EU eCommerce Legal Requirements in 2026: The Complete Checklist

✅ Privacy Policy — must disclose all data collected, lawful basis, retention periods, third-party sharing (payment processors, shipping providers, marketing platforms), and data subject rights

✅ Cookie Policy — separate document detailing all cookies used, categories, and duration

✅ Cookie Consent Banner — must appear before any non-essential cookies load; must offer an equally prominent Reject option; no pre-ticked boxes

✅ Data Processing Agreements with all processors (payment gateway, email platform, shipping software, CRM, analytics)

Email addresses collected at checkout require a lawful basis — typically contract (for transactional emails) or consent (for marketing emails). These are legally distinct. Do not conflate them.

Abandoned cart emails require prior consent — you cannot rely on soft opt-in for abandoned cart retargeting without complying with ePrivacy rules

Customer data retention periods must be defined and documented

✅ 14-day right of withdrawal — consumers can return most goods within 14 days without giving any reason

✅ Clearly displayed return and refund policy before purchase is completed

✅ Model withdrawal form available (consumers can use their own words but the form must be accessible)

✅ Refunds processed within 14 days of receiving returned goods (or proof of return)

✅ Disclosure if the consumer pays return shipping costs — if not disclosed, the seller bears the cost

✅ No hidden fees — all costs (including taxes and delivery) must be shown before checkout confirmation

✅ Single point of contact for authorities — a designated contact for regulatory communications

✅ Transparent terms of service — clear explanation of content moderation policies, restrictions on products/services sold, and enforcement mechanisms

✅ Notice and action mechanism — if you operate a marketplace with third-party sellers, you must have a system for reporting illegal content or products

✅ Know Your Business Customer (KYBC) — if you operate a marketplace, you must verify that traders on your platform are who they say they are before allowing them to sell

You would need to register for VAT in every EU member state where you sell

Each country has different VAT rates and filing requirements

Non-compliance carries penalties in each member state

Register once in your home member state

File a single quarterly OSS return covering all EU cross-border sales

Pay VAT for all EU countries in one payment

✅ Images must have descriptive alt text

✅ Videos must have captions and transcripts

✅ Website must be navigable by keyboard alone (for users who cannot use a mouse)

✅ Sufficient colour contrast ratios throughout the site

✅ Forms must have clear labels and error messages

✅ Checkout process must be fully accessible

✅ Responsible person obligation — non-EU manufacturers must appoint an EU-based Responsible Person to handle product safety compliance

✅ Traceability — products must be traceable throughout the supply chain

✅ Online marketplace transparency — product listings must include manufacturer details, country of origin, and relevant safety information

✅ Post-market surveillance — ongoing obligation to monitor products already sold and report serious risks

✅ Full legal identity of the seller (company name, registration number, registered address)

✅ Total price including all taxes and delivery costs

✅ Payment methods accepted

✅ Delivery timeframe

✅ Withdrawal rights and return policy (with model withdrawal form link)

✅ Duration of the contract for subscriptions

✅ Complaint handling procedure

✅ Existence of any applicable codes of conduct

❌ Pre-ticked boxes for marketing consent or add-on products

❌ Making cancellation or unsubscribe options harder to find than sign-up options

❌ Creating false urgency ("Only 1 left!" when stock is plentiful)

❌ Hiding total costs until the final checkout step

❌ Making the "reject cookies" button smaller or less prominent than "accept"

Shareholder Agreements: Protecting Your Equity From Day One

How to Write a GDPR-Compliant Privacy Policy in 2026

GDPR for eCommerce: Cookies, Checkout Data and Marketing Emails

EU eCommerce Legal Requirements in 2026: The Complete Checklist

Selling Online in the EU Has Never Been More Regulated

1. Data Protection — GDPR

2. Consumer Rights Directive — 14-Day Right of Withdrawal

3. Digital Services Act (DSA)

4. VAT — One-Stop-Shop (OSS)

5. European Accessibility Act (EAA)

6. Product Safety and Consumer Protection

7. Pre-Contractual Information Requirements

8. The Dark Patterns Ban

The 2026 eCommerce Legal Checklist Summary

Need Legal Documents?

More Legal Updates

Shareholder Agreements: Protecting Your Equity From Day One

How to Write a GDPR-Compliant Privacy Policy in 2026

GDPR for eCommerce: Cookies, Checkout Data and Marketing Emails