The EU Withdrawal Button Deadline Already Passed on June 19 — Why Shopify's Self-Serve Returns Don't Satisfy It, and How to Build One That Does
Since June 19, 2026, EU consumer law (Directive 2023/2673) requires stores selling to EU customers to offer a clearly visible, login-free electronic withdrawal function with a two-step confirmation and an automatic durable-medium receipt. Shopify's native self-serve returns run through Customer Accounts, which requires login — so most stores are still out of compliance without realizing it. Here's what the law actually requires and how to build a flow that meets it.
If you sell to EU customers on Shopify and haven't specifically built something for this, there's a good chance you quietly walked past a compliance deadline on June 19, 2026. That's when Directive (EU) 2023/2673 — an update to the EU Consumer Rights Directive — started requiring online stores to provide "a clearly visible electronic withdrawal function" that lets a customer exercise their right of withdrawal directly from your store, without needing to log in, dig through a policy page, or email support and wait. It's not a settings toggle Shopify quietly flips on for you. According to Shopify's own compliance documentation, Shopify automatically applies compliant policies only for orders placed through Shopify Managed Markets — everyone else has to build or configure this themselves.
This is easy to miss because nothing breaks. There's no error, no failed webhook, no admin banner demanding action. Your store keeps taking EU orders exactly as before. The gap only becomes visible if a regulator, a payment processor, or a customer's own consumer-protection complaint asks you to produce the specific mechanism the law describes — at which point "we have a returns policy page" isn't the answer they're looking for, in the same way that a footer link to your terms of sale wasn't enough evidence in the chargeback disputes we covered in our piece on proving terms-of-sale consent. The pattern repeats: EU and payment-network compliance increasingly wants a specific, timestamped, user-initiated action — not a page that technically exists somewhere on your domain.
What the law actually requires
Per Shopify's Help Center documentation on EU right-of-withdrawal compliance, the requirement breaks into three concrete parts:
- A clearly labeled, easy-to-find withdrawal function. A button or link — commonly placed on the order status page or account area — that a customer can use without hunting for it.
- A two-step confirmation process. The customer initiates the withdrawal, then confirms it with their name and the relevant order/contract details before it's treated as submitted. A single click that immediately fires the withdrawal isn't what's specified — there has to be a distinct confirm step.
- An automatic notification on a durable medium. Once withdrawal is confirmed, the store must send an automatic acknowledgment the customer can keep — email is the example Shopify's own documentation gives. A confirmation message that only flashes on screen and disappears doesn't count as durable.
Shopify's documentation is also direct about what's at stake: non-compliance risk includes fines of up to 4% of annual turnover, and courts can extend the withdrawal window itself to 12 months if the required information and mechanism weren't properly provided. This isn't a minor labeling requirement — it changes how long a customer can legally walk back a purchase if you got it wrong.
Why "we already have self-serve returns" doesn't close the gap
The most common mistake merchants make here — visible across the Shopify Community discussion of this requirement — is assuming Shopify's built-in self-serve returns feature already covers it. It doesn't, for one specific reason: Shopify's self-serve returns run through Customer Accounts, which means the customer has to sign in first. That directly conflicts with a requirement for a function customers can use without logging in.
This is the same login wall we covered from the account-migration side in our piece on the legacy customer accounts deprecation — the new accounts system is a hosted OAuth redirect, not something you can quietly bypass with a guest-friendly shortcut. If a meaningful share of your EU checkouts are guest checkouts (no account created), those customers hit a login prompt the moment they try to use your only withdrawal mechanism, which is exactly the failure mode the law is written to prevent.
Step 1: set the compliance baseline with EU market return rules
Before building anything custom, configure the actual entitlement first, in Settings → Markets → European Union, under the market's return and cancellation rules. Set the return window to at least 14 days for the EU market specifically — the statutory minimum — separate from whatever return policy you run elsewhere. This is the record Shopify checks against when a return or refund is actually processed; the withdrawal button you build in Step 2 is the front door, but this setting is what has to back it up once someone walks through.
Step 2: exclude what the law actually exempts — don't build a blanket flow
Not every order qualifies for withdrawal. Shopify's documentation lists the standard carve-outs: custom or personalized goods made to the customer's specification, goods that can spoil or expire quickly, digital content supplied with the customer's prior express consent (where they acknowledged losing the withdrawal right), and services that have already been fully performed with the customer's agreement. Tag these products at the source — a product tag like eu-withdrawal-exempt or a metafield your theme can check — so your withdrawal form can tell a customer up front that a specific line item isn't eligible, rather than accepting every request and sorting out exemptions manually after the fact.
Step 3: build a login-free, two-step withdrawal page
Add a standalone page — linked from your footer and from order confirmation emails, not buried inside the account area — using a page template your theme doesn't gate behind customer login. The two-step structure matters: step one collects the identifying details, step two shows them back for confirmation before anything submits.
{% comment %} templates/page.eu-withdrawal.liquid {% endcomment %}
{% layout 'theme' %}
Withdraw from your order
Under EU consumer law, you can cancel most orders within 14 days of delivery without giving a reason.
Confirm your withdrawal
Your withdrawal request has been recorded. A confirmation email is on its way to the address you provided.
The front-end logic renders the review step, then posts once the customer explicitly confirms — the confirm click is the second step the law requires, distinct from the initial form submission:
var step1 = document.getElementById("withdrawal-step-1");
var step2 = document.getElementById("withdrawal-step-2");
var summary = document.getElementById("withdrawal-summary");
var pendingData = null;
step1.addEventListener("submit", function (event) {
event.preventDefault();
var formData = new FormData(step1);
pendingData = {
order_number: formData.get("order_number"),
email: formData.get("email"),
full_name: formData.get("full_name"),
};
summary.textContent =
"Order " + pendingData.order_number + " for " + pendingData.full_name +
" (" + pendingData.email + ") will be marked for withdrawal.";
step1.hidden = true;
step2.hidden = false;
});
document.getElementById("withdrawal-back").addEventListener("click", function () {
step2.hidden = true;
step1.hidden = false;
});
document.getElementById("withdrawal-confirm").addEventListener("click", function () {
fetch("/apps/withdrawal/submit", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(pendingData),
}).then(function (response) {
if (response.ok) {
step2.hidden = true;
document.getElementById("withdrawal-success").hidden = false;
}
});
});Step 4: give the request a real, timestamped record — and an actual email
This is the part that's easy to underestimate. Neither Shopify's native contact form nor the free Shopify Forms app is built to look up an order by number and email, verify it, and fire a durable-medium confirmation back to that specific customer — those tools are designed for marketing signup and general inquiries, not order-linked legal notices. The /apps/withdrawal/submit endpoint in the snippet above has to be a small backend you control (a Shopify app extension, or a serverless function holding your Admin API access token — never expose that token in theme JS), whose job is to do three things: verify the order/email/name match, write a durable record onto the order, and send the confirmation.
mutation TagWithdrawalRequest($id: ID!, $tags: [String!]!) {
tagsAdd(id: $id, tags: $tags) {
userErrors {
field
message
}
}
}
# Pair with orderUpdate (or a metafield write) to store a note like:
# "EU withdrawal requested 2026-07-28T09:14:00Z by jane@example.com"The confirmation email itself is the one piece Shopify genuinely doesn't hand you for free — sending an arbitrary transactional email to a specific customer outside the built-in order/shipping notifications needs either a transactional email provider (Postmark, Resend, SendGrid, or similar) called from your backend, or a purpose-built app. Given how narrow and well-defined this one requirement is, a vetted app built specifically for EU withdrawal compliance is often the more defensible route than custom code for stores that don't already run a backend — it's less to maintain, and the vendor is the one keeping pace if the directive's implementing rules shift.
What "durable medium" means in practice
Shopify's own phrasing is that the confirmation must be sent "on a durable medium, such as email" — a format the customer can keep and refer back to, not a toast notification that vanishes on page refresh. The withdrawal-success panel in the form above is a courtesy, not the compliance artifact. The actual requirement is satisfied by the email your backend sends after the tag/note is written, referencing the order number, the date of the request, and what happens next (refund timeline, return instructions if physical goods are involved).
Setting expectations honestly
This is new enough — and enforcement patterns are early enough — that nobody can promise a specific implementation is bulletproof against every EU member state's transposition of the directive, since each country implements it into national law with some local variation. What this plan does is close the specific, documented gap Shopify itself describes: a genuinely login-free entry point, a real two-step confirmation, and a durable email record tied to the order — instead of relying on a returns flow that quietly assumes every customer has an account and is willing to log into it.
Code Kaarigari builds compliance-critical flows like this — login-free withdrawal forms, order tagging, and transactional email wiring — for Shopify stores selling into the EU. Start with our Shopify development services, or contact Code Kaarigari for an EU withdrawal compliance audit against your own store's checkout and returns setup.