On 19 June, § 356a of the German Civil Code came into force. Any site where a consumer can enter into a contract must now carry a “Vertrag widerrufen” button — prominent, legible, and reachable without logging in. There was no grace period: the implementing act was published on 5 February, and the date came straight from the directive. This rule has no small-business exemption at all — not by turnover, not by headcount.
If you are reading this at the end of July and you have no such button, you have been in breach for six weeks.
What the law actually demands
The provision is short and unusually specific. It is not “provide a reasonable means” — it is a list with prescribed wording.
The button. Labelled “Vertrag widerrufen” or an equivalent phrase. Placed prominently, easily legible, permanently available throughout the withdrawal period.
The form. Clicking it opens a form where the customer enters their name, details identifying the contract, and an electronic address for the confirmation.
The second button. The form ends with a “Widerruf bestätigen” button or equivalent. One click is not enough: the law describes a two-step flow.
The acknowledgement. Immediately after submission the consumer receives, on a durable medium, confirmation of receipt — including the content of the declaration, the date and the time.
A withdrawal counts as submitted on time if it was sent through this function before the deadline expires. Not when you read it, not when you processed it — when the person pressed the button.
One detail people miss: the button has to work without a login. You may place it behind an account only where the contract itself requires one — access to a course platform, for instance. In every other case, “log in to cancel” is a breach.
Who this applies to
Anyone who lets a consumer conclude a distance contract through an online interface: a website, an app, a marketplace listing. Goods, services, digital products, financial services — unlike the cancellation button, § 356a carves out no exception for financial services.
Turnover, headcount and small-business status are irrelevant. That is the sharp contrast with the accessibility law, where a micro-enterprise exemption does exist and takes roughly half of readers out of scope. This one takes nobody out of scope.
If you are outside Germany, the question is not where your company or your server sits. What matters is whether you direct your offering at consumers in the EU. A UK, US or Ukrainian business selling a subscription to customers in Germany is inside the rule; a German company selling only to businesses is outside it.
Who this does not apply to
Contracts with no right of withdrawal. There are not many, and the list is closed: goods made to your customer’s specification, perishables, sealed hygiene products once opened, and digital content whose delivery began with the consumer’s express consent and their acknowledgement that the withdrawal right is thereby lost.
That last one looks like a lifeline for online courses. It is not. To rely on it you must obtain both confirmations before access starts, and be able to produce them later. If there was no checkbox, or it was pre-ticked, the withdrawal right survives — and so does the obligation to give people a button.
B2B is outside the rule. But if you sell to both businesses and consumers from the same page, draw the line carefully: what counts is how the offer reads, not what you intended.
Now the second button
People confuse it with the first one constantly, and they are different things with different start dates.
The Kündigungsbutton, § 312k of the Civil Code — the cancellation button. In force since 1 July 2022, so four years now. Required for ongoing obligations entered into online: subscriptions, memberships, platform access, recurring deliveries. Labelled “Verträge hier kündigen”.
In May 2025 the Federal Court of Justice widened its reach considerably. It confirmed that an ongoing obligation does not require recurring payments: a single payment for a year of access is still an ongoing contract. A course you sell for one fee with twelve months of access needs the cancellation button.
And here is the sting. Section 6 of § 312k: if the button is missing, the consumer may terminate at any moment without observing any notice period. Not next month, not at the end of the paid term — today. That is not a fine, it is a built-in consequence, and it operates on its own without any court.
Why courses and subscriptions need both
The buttons cover different situations, and neither substitutes for the other.
- Withdrawal is the fourteen days after the contract is concluded. The customer changed their mind, the contract is unwound, the money goes back.
- Cancellation ends the contract going forward. The customer used it for six months and no longer wants it.
An online school selling annual access falls under both. A subscription service falls under both. A shop selling one-off goods with no subscription falls under the first only. A consultant who signs contracts by email rather than through the site falls under neither — right up until the day an order form appears on that site.
What happens if the buttons are missing
First, an Abmahnung — a formal cease-and-desist letter from a lawyer, sent by competitors and by consumer associations alike. Second, a stretched withdrawal period: lawyers broadly agree that defective information about the right of withdrawal extends it to twelve months and fourteen days. Third, cancellation on any given day, as above.
How common is the failure? The German consumer association vzbv surveyed around three thousand sites in 2023 and found that only forty-two per cent met the requirements for the cancellation button — a rule that had been in force for a year by then.
There is an extra complication for cross-border sellers. The European Commission has opened infringement proceedings against twenty-one member states that missed the transposition deadline at the end of 2025. While the countries catch up, the rules arrive unevenly, and the country that matters is the consumer’s, not your server’s.
A ten-minute self-check
- Open your own site in a private window, without logging in.
- Find the withdrawal button. Not a line in the terms, not a paragraph in the policy — a button.
- Check that it appears on every page, not just the home page.
- Click it. A form should open with fields for name, contract identification and email.
- Submit a test withdrawal. The acknowledgement must arrive at once and carry the date and time.
- If you sell subscriptions or timed access, find the second button, for cancellation.
- Make sure the confirmation page carries nothing else: no “stay with us” discounts, no surveys, no offers to pause the subscription.
If a single step failed, you have work to do this week.
No button? Write to me today. I install both, with the form, the automatic acknowledgement and the enquiry logged into your CRM so withdrawals do not get lost in an inbox. It is usually a day’s work. Six weeks past the deadline is already enough reason not to wait for the first letter from a lawyer.
If you run a shop or a subscription platform, have a look at the Growth website service: the legally required elements are part of the build, so there is nothing to bolt on afterwards. And if you would rather first understand what else on your site could attract attention, start with the seven small things that get you a letter in Germany.
This is technical preparation of a website, not legal advice. For how the rules apply to your particular case, talk to a lawyer.
Sources
- § 356a BGB — Elektronische Widerrufsfunktion, official text
- Directive (EU) 2023/2673 — Article 11a of the Consumer Rights Directive
- Noerr: the German implementing act, in force 19 June 2026
- Noerr: Federal Court of Justice, 22 May 2025, I ZR 161/24 — cancellation button with a one-off payment
- Bird & Bird: § 312k BGB — overview of the case law
Checked on 27 July 2026.