Penalties and enforcement: what a missing or faulty withdrawal function costs

The withdrawal function is not a formality: whether it exists can be checked from the outside, from any product page, without a test purchase. What follows a breach depends heavily on the country.

Last reviewed: August 2026 · Guide

Enforcement styles differ by country

The EU sets the obligation; the sanction is national. Two styles dominate, and a store selling across borders is usually exposed to both.

Germany: warnings, fines, a longer period

Consumer-protection provisions such as § 356a BGB count as rules of market conduct. Breaching them invites cease-and-desist warnings (Abmahnungen) from competitors and qualified associations, with a declaration to cease and reimbursement of costs. Values in dispute for competition-law warnings are, by experience, between €1,500 and €10,000; the legal fees follow from that and are usually borne by the recipient. On top comes the penalty-backed undertaking: whoever signs one and breaches again pays a contractual penalty.

Separately, the law provides for fines of up to €50,000. Unlike a warning, a fine presupposes official proceedings – it is the escalation, not the standard case.

France: administrative fines from the DGCCRF

France works through public enforcement. The DGCCRF supervises compliance and can impose administrative fines of up to €15,000 for a natural person and €75,000 for a legal person (art. L242-13 Code de la consommation). French law also names a labelling example for the button and requires the two-step flow with a confirmation step.

Other member states

Sanctions elsewhere follow the same two patterns – public enforcement by a consumer authority, private enforcement by competitors and associations – but the maximum amounts and the competent bodies differ considerably, and several member states had not notified a transposition measure at all as of August 2026. We deliberately do not quote figures for those countries here: a wrong number in a compliance text is worse than no number. If a specific market matters to you, that belongs in a local legal review. The country-by-country overview sets out what is documented.

Who enforces – the difference that matters most

The amounts catch the eye; who imposes them matters more, and that is where Germany stands apart.

Germany relies largely on private enforcement: competitors and qualified consumer associations hold an injunction claim, which is where the cease-and-desist letter comes from. There is no general consumer authority for this field.

Most other member states use an authority instead, often one that covers consumer protection and competition together — the DGCCRF in France, the AGCM in Italy, the ACM in the Netherlands. Directive (EU) 2019/2161 strengthened that administrative model across the Union.

In practice: in Germany a competitor's lawyer writes to you, elsewhere an authority opens a case. Sell across a border and both can reach you — authorities cooperate through the CPC network (Regulation (EU) 2017/2394).

Which authority is competent for the withdrawal function specifically, we have not researched per state. The three named above are documented, the others are not.

The quiet one: the extended withdrawal period

Often the most expensive consequence is the least visible. If the withdrawal option does not work correctly, the withdrawal period extends to up to 12 months and 14 days – in Germany under § 356 (3) BGB, and in the EU generally under art. 10 of Directive 2011/83/EU where the information duty was not met. Customers can then still withdraw nearly a year after receiving the goods, with everything that implies for reversal, used stock and accounting. This risk runs silently, on every single order.

If a warning has already arrived

• Do not ignore it: the deadlines set are short and meant seriously.
• Do not sign unchecked: pre-drafted undertakings are often drawn wider than necessary – have them reviewed and, where appropriate, submit a modified version.
• Fix the defect in parallel: retrofitting the function does not, in itself, remove the legal risk of repetition, but it is the precondition for no further breaches accruing.

Prevention has become trivial

Measured against the exposure, the remedy is remarkably small: for Shopify stores the complete function – button, form, acknowledgement – can be set up in minutes without code, free of charge and without a time limit.