmation email be kept?
The legislator does not name a specific deadline. We recommend keeping the confirmation emails at least for the duration of the statutory limitation periods. That is generally three years.
We build the withdrawal button into your shop
If you need a legally compliant withdrawal button by June 19, get in touch. We implement the function in WordPress, WooCommerce, Shopware, and custom systems. Including a two-step form, automatic acknowledgment of receipt, and an update to your withdrawal policy.