Online store legislation in the EU

Status of the rules: 13 October 2026. This page is not legal advice. Laws change, and some of the measures mentioned were still being adopted at the time of writing. Before important decisions about your store, consult a lawyer in your country, and an accountant for tax questions.

Why these pages matter

From our practice (2026). The national consumer protection authority of one EU country inspected one of the stores we maintain. Its report listed several irregularities: single-page checkout without a separate "Order review" step (the customer placed the order immediately with the "Complete order" button); a customer from another EU country could not order with a billing address in their own country; the withdrawal form asked for an IBAN; the footer said "delivery in one day" while the terms stated 2 to 4 business days; discounted products did not show the lowest price of the previous 30 days. The last one is very common, especially in stores on hosted platforms, where this display is not there by default, and inspectors do check it. The store had a few weeks to fix everything, and the inspector verified the corrections on the live site.

The separate review step is a good example of how a rule turns into a design requirement. Directive 2000/31/EC, Article 11(2), requires that the service provider makes available appropriate, effective and accessible technical means allowing the customer to identify and correct input errors before placing the order. In the inspector's view, the ability to edit fields inside a form was not enough: the customer needs one place where they see everything they entered (addresses, delivery and payment method, products, quantities, prices), can go back and correct it, and only then place the order.

Legislation on online selling changes faster than we would like. This page is an overview of the rules for selling to consumers in the EU that are easiest to overlook. Each rule comes with the EU act, so you can check the current text yourself. The overview is not organized by law but by the customer journey: footer, product page, cart, after purchase and behind the scenes. That way you know exactly where in your store to check what. You do not need to know the acts by heart, but you do need to know they exist and build them into your work: into the store layout (buttons, forms, product page data), the terms and conditions, contracts with suppliers and regular maintenance.

Important: EU directives are transposed into national law by each Member State, and enforcement is done by national authorities (the consumer protection authority, the data protection authority, the tax authority). Details, deadlines and exemptions can therefore differ from country to country, and some countries may still be completing the transposition of recent directives. Check the rules of the country where you are established and of the countries you sell to. Your national consumer protection authority often publishes its own guide for online stores.

Three traffic lights

• Red - sort these out first (rules that apply to every store and are easy to check): strikethrough prices (Omnibus), false urgency, the withdrawal period and refund, the order button labeled with a payment obligation, cookie consent, company details in the footer.
• Orange - applies, but needs more work: GPSR data on the product page, accessibility, packaging and extended producer responsibility, health and environmental claims.
• Green - mostly for special cases: DSA (if you run a marketplace or comments), NIS2, buy now pay later (BNPL).

The red rules are the ones where consumer authorities most often find violations in our experience: missing information (conformity liability, delivery time, withdrawal form), a wrong withdrawal period, a wrongly labeled order button, fake discounts and unverified reviews. Most cases end with a warning and a deadline to fix, but fines are possible.

The customer journey through the store: five stops

The five stops double as a checklist. Each comes with the relevant act, one mistake that is easy to overlook, and one task for today.

Stop 1: the footer and general information

Directive 2000/31/EC, Article 5, and Directive 2011/83/EU, Article 6

• The footer shows the name, registered address, registration and tax numbers, contact details and register entry, reachable by a link from every page.
• The terms and conditions are accessible before and after purchase.
• The returns procedure and the withdrawal form are published.
• The privacy policy and cookie policy are published.
• Information on out-of-court dispute resolution is published where relevant to you (Directive 2013/11/EU); a link to the EU ODR platform is no longer needed because the platform has been discontinued.

An easy-to-miss mistake: terms and a withdrawal form that the customer cannot find before buying. Failing to provide this information is among the most common violations by online stores.

Do it today: open your store as a customer and look for the terms, the company details and the withdrawal form. How many clicks does it take?

Stop 2: the product page

Directive 2011/83/EU, Omnibus, GPSR

• The price including VAT and the delivery cost are visible; unit price where required.
• If you advertise a reduction, the previous price is the lowest one you applied in the last 30 days (Omnibus); there is no fake limited offer.
• Manufacturer details, the EU responsible person, product identification with an image, and safety warnings in the language of your customers (GPSR); an energy label where required.
• No fake reviews; you state whether and how you check that reviews are written by real customers.
• Health claims only from the approved list (Regulation (EC) 1924/2006); generic environmental claims ("eco", "green") are not allowed without proof (Directive (EU) 2024/825, applicable in the EU from 27 September 2026, subject to national transposition).

Do it today: pick three products and check every item on this list for each of them.

Stop 3: the cart and checkout

Directive 2011/83/EU, Directive 2000/31/EC, Article 11

• The final price including VAT and delivery is visible before the order is placed.
• Before placing the order there is a separate "Order review" step: the customer sees everything they entered in one place (addresses, delivery and payment method, products, quantities, prices) and can go back and correct mistakes; only then comes the order button (Directive 2000/31/EC, Article 11(2): means to identify and correct input errors before the order is placed). As our inspection example shows, being able to edit fields inside a form may not be enough.
• The order button clearly says that it means payment ("Order with obligation to pay" or another clear label).
• There are no pre-ticked extra services in the cart.
• The strikethrough price is the lowest of the last 30 days (Omnibus).
• There are no fake countdown timers or fake low-stock warnings.

An easy-to-miss mistake: a "Next" or "Order" button that does not say it is a payment, and single-page checkout with no review before placing the order. A wrongly labeled order button and the lack of a way to correct errors before ordering are common findings in inspections.

Do it today: place an order yourself in your own store and read every label from the cart to the thank-you page as if you were a judge.

Stop 4: after purchase

Directive 2011/83/EU, Directive 2002/58/EC

• The customer receives the order confirmation on a durable medium (e.g. by email).
• The right of withdrawal is explained, and the period and procedure are clear; the withdrawal button is set up as described in the section below.
• Refunds follow the legal deadlines.
• The seller's legal liability for conformity of goods (two years) is kept separate from the commercial guarantee.
• Marketing messages after purchase only with consent or under the conditions of the soft opt-in; abandoned-cart messages that contain an offer generally need consent.

Do it today: submit a test return and check when your system sends the confirmation.

Stop 5: behind the scenes

GDPR, ePrivacy, EAA, DSA, PSD2, PCI DSS, VAT, GPSR

• Contracts with data processors are signed, and transfers of data outside the EU are covered.
• Cookie consent works and can be proven.
• Accessibility has been reviewed, if the law applies to you.
• Your payment provider supports strong customer authentication (3DS2); PCI DSS is handled through the provider.
• VAT (OSS/IOSS), customs duty for small parcels and packaging obligations in the country of sale are sorted out; check with your accountant whether your national tax authority has additional requirements for invoicing or receipts.
• An AI use policy exists.
• If you have comments, reviews or a marketplace: a mechanism for reporting illegal content (DSA).
• Product liability: a new directive applies to products placed on the market after 9 December 2026 (check your supplier contracts).

Do it today: appoint a person who follows changes in the law and put the first review in the calendar.

In detail: the withdrawal button

Under EU rules (Directive (EU) 2023/2673, which inserts Article 11a into Directive 2011/83/EU), for distance contracts concluded through an online interface traders must provide a dedicated withdrawal function from 19 June 2026. The labels are prescribed: the function is labeled with the words "withdraw from contract here" or an unambiguous corresponding formulation, and the confirmation function only with the words "confirm withdrawal" or an unambiguous corresponding formulation. EU Member States have to transpose this directive into national law; transposition status and the exact national rules can differ, and we do not claim that every country has completed it. Where your national law does not yet require the function explicitly, it is still advisable to introduce it now: the European rule is clear and will not change.

This is how it looks:

1. The customer clicks Withdraw from contract here.
2. They enter their name, the order details and the email address where they want to receive the confirmation.
3. They click Confirm withdrawal. Without delay, they receive an acknowledgement with the content, date and time of the withdrawal (on a durable medium, e.g. by email).

The function must be continuously available and easy to reach throughout the withdrawal period. It applies to contracts where a right of withdrawal exists (not to types of goods exempt from withdrawal). It does not replace the information about the right of withdrawal and does not change the deadlines: refunds and returns of goods follow the usual rules. Make sure it also works for orders without a user account, that is, when the customer bought as a guest.

The first 10

The order is by risk, in line with the most common violations found in inspections.

1. The "withdraw from contract" function works (in the EU from 19 June 2026; check your national transposition).
2. The final price including VAT and delivery is visible before the order is placed.
3. The order button clearly says that it means payment.
4. There are no pre-ticked extra services in the cart.
5. The strikethrough price is the lowest of the last 30 days.
6. There are no fake countdown timers or fake limited stock.
7. The footer shows the name, registered address, registration and tax numbers, contact details and register entry.
8. The returns procedure and the withdrawal form are published.
9. Analytics and advertising scripts load only after consent.
10. The "Accept all" and "Reject all" buttons are equally prominent.

How to stay up to date

Follow the official sources: EUR-Lex for EU acts, your country's official gazette or legal information portal, and the websites of your national consumer protection authority, data protection authority and tax authority. Trade associations and chambers of commerce in your country are also useful. Appoint a person to follow changes and review all terms and procedures at least once a year. A good lawyer is part of the team. Keep in mind that transitional provisions and exemptions can change the text of laws and the dates they apply.

Table of acts

Status as of 13 October 2026. The table is meant for your lawyer or accountant; for each act, check the current text at the official source. Member States transpose directives into national law, so national rules and dates can differ.

This page is a web add-on to the book "Spletna trgovina zdaj" (2nd edition). It is for general information only and is not legal advice: consult a lawyer in your country. Related page: AI in search and shopping.