Online withdrawal button in Poland: what must e-commerce businesses prepare and when?

Is the withdrawal button already mandatory for Polish online shops?

Directive (EU) 2023/2673 amended the Consumer Rights Directive 2011/83/EU. Member States were required to adopt implementing legislation by 19 December 2025 and apply it from 19 June 2026. Poland intended to implement the withdrawal function through draft legislation known as UC82, which included amendments to the Polish Consumer Rights Act. Following a decision by the Prime Minister on 18 May 2026, the draft was withdrawn from the Legal Commission process. At the time of this update, no replacement national measure implementing this part of the directive had been identified and no provisions establishing the new duty had been promulgated.

The distinction matters. A directive binds Member States as to the result to be achieved, but as a rule it cannot of itself impose obligations on a private trader in a dispute with another private person. It is therefore inaccurate to say that every online shop operating solely in Poland has breached Polish law since 19 June 2026 merely because it lacks the new function.

This does not justify indefinite inaction. Poland remains required to implement the directive, and the EU-level design is already known. Implementation will usually require changes to the interface, order-management system, automated communications, terms and customer-service process. Work begun only after the Polish act is promulgated may be difficult to complete before its effective date.

When may the law of another EU country apply?

A Polish business may direct its activities to consumers in another country by using a local domain or language, running market-specific advertising, offering local delivery or payment methods or regularly fulfilling orders there. In that model, a Polish governing-law clause cannot deprive a consumer of mandatory protection available under the law of the consumer’s habitual residence if the conditions in Article 6 of Rome I are met.

The seller should therefore check whether each target Member State has implemented Article 11a of Directive 2011/83/EU, when the local rule became applicable and what enforcement framework it uses. A single EU-facing interface may need to comply with the most demanding relevant variant or correctly differentiate the process by market.

Mere technical accessibility from another country does not necessarily mean that the business directs activities there. The assessment depends on the complete sales, marketing and fulfilment model. Businesses with material cross-border sales should document the analysis instead of relying solely on the seller’s place of establishment.

What should the online withdrawal function do?

The directive does not prescribe one identical visual element for every business. It requires a function labelled clearly with the words “withdraw from contract here” or an equivalent unambiguous expression. It must be prominent, easily accessible and continuously available throughout the applicable withdrawal period.

After activating the function, the consumer should be able to provide or confirm their name, details identifying the contract from which they wish to withdraw and details of the electronic means to which the acknowledgement should be sent.

The interface should then require the consumer to confirm the decision deliberately. The final function must be labelled “confirm withdrawal” or with an equally unambiguous expression. This two-step design protects the consumer against an accidental declaration and the trader against disputes over the user’s intention.

After confirmation, the trader should send an acknowledgement on a durable medium — normally by email — without undue delay. It should include the content of the declaration and the date and time of submission. The system should also retain reliable evidence that the process operated correctly.

Must the function be available without a customer account?

The duty is linked to the way the contract was concluded, not to whether the consumer created an account. If a shop permits guest checkout, it needs a workable route for those customers. This might use a secure link in a transactional email or a form based on an order number and proportionate additional verification.

The directive emphasises accessibility and ease of use. Requiring a consumer to create an account after purchase, call a helpline or search for a PDF in the terms would be difficult to reconcile with that objective. At the same time, the function should prevent an unauthorised person from withdrawing from someone else’s contract. The verification method should therefore be secure without becoming an artificial obstacle.

A process should not rely exclusively on a logged-in dashboard where some customers purchase without an account or may lose access later. Testing should cover desktop, mobile, app, account and guest-checkout journeys.

Which contracts are covered?

The function is intended for distance contracts concluded through an online interface where the consumer has a statutory withdrawal right. It is not limited to physical goods. Depending on the model and the conditions for retaining or losing the right, it may also cover services, subscriptions, digital content and digital services.

The mechanism does not create a withdrawal right where legislation provides an exception. Bespoke goods, perishable products, certain sealed products, fully performed services and digital content supplied under particular conditions require separate analysis. A shop should not automatically hide the function merely because a product falls into a general category: it must verify whether every condition for the exception has been met.

Withdrawal must also be distinguished from returning goods. The declaration terminates the contract under the statutory regime, but the parties still need to deal with return logistics, return costs, reimbursement deadlines and any diminished value. The function does not replace a lack-of-conformity complaint or a voluntary commercial returns policy.

What must change beyond the interface?

The project should begin by mapping the process from submission to closure. A button that sends a message to an unmonitored inbox is not a compliant implementation. The business must decide how the system will identify the order, record the time, flag the case, stop relevant fulfilment steps and trigger further handling.

The change should be combined with a broader review of the sales journey described in the legal checklist for an online shop in Poland. If the form or communications change the processing of personal data, the relevant records, notices and suppliers should also be reviewed as part of a GDPR audit.

• The terms and withdrawal information, including information about the existence and location of the function
• The customer dashboard, order page, app and transactional emails
• The durable-medium acknowledgement template
• The reimbursement, delivery-cost and physical-return workflow
• The handling of exceptions and contracts containing several supplies
• Log retention, staff permissions and personal-data security
• Customer-service instructions and escalation of non-standard cases

What risks arise from a defective implementation?

Once Polish implementing legislation takes effect, a missing or merely cosmetic function may breach consumer-law duties and expose the trader to consumer-protection enforcement. The final sanctions must be assessed under the enacted Polish legislation rather than an earlier draft.

Existing law may already be engaged where a seller obstructs the statutory withdrawal process, provides incorrect information or uses a manipulative interface. The new function will not cure defects in the current process.

Operational risks matter too. A poorly integrated form may cause duplicate reimbursements, incorrect refund amounts, dispatch after effective withdrawal, loss of evidence or disclosure of order data to a third party. The design should therefore combine legal analysis, user experience, security and order-system integration.