Note: This article is for information only and does not constitute legal advice. For a legally binding assessment, please consult a licensed attorney.
TL;DR
- The withdrawal-button obligation under § 356a BGB entered into force on 19 June 2026 - with no transition period. Stores still missing the button are already in breach of applicable law.
- Concrete risks: cease-and-desist warnings from competitors and consumer associations, a withdrawal period extended to 12 months + 14 days, and per law firms fines of up to €50,000 or 4% of annual turnover.
- The good news: with an app the button is retrofitted within hours - far faster than any in-house build.
- Afterwards: update your withdrawal instructions and privacy policy and test the flow end to end once.
The situation: the deadline has passed
Since 19 June 2026, every B2C online store concluding distance contracts with German consumers must provide a withdrawal function ("withdrawal button") - permanently available, prominently placed, easily accessible. This is governed by the new § 356a BGB, introduced by the act implementing EU Directive 2023/2673 (BGBl. 2026 I No. 28).
There was no transition period. And unlike some earlier obligations, no informal "grace period" from the warning-letter scene should be expected: the violation is visible from outside on every store's frontend - it is hard to find an easier target.
What stores without the button risk right now
1. Warning letters. A missing button points to a competition-law violation that competitors and entitled associations can pursue. Costs per warning letter are typically in the four-digit range - plus a penalty-backed cease-and-desist declaration that gets expensive with every subsequent violation. Details: Avoiding withdrawal-rights warnings.
2. Extended withdrawal period. If the consumer is not properly informed about the right of withdrawal or the mandatory withdrawal function is missing, the withdrawal period extends to up to 12 months and 14 days. Customers can still withdraw a year later - including full reversal of the transaction.
3. Fines. Law firms cite a range of up to €50,000, or up to 4% of annual turnover for cross-border violations.
Quick check: am I affected at all?
The button is mandatory if you conclude distance contracts with consumers via an online user interface - regardless of size or legal form. Foreign stores selling to German consumers are covered too, via the market-location principle.
Pure B2B stores are exempt. For mixed assortments where some products have an excluded right of withdrawal (§ 312g BGB), the obligation remains as soon as at least one withdrawable product is offered.
The retrofit roadmap for Shopify
Step 1 - install an app (today). The fastest route is a specialised app like Retractly: install, set the menu link in the footer, and the two-step flow is live - with statutory labels ("Vertrag widerrufen" / "Widerruf bestätigen"), limited mandatory fields and an automatic acknowledgment email as a durable medium. No theme code required.
Step 2 - verify placement. The button must be reachable from every subpage, work for guest orders and on mobile. A footer link is permitted per the explanatory memorandum, but should stand out from imprint and T&Cs by colour. The full checklist: Withdrawal button checklist: 12 points.
Step 3 - update your legal texts. The withdrawal instructions must mention the button, its internet address and the acknowledgment; the privacy policy must cover the data processing via the button. These texts belong in a lawyer's hands - an app delivers the technology, not legal advice.
Step 4 - test the flow end to end. Place a guest test order, trigger a withdrawal via the button, and verify: two-step flow present, no forced reason field, acknowledgment with date and time arrives.
The full step-by-step guide: Setting up the withdrawal button in Shopify.
Building it yourself under time pressure? Not a good idea
The flow can be coded in-house - but under time pressure that is the riskiest option. Exact labelling, mandatory-field limits, guest access, durable medium, 24 EU official languages for cross-border sales, an audit trail as evidence: each of these is its own warning-letter risk, and every week of development is another week in a non-compliant state. The full trade-off: Build the withdrawal button yourself vs. app.
Already received a warning letter?
Do not ignore it and do not sign anything hastily. Warning letters carry short deadlines; an unmodified cease-and-desist declaration may be drafted far too broadly. The sensible three steps: (1) retrofit the button immediately to stop the violation, (2) note the deadlines, (3) have the letter reviewed by a lawyer - many can be significantly reduced in scope and cost.
FAQ
Is it too late to retrofit without consequences? The past violation cannot be undone, but every day with the button lowers your risk from now on. In practice, stores that retrofit before a warning letter arrives usually face no consequences.
Is the cancellation button I already have enough? No. The cancellation button (§ 312k BGB) covers continuing obligations (subscriptions), the withdrawal button (§ 356a BGB) covers distance contracts - and they must not be merged. Details: Withdrawal button vs. cancellation button.
Do I need a PDF for the acknowledgment? No. The automatic confirmation email suffices as a durable medium (Art. 11(3) Directive 2011/83).
Further reading:
- Retractly - EU withdrawal button for Shopify
- Setting up the withdrawal button in Shopify: step by step
- § 356a BGB: the withdrawal button, mandatory since 19 June 2026
- Withdrawal button checklist: 12 points
Primary legal sources: § 355 BGB · § 356 BGB · § 312k BGB · EU Directive 2023/2673