From 19 June 2026, if consumers can conclude a contract on your website or app, they must also be able to cancel it there with a button. That is the short version of Article 11a of the Consumer Rights Directive, inserted by Directive (EU) 2023/2673. Member states had to write it into national law by 19 December 2025, and Germany has already done so with the new § 356a BGB. Every legal quote below is taken verbatim from the directive text on EUR-Lex, with capture dates in our source ledger.
Short answer: you need a withdrawal function that is "labelled with the words 'withdraw from contract here' or an unambiguous corresponding formulation", is "continuously available throughout the withdrawal period", and is "prominently displayed on the online interface and easily accessible to the consumer". Clicking it opens a short statement (name, order, contact channel), the consumer confirms with a second button that says "confirm withdrawal", and you must send back an acknowledgment "on a durable medium, including its content and the date and time of its submission, without undue delay".
Who this applies to
The rule covers "distance contracts concluded by the means of an online interface". The directive's own recital removes any doubt about scope: "This obligation should apply not only to distance contracts for financial services, but to all distance contracts that are subject to the right of withdrawal under Directive 2011/83/EU." Directive 2023/2673 is formally the financial-services directive, which is why many merchants assume it does not concern them. It does. If you run an online store selling to EU consumers and your orders carry the standard 14-day right of withdrawal, the button obligation lands on you.
The stated logic is parity: "This should ensure that consumers can withdraw from a contract just as easily as they can conclude it." One click to buy, so no obstacle course to cancel.
Two useful clarifications sit in the same recital:
- No forced app download. "The consumer should not have to undertake procedures to find or access the function, such as downloading an application if the contract was not concluded via that application." If they bought on your website, the button lives on your website.
- Partial withdrawal is allowed. "If the consumer has ordered multiple goods or services within the same distance contract, the trader can provide the consumer with the possibility to withdraw from a part rather than the whole of the contract." A line-item cancel flow is compliant, and better for you than all-or-nothing.
What Article 11a actually requires
The full mechanism has five parts, and the directive specifies each one.
1. The button itself
"The trader shall ensure that the consumer can also withdraw from the contract by using a withdrawal function. The withdrawal function shall be labelled with the words 'withdraw from contract here' or an unambiguous corresponding formulation in an easily legible way. The withdrawal function shall be continuously available throughout the withdrawal period. It shall be prominently displayed on the online interface and easily accessible to the consumer."
Note the word "also". The button is an additional channel. Consumers keep every existing route, including the model withdrawal form and a plain email.
2. The withdrawal statement
The button must open "an online withdrawal statement" that lets the consumer "easily provide or confirm the following information: (a) his or her name; (b) details identifying the contract from which he or she wishes to withdraw; (c) details of the electronic means by which the confirmation of the withdrawal will be sent to the consumer." In practice: name, order reference, email address. Nothing more is required, and adding friction beyond this list invites trouble.
3. The confirmation button
Submission happens "by means of a confirmation function" which "shall be labelled in an easily legible manner, and only with the words 'confirm withdrawal' or with an unambiguous corresponding formulation." The word "only" matters. This is the same drafting pattern as the "order with an obligation to pay" button rule, and it means no marketing copy, no guilt trips, no "are you sure?" maze on that final control.
4. The acknowledgment
"Once the consumer activates the confirmation function, the trader shall send to the consumer an acknowledgement of receipt of the withdrawal on a durable medium, including its content and the date and time of its submission, without undue delay." A timestamped email restating what was withdrawn satisfies this.
5. The deadline rule
"The consumer shall be considered to have exercised his or her right of withdrawal within the relevant withdrawal period if he or she submitted the online withdrawal statement referred to in this Article before that period expired." Submission time wins, not your processing time. Your logs need to capture that timestamp.
There is one more change that is easy to miss: the pre-contract information duty in Article 6(1)(h) now includes "information about the existence and placement of the withdrawal function". Your terms and your withdrawal policy page have to say the button exists and where it is.
The dates, precisely
The directive's own transposition article: "Member States shall adopt and publish by 19 December 2025 at the latest, the laws, regulations and administrative provisions necessary to comply with this Directive... They shall apply those measures from 19 June 2026." So national laws exist now, and the obligations bite from 19 June 2026. Penalties are set country by country, and the directive requires them to be "effective, proportionate and dissuasive".
Germany moved first. The transposition law was published in the Bundesgesetzblatt on 5 February 2026 and creates § 356a BGB, "Elektronische Widerrufsfunktion bei Fernabsatzverträgen", in force 19 June 2026. The German button label is "Vertrag widerrufen" and the confirmation button is "Widerruf bestätigen", each with the same "or an equivalent unambiguous formulation" escape hatch as the directive. If you sell into Germany, that is the wording your German-language storefront should carry.
How to implement it, step by step
The directive tells you what. Here is a build plan that satisfies each requirement:
- Place the button where the contract was concluded. Sold on your website means a button on your website: the order page in the customer account is the natural home, plus a persistent link in the footer or help menu so it is "prominently displayed" and "easily accessible". If you also sell in an app, the app needs it too. Do not hide it behind login alone if guest checkout exists, since guests also hold the right.
- Label it correctly per market. "Withdraw from contract here" in English, "Vertrag widerrufen" in German, or an unambiguous equivalent. "Cancel order" on its own is risky wording for a statutory withdrawal, since it collides with pre-shipment cancellation. Keep the two flows distinct.
- Build the two-step flow. Step one collects exactly the three items in the directive: name, order identifier, email for the confirmation. Pre-fill everything you already know. Step two is a single control labelled "confirm withdrawal". No surveys, no retention offers between the two steps.
- Send the acknowledgment automatically. An immediate email containing the withdrawal statement content plus the date and time of submission. Store the same timestamp server-side, because it is the legal moment the right was exercised.
- Keep it available for the whole window. The 14-day period for goods runs from delivery, so availability is per order, not per calendar. Your logic needs the delivery event to know when the window closes. Since being generous is allowed, many merchants will simply keep the button available as long as their return window runs.
- Update your legal texts. Withdrawal policy and pre-contract information must mention the function and its placement, per amended Article 6(1)(h).
- Wire it into your returns flow. This is where compliance turns into operations, covered next.
What happens after the click
The button is the front door. Everything the consumer is entitled to afterwards already existed in the Consumer Rights Directive: the 14-day cooling-off ("the consumer shall have a period of 14 days to withdraw from a distance or off-premises contract, without giving any reason"), the refund, and the return shipment. The exceptions also still apply, including "the supply of goods made to the consumer's specifications or clearly personalised". The full rulebook is in our guide to the EU right of withdrawal.
Operationally, one button press has to trigger a chain: validate the order is inside its window, register the withdrawal with a timestamp, send the acknowledgment, issue a return label or pickup, track the parcel home, and start the refund clock. Doing that by hand from an inbox is exactly the workload the button will multiply, because a one-click cancel path gets used far more than a buried PDF form. Merchants running returns through spreadsheets should read up on what a return management system automates, and what the true cost of a return looks like once volume rises.
Pango sits on exactly that chain: returns management that turns a withdrawal into a labeled, tracked, refund-ready return automatically, with exchange offers where the shopper actually wanted a different size rather than their money back. If you want to see what unmanaged returns cost you today, run the returns leak calculator.
The bottom line
Article 11a is unusually prescriptive for EU consumer law: exact label, exact confirmation wording, exact acknowledgment contents, exact deadline rule. That makes compliance a checklist rather than a judgment call, and this page is that checklist. The harder part is what the button unleashes: more withdrawals through a faster channel, each one demanding a label, a tracked return, and a refund inside 14 days. For the operational half of the problem, see Pango's post-purchase platform or book a demo.
