In brief. The Directive 2023/2673 fines are imposed by each country's consumer authority, not by Brussels: they run from a few thousand euros up to €1,000,000 in Spain, €75,000 in France or €10 million in Italy. The famous 4% of annual turnover is the European cap reserved for coordinated cross-border infringements, not the everyday fine of a small store. And there is an automatic sanction almost nobody mentions: the withdrawal period jumps from 14 days to 12 months.
From 19 June 2026, Directive (EU) 2023/2673 requires online stores selling to European Union consumers to display a clearly identified withdrawal button (the new Article 11a). There is no grace period. The question every merchant asks is a logical one: if I don't comply, what fine do I really risk? The short answer is that there are two layers — the European one and the national one — and that the figure most people cite (the 4%) is almost never the one that will actually be applied to you. We walk you through the penalty framework country by country, with amounts and a real case, without inventing figures.
What fines does Directive (EU) 2023/2673 set out?
The Directive does not fix specific amounts: it requires each Member State to have penalties that are "effective, proportionate and dissuasive". The amounts are set by each country's national law. The only thing the European rules do harmonise is a maximum cap for the most serious cases.
That cap sits in Article 24 of Directive 2011/83/EU, amended by the Omnibus Directive (EU) 2019/2161. It states that, for "widespread infringements with a Union dimension", the maximum fine must be at least 4% of the trader's annual turnover in the Member States concerned, or at least €2 million where that turnover is unknown.
The nuance is decisive and almost nobody gets it right: a "widespread infringement with a Union dimension" is a case pursued in a coordinated way by the authorities of several countries at once, through the European cooperation regulation (CPC). It is the scenario of a large platform breaching the rules across half of Europe, not that of a fashion store with 200 orders a month. For national infringements — the normal case — your country's penalty scale applies.
The sanction almost nobody mentions: 14 days become 12 months
Before talking about fines, it helps to understand the most likely consequence of not complying, and it is not a fine: it is automatic and needs no authority. If you fail to properly inform the consumer of their withdrawal right, the 14-day period is extended to 12 months (12 months and 14 days from delivery). This is set by Article 10 of Directive 2011/83/EU, transposed in each country; the missing button (Article 11a) is sanctioned separately.
Translated to your bottom line: for an entire year, any customer can withdraw from their purchase and demand a full refund, even if the product has been sitting in their home for months. There is no need for the DGCCRF or the AGCM to inspect you; it is enough for a customer to know their right. For many small stores, this "silent tax" on sales weighs more than the risk of a formal fine. It is also the reason why getting the button right from day one is an economic decision, not just a legal one.
Penalty framework by country: Spain, France, Germany, Italy and Portugal
Each country applies its own scale. This table sums up the five jurisdictions most relevant to a store selling to the EU (amounts from the rules in force, captured in July 2026; always check your country's official source):
| Country | Authority imposing the penalty | Fine for a national infringement | EU cap (cross-border infringement) |
|---|---|---|---|
| Spain | Regional governments + Directorate-General for Consumer Affairs | Minor ≤ €10,000 · serious ≤ €100,000 · very serious ≤ €1,000,000 | 4% of turnover / €2M |
| France | DGCCRF | Up to €15,000 (individual) / €75,000 (company) | 4% of turnover / €2M |
| Germany | Courts/competitors via Abmahnung | Abmahnung (cease-and-desist) only + costs / possible court order | ≤ €50,000, or 4% / €2M with Union dimension (Art. 246e EGBGB, widespread infringements only) |
| Italy | AGCM | From €5,000 to €10,000,000 | Up to 4% (Union dimension) |
| Portugal | ASAE | Serious infringement (art. 31 DL 24/2014), fined under the RJCE: €1,700 – €24,000 (legal person) | 4% of turnover / €2M |
Spain: up to a million, and it's your regional government that levies it
In Spain, consumer infringements are penalised under Articles 49 to 51 of Royal Legislative Decree 1/2007 (TRLGDCU), reformed in 2021-2022. The scale is: minor from €150 to €10,000, serious from €10,001 to €100,000 and very serious from €100,001 to €1,000,000. On top of that, the fine can be raised to between 2 and 8 times the unlawful gain obtained. Breaching the information duties and the withdrawal right falls, depending on the severity and its scope, within the range of serious infringements.
An important detail: in Spain it is above all your regional government that penalises, each with its own consumer law and its own nuances; the state Directorate-General for Consumer Affairs steps in when the harm affects several regions at once. To calibrate the fine, they look at the number of consumers affected, the duration, the intent and your economic capacity.
⚠️ Freshness note: Spain has not yet published in the BOE the specific transposition of the Article 11a button. The obligation still applies on 19 June 2026; in the meantime, the rules in force (TRLGDCU) and consistent interpretation are cited. We will update this guide when the final text is published.
France: the DGCCRF's amende administrative
France has already transposed the rule (Ordonnance n° 2026-2). Article L242-13 of the Code de la consommation penalises any breach of the conditions of the withdrawal right — now including the online withdrawal (rétractation) function — with an amende administrative of up to €15,000 (individual) and €75,000 (legal person). The DGCCRF usually starts with a formal notice (mise en demeure): if you put things right in time, there is no fine.
Germany: the real risk is the Abmahnung
Germany is the special case. The administrative penalty route (Art. 246e EGBGB) only applies to widespread infringements: up to €50,000 and, where they have a Union dimension, up to 4% of turnover or €2 million. For an isolated, local breach there is no administrative fine: the risk is the Abmahnung, the cease-and-desist notice that competitors or consumer associations can send you, with their legal costs and a possible court order. In Germany, a visible breach of the button exposes you to this mechanism from minute one.
Italy: the AGCM and fines of up to €10 million
Italy has also transposed the rule (Article 54-bis of the Codice del Consumo). The AGCM can impose penalties from €5,000 to €10,000,000, and up to 4% of turnover in cases with a European dimension. This is not theoretical: in January 2026, the AGCM fined a large travel operator €9 million for dark patterns in subscriptions, of which €3 million were specifically for obstructing recesso (we look at it below).
Portugal: the ASAE's contraordenações
In Portugal, Decree-Law 24/2014 governs the right of livre resolução, and the ASAE handles the contraordenações. The information and free-withdrawal duties (arts. 4 and 10) are classed as a serious infringement (art. 31) and their amounts are set by the Regime Jurídico das Contraordenações Económicas (RJCE, Decree-Law 9/2021): for a legal person, the fine for a serious infringement runs from €1,700 to €24,000 (the RJCE general ceiling of €90,000 is reserved for very serious infringements by large companies). As in the rest of the EU, if you fail to inform of the right, the period is extended to 12 months.
How much does a small store really risk?
Let's be honest about the figure that circulates most: it is very unlikely that an SMB store will be hit with a fine of 4% of its turnover for not having the button. That cap is designed for coordinated cross-border infringements against large players. What a small store does risk is a more mundane but more frequent cocktail:
- The 12-month period (Article 10): refunds that can be demanded for a year, customer by customer, with nobody stepping in.
- The national fine if an inspection or a consumer complaint succeeds: in practice, the minor or serious brackets (thousands to tens of thousands of euros), not the million.
- In Germany, the Abmahnung: legal costs and a cease order, even without an authority involved.
- Reputational cost: complaints about not being able to withdraw end up in reviews and forums.
Put another way: the danger is not so much the spectacular fine as the sum of frictions that not complying generates. And they are all avoided with the same thing: a compliant button and a traceability trail that proves you informed the customer and handled every request.
A real case: the AGCM and the €9 million against eDreams (January 2026)
So as not to fall into "this never happens", here is a real, public, dated example. In decision PS12853, of 27 January 2026, the Italian AGCM fined the eDreams group €9 million for unfair commercial practices tied to the promotion of subscriptions (dark patterns): €6 million for the practices concerning the subscription programme and €3 million for the obstacles to exercising the right of recesso.
Two lessons for any store: first, European authorities are already looking specifically at obstacles to withdrawal, not just at the absence of the button. Second, dark patterns — hiding cancellation, complicating the refund, dragging out deadlines — are precisely what Directive 2023/2673 aims to stamp out with a visible button and a frictionless two-step flow. Complying properly is not just adding the button: it is not setting traps around it.
How to avoid the penalty (and the 12-month period)
The way to protect yourself is simple and fits in a list:
- Install the withdrawal button ("Withdraw from contract here" or its literal wording per language), visible in the footer and accessible without login. Review which label is valid and how to comply on Shopify.
- Inform before purchase of the right, the period and the exceptions. If you don't inform, the period jumps to 12 months.
- Seal every request with date, time and an identifier. If a complaint ever arises, the proof that you handled it is your best defence.
- Don't set traps: no forcing a phone call, hiding the link or dragging the refund out beyond 14 days.
All of this is exactly what Article 11a requires and what we develop in the complete guide to Directive (EU) 2023/2673.
Frequently asked questions
How much can you be fined for not having the withdrawal button? It depends on the country and the severity: in Spain from up to €10,000 (minor) to €1,000,000 (very serious); in France up to €75,000 for a company; in Italy the AGCM can reach €10 million. The 4% of turnover is the European cap for coordinated cross-border infringements, not the everyday fine of a small store.
Where does the 4% of turnover come from? From Article 24 of Directive 2011/83/EU, amended by the Omnibus Directive (2019/2161), for "widespread infringements with a Union dimension". If turnover is unknown, the cap is at least €2 million.
What happens if I don't add the button but nobody reports me? The most likely consequence is automatic: if you fail to inform of the withdrawal right, the period is extended from 14 days to 12 months (Article 10 of Directive 2011/83/EU); the missing button is sanctioned separately. During that year, any customer can withdraw and demand a refund.
Is the fine imposed by the EU or by my country? Your country. The EU sets the framework; the national authority imposes the penalty (regional governments and the Directorate-General for Consumer Affairs in Spain, the DGCCRF in France, the AGCM in Italy, the ASAE in Portugal; in Germany, above all, the courts via Abmahnung).
Are there real cases of fines for obstructing withdrawal? Yes: in January 2026 the AGCM fined the eDreams group €9 million (decision PS12853), of which €3 million were for obstacles to recesso.
Conclusion
If you run a Shopify store selling to the EU, forget the obsession with the 4%: for you, the real risk is the sum of a withdrawal period inflated to 12 months, a possible national fine in the minor-to-serious bracket and reputational friction. And it is all neutralised by the same measure: a compliant, visible withdrawal button with no traps, with every request sealed with date and time. Complying properly costs less than a single year of refunds that can be demanded.
💡 Ready to comply effortlessly? returnEasier installs the compliant withdrawal button on your Shopify store and seals every request with date and time, an auditable record and an acknowledgement of receipt, in the 7 EU languages. Try it free — 3 trial returns, no card required.
Official sources
- Directive (EU) 2023/2673 — EUR-Lex
- Directive 2011/83/EU (arts. 10 and 24) — EUR-Lex
- Omnibus Directive (EU) 2019/2161 — EUR-Lex
- Spain — Royal Legislative Decree 1/2007 (TRLGDCU), arts. 49-51 — BOE · Ministry of Consumer Affairs — Penalties
- France — Code de la consommation, art. L242-13 — Légifrance
- Germany — Art. 246e EGBGB — dejure.org
- Italy — Codice del Consumo (art. 54-bis) / AGCM
- Portugal — Decree-Law 24/2014 and RJCE (Decree-Law 9/2021) — Diário da República
Informational content; it does not constitute legal advice. Amounts and the classification of infringements depend on the rules in force in each country and on the circumstances of the case. National amounts vary across jurisdictions. For your specific situation, consult a lawyer specialising in consumer law.