Note: This article is for information only and does not constitute legal advice. For a legally binding assessment, please consult a licensed attorney.
TL;DR
- From 19 June 2026, every German B2C Shopify store must provide a withdrawal button per § 356a BGB — no transition period.
- Setup involves five building blocks: button placement, correct labelling, a two-step flow, limited mandatory fields, an automatic acknowledgment on a durable medium.
- The button must be reachable from every subpage, not only inside a customer account, and must work for guest orders.
- Manual theme solutions are error-prone; a vetted app like Retractly implements every requirement out of the box.
Why every Shopify store must act in 2026
The implementing act (BGBl. 2026 I No. 28, published 5 February 2026) brings the new § 356a BGB into force on 19 June 2026. The legal basis is EU Directive 2023/2673, which amends the Consumer Rights Directive 2011/83/EU.
Important: the new § 356a BGB replaces the previous provision (timeshare contracts). Outdated legal databases still show the old text — the withdrawal-button version only applies from the cut-off date.
Non-compliance risks cease-and-desist warnings, fines (per law firms up to €50,000 or up to 4% of annual turnover) and an extension of the withdrawal deadline to 12 months + 14 days. See Avoiding withdrawal-rights warnings.
Step 1: Check whether you are affected
The button is mandatory if you conclude distance contracts with consumers via an online user interface — regardless of size, revenue or legal form. Financial services are also covered (unlike the cancellation button, see § 356a vs. § 312k).
Exempt: pure B2B stores and goods with a statutorily excluded right of withdrawal (e.g. hygiene items after unsealing, personalised goods — see Exceptions per § 312g BGB). Note: for mixed assortments the obligation remains as soon as at least one withdrawable product is offered.
Step 2: Place the button correctly
§ 356a (1) BGB requires the withdrawal function to be "permanently available, prominently placed and easily accessible" — throughout the entire withdrawal period.
Practical implementation in Shopify:
- Reachable from every subpage — in practice a footer link (permitted per the explanatory memorandum) that stands out from imprint and T&Cs via colour/contrast.
- Not hidden exclusively inside the customer account. A login solution is only permitted if the contract itself can only be concluded with an account.
- Functional for guest orders and on mobile — Shopify themes often hide footer links on small screens; that is not permitted here.
Step 3: Build the two-step flow
The law mandates a two-step procedure:
- Step 1 — withdrawal button: labelled "Vertrag widerrufen" (withdraw contract) or an equivalent, unambiguous wording. Ambiguous terms like "cancel" or "contact" are not allowed.
- Step 2 — confirmation page: the consumer enters the mandatory data and clicks a "Widerruf bestätigen" (confirm withdrawal) button.
A simple mailto: link does not satisfy this — you need an interactive form flow with verifiable receipt.
Step 4: Limit mandatory fields correctly
§ 356a (2) BGB names the data that may be requested exhaustively:
- the consumer's name
- the contract/order identification
- an electronic means of communication for the acknowledgment (email)
The reason for withdrawal must never be a mandatory field. Forcing a reason restricts the right of withdrawal and is subject to warning. Optional is fine — mandatory is not.
Step 5: Acknowledgment on a durable medium
Per § 356a (4) BGB the trader must immediately send a confirmation on a durable medium containing at least the content of the withdrawal declaration plus the date and time of receipt.
The automatic confirmation email satisfies this (it is a durable medium within the meaning of Art. 11(3) of EU Directive 2011/83). A separate PDF is not legally required.
Critical: the confirmation may only document receipt, not material validity. Wording like "your withdrawal has been approved" is risky — better to note that a review of validity and scope is still pending.
Step 6: Adjust your legal texts
Beyond the technical side, update your legal texts:
- Withdrawal instructions: extended with a reference to the button, its internet address and the automatic acknowledgment.
- Privacy policy: documents the data processing via the withdrawal button (legal basis Art. 6(1)(c) GDPR in conjunction with § 356a BGB).
Have these texts reviewed by a lawyer — an app provides the technology, not individual legal advice.
Build manually or use an app?
The flow can be coded in-house. The risk lies in the many detailed requirements: exact labelling, placement, guest access, mandatory-field limits, durable medium, 24 EU official languages for cross-border, a complete audit trail as burden of proof. Each is its own warning risk. See Build vs. app.
Retractly implements these out of the box: menu link on onboarding (no theme code), login-free customer portal, statutory labels, automatic acknowledgment as a durable medium in 24 EU official languages, and an admin dashboard with audit log. There is a permanently free plan with unlimited withdrawals.
FAQ
Is a "contact" form enough? No. The button must be explicitly labelled as the withdrawal function and trigger the two-step flow.
May the button live only in the customer account? No, unless the contract can only be concluded with an account. Guest orders must be able to use the function.
Do I need to generate a PDF? No. The acknowledgment by email is sufficient as a durable medium (Art. 11(3) Directive 2011/83).
Does this apply to foreign stores? Yes — market-location principle. Anyone selling to German consumers needs the button. More: EU withdrawal rights & 24 languages.
Is there a transition period? No. From 19 June 2026 the obligation is fully effective.
Further reading:
- Retractly — EU withdrawal button for Shopify
- § 356a BGB: the withdrawal button from 19 June 2026
- Withdrawal button checklist 2026: 12 points
- Withdrawal button ≠ cancellation button (§ 356a vs. § 312k)
Primary legal sources: § 355 BGB · § 356 BGB · § 312k BGB · EU Directive 2023/2673