The shop is built, the products are loaded and test payments have gone through. The day before launch, someone asks: do our terms reflect the current cancellation rules, are the "was" prices compliant, do we need consent for the basket reminder emails, and what has changed this year? Nobody around the table can answer with confidence.
This guide brings together the obligations an online shop selling to consumers in the UK and the EU runs into: which rules apply, the business information your site must show, the ordering process and order button, cancellation rights and the new EU withdrawal function, pricing, discounts and reviews, data protection and marketing consent, product safety, accessibility, packaging and VAT. It ends with a single checklist table.
Which rules apply to you?
There is no single e-commerce law. For a business selling to consumers, the framework has three layers: rules on online services and information, consumer protection rules, and the rules on data, product safety and tax that apply to every business.
In the EU, the core consumer rules are the Consumer Rights Directive, the Unfair Commercial Practices Directive and the Price Indication Directive, all amended by the 2019 Omnibus Directive, plus the e-Commerce Directive's information requirements, the GDPR and the ePrivacy rules on cookies and marketing. Each member state implements the directives in its own law, so wording and enforcement differ. If you actively target consumers in another EU country, its consumer law generally protects them even if your terms choose a different law.
In the UK, the equivalents are the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, the Consumer Rights Act 2015, the Electronic Commerce Regulations 2002, UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 has also given the CMA power to enforce consumer law directly and to fine businesses up to 10% of global turnover.
Most of these rules protect consumers only. If you sell exclusively to businesses, much of what follows does not apply, but you must then be able to show that your customers really are businesses.
Business information your website must show
Customers have to be able to see who they are dealing with. In the UK, the Electronic Commerce Regulations 2002 require your name, geographic address, email address, company registration number and VAT number, among other details, to be easily, directly and permanently accessible. Limited companies must also show their registered name, number, registered office and place of registration under the company disclosure rules. In the EU, the e-Commerce Directive sets out a similar list, which member states have implemented in their own law; Germany's Impressum is the best-known example.
Put these details on a dedicated page linked from the footer of every page, not only inside your terms. A geographic address means a real address; a PO box alone is not enough.
One thing you can now remove: the link to the EU's online dispute resolution platform. The platform closed on 20 July 2025 and the obligation to link to it ended with it. If your national law requires information about alternative dispute resolution, that requirement still stands.
Ordering: pre-contract information and the order button
Before a consumer is bound by an order, they must receive clear pre-contract information: the main characteristics of the goods, your identity and contact details, the total price including taxes and delivery charges, payment and delivery arrangements, the conditions of the right to cancel and how complaints are handled. Much of it can sit on the product page and in the checkout summary, but it has to be there before the final click.
The final button has to make clear that clicking it means paying. Both EU and UK rules use the formulation "order with obligation to pay" or an equally unambiguous phrase, such as "Buy now" or "Pay now". "Continue", "Submit" or "Confirm" do not meet that standard. Extra paid options need the consumer's express consent; pre-ticked boxes for gift wrap, insurance or donations are not allowed, and payments taken that way have to be refunded.
The process itself has technical requirements too. Customers must be able to spot and correct input errors before ordering, you must acknowledge the order electronically without undue delay, and the contract terms must be available in a form they can store. After the sale, send confirmation of the contract on a durable medium, in practice an email containing the terms and the pre-contract information. Unless you agree another date, goods must be delivered without undue delay and within 30 days.
Cancellation rights and the EU withdrawal function
For most goods bought online, consumers in the EU and UK can cancel within 14 days of delivery without giving a reason; for services, the period usually runs from the contract date. If you fail to give proper cancellation information, the period is extended by up to 12 months. After cancellation, you must refund the payment, including standard outbound delivery, within 14 days. For goods, you may wait until they come back or the customer provides evidence of return. You may deduct for any loss in value caused by handling beyond what was needed to inspect them.
Returns costs are the consumer's to bear only if you told them so beforehand; if you did not, you pay. Exceptions to the right to cancel are listed in the legislation and include goods made to the customer's specifications, perishable goods, sealed hygiene products once unsealed, sealed audio, video and software once unsealed, and digital content once supply has started with the consumer's consent and acknowledgement. State the exception on the relevant product page.
The biggest change of 2026 applies in the EU. Since 19 June 2026, traders who conclude contracts with consumers through a website or app must provide an online withdrawal function: a clearly labelled button or similar function, along the lines of "withdraw from contract here", followed by a confirmation step. It must be easy to find and available throughout the withdrawal period, and you must acknowledge receipt on a durable medium without undue delay. Member states have implemented this in their own law, sometimes with prescribed wording, so check the rules of each country you sell into. The UK has no equivalent requirement.
Prices, discounts and reviews
Prices shown to consumers must be total prices including VAT and all unavoidable charges. In the UK, the DMCC Act made this sharper: mandatory fees cannot be dripped in later, and the CMA has published guidance on how it treats delivery and other charges. Products sold by weight or volume generally need a unit price as well.
Discount claims are where the EU and UK differ. In the EU, every announcement of a price reduction must show the prior price, meaning the lowest price you charged in the 30 days before the reduction. The Court of Justice confirmed in September 2024, in a case against the German discounter Aldi Süd, that percentage reductions and "price highlight" claims must also be calculated from that 30-day low; printing the lowest price somewhere in small print is not enough.
The UK has no fixed 30-day rule. Instead, a "was" price is judged on whether it is genuine and does not mislead, and the CMA's enforcement work suggests the higher price must have been the real selling price for a meaningful period. The government announced in 2026 that it would consult on tighter rules for misleading discounts and inflated reference prices, so watch for changes.
Reviews are regulated in both markets. In the EU, if you display consumer reviews you must say whether and how you check that they come from customers who actually bought or used the product, and fake reviews are banned. In the UK, the DMCC Act added fake reviews and concealed incentivised reviews to the list of practices that are banned outright, and the CMA expects businesses to take reasonable steps to prevent and remove them. A review widget that publishes anything, from anyone, is a liability.
Data protection, cookies and marketing emails
Processing a customer's name, address and payment details to fulfil an order needs no consent, but it does need a clear privacy notice, linked from every form that collects personal data. Marketing is different and is governed by the e-privacy rules on top of GDPR.
For cookies and similar technologies, the EU rule is consent before anything that is not strictly necessary runs, and that includes analytics and advertising tags. Make "Reject" as easy as "Accept" and record each choice. In the UK, the Data (Use and Access) Act 2025 changed PECR: since February 2026 certain low-risk cookies, including some used only for the site's own statistics, can run without prior consent if users are told and given a simple way to object. Advertising and cross-site tracking still need consent, and PECR fines are now aligned with UK GDPR levels. Read the ICO's guidance before relying on the exemption.
For email marketing, both regimes start from consent. The UK and EU both allow a soft opt-in for existing customers: you may email people whose details you collected during a sale about your own similar products, provided you offered a clear opt-out when you collected the address and in every message. Some EU countries read this exception narrowly, and in Germany basket reminders without consent are widely regarded as unlawful. Use an unticked box for marketing consent, keep it separate from accepting the terms and store proof of every opt-in.
If your tools send personal data outside the UK or EEA, as many analytics, email and support platforms do, check the transfer mechanism. For the US, that usually means a provider certified under the EU-US Data Privacy Framework and its UK extension, or standard contractual clauses.
Product safety, accessibility, packaging and VAT
Since 13 December 2024 the EU General Product Safety Regulation has required online listings to show the manufacturer's name and postal and electronic address, a product identifier, any warnings and safety information in the local language, and, if the manufacturer is outside the EU, the details of a responsible person established in the EU. It also applies in Northern Ireland; Great Britain has its own product safety regime.
The European Accessibility Act has applied to e-commerce services provided to consumers in the EU since 28 June 2025. In practice that means a site built to WCAG 2.1 AA or 2.2 AA standards, with an accessibility statement. Micro-enterprises providing services are exempt, but your checkout is still the first place an inaccessible shop loses customers.
Packaging and electrical goods come with producer obligations. In the EU, the Packaging and Packaging Waste Regulation has applied since 12 August 2026 alongside national schemes, and countries such as Germany require registration before you sell packaged goods there, even if you ship from abroad. The UK runs its own packaging extended producer responsibility scheme. Electrical and electronic equipment and batteries have separate national registration and take-back rules.
On VAT, cross-border sales to consumers in other EU countries are taxed in the customer's country once you exceed the EU-wide distance sales threshold, and the One-Stop Shop lets you report that VAT in a single return. Goods imported into the EU in low-value consignments can use the Import One-Stop Shop. In the UK, the VAT rules for goods sold to consumers from overseas differ again. These are the questions to settle with your accountant before you open a new market.
Obligations at a glance
The table below summarises the main obligations for a business selling to consumers through its own website in the UK or EU. Your size, sector and products may add more.
| Obligation | When it applies | Where it is shown |
|---|---|---|
| Business information | Always, accessible before any contract | Contact or legal information page linked from every footer |
| Pre-contract information | Every consumer order, before the final click | Product page, checkout summary and terms |
| Order button wording | Every order that creates a payment obligation | Final checkout button, such as "Pay now" |
| Order acknowledgement and confirmation | After every order, without undue delay | Confirmation page and email with terms attached |
| Cancellation rights | Every consumer sale; exceptions by product | Pre-contract information, returns page, product page for exceptions |
| EU withdrawal function | Since 19 June 2026, online contracts with EU consumers that carry a withdrawal right | Clearly labelled function available throughout the withdrawal period |
| Prior price on discounts | EU: every price reduction, lowest price in the previous 30 days | Product and category pages, next to the reduced price |
| Review verification | Whenever you publish consumer reviews | Near the reviews, explaining how they are checked |
| Cookie consent | Before any non-essential cookie runs; UK exemptions since 2026 | Banner on first visit, preferences link afterwards |
| Marketing consent | Before any marketing email or text outside the soft opt-in | Unticked box at sign-up or checkout, unsubscribe in every message |
| Product safety information | EU and Northern Ireland, every product listing | Product page |
| Accessibility | EU consumer e-commerce since 28 June 2025 | Whole site, plus accessibility statement |
Where to start
Do not try to fix everything in a week. Close the gaps with the highest risk first.
- Check your business information page against the UK or EU list and remove any link to the closed EU ODR platform.
- Walk through checkout and check the pre-contract information, order button wording and the absence of pre-ticked paid extras.
- Make sure confirmations, terms and cancellation information are generated per order and sent by email.
- If you sell to EU consumers, confirm that the withdrawal function is live and meets the rules of each country you sell into.
- Test that your shop stores price history and calculates EU discount claims from the 30-day low.
- Review how reviews are collected and checked, and remove anything you cannot verify.
- Separate privacy notice, terms acceptance and marketing consent; set the cookie banner so non-essential tags wait for consent.
- Check product pages for GPSR information, run an accessibility audit, and review packaging, electrical goods and VAT obligations with your advisers for each market.
At AYTE Digital we build the technical side of these obligations rather than their legal content: dynamic order confirmations and terms, price history, review verification, the EU withdrawal function, cookie consent and accessible checkouts. Once your legal adviser has settled the wording, we can make sure it appears in the right place at the right moment.
