Legal Texts for Online Stores in 2026: Legal Notice, Privacy Policy, Return Policy, and Cookie Banner—The Checklist

An online store that sells to consumers will need a legal notice, a privacy policy, a consent request for non-essential cookies, a cancellation policy with a sample cancellation form, and—as of June 19, 2026—a “Cancel Contract” feature. In addition, there must be a clearly labeled “Order” button, complete price information, information on consumer dispute resolution, and—as of September 27, 2026—the EU warranty notice. The link to the EU’s ODR platform, however, has been removed. This guide serves as a checklist, detailing what each mandatory disclosure must include and where it must be placed in the online store.

Status of the legal texts: October 4, 2026. This overview is not a substitute for legal advice; it is best to have the texts themselves drafted and kept up to date by an attorney or a legal document service. It expands on the “Legal Texts” step from our guide to setting up an online store, which you can find in our News section.

What mandatory information does an online store need in 2026? The checklist

The table applies to stores that sell goods to consumers. Those who sell only to businesses are not subject to many consumer obligations; however, even a purely B2B store requires a legal notice, privacy policy, and cookie consent.

What must be included in an online store’s legal notice?

Section 5 of the Digital Services Act (DDG) requires that commercial digital services—which are generally offered for a fee—include information that is “easily recognizable and directly accessible” and kept “constantly available.” It is customary to include a clearly labeled “Legal Notice” link in the footer of every page, including the mobile view. This must include:

• The name and address of the business location; for legal entities, additionally the legal form and authorized representatives;
• Information for quick electronic contact and direct communication, including the email address,
• the registry and registry number, such as in the case of the commercial register,
• the value-added tax identification number or business identification number, if available,
• for activities requiring a license, the supervisory authority; for regulated professions, the professional association, professional title, and professional regulations,
• in the case of corporations in winding-up or liquidation, a note to that effect.

Section 5 of the German Data Protection Act (DDG) does not explicitly mention a phone number. However, regarding information to be provided prior to the conclusion of a distance sales contract, Article 246a, Section 1, Paragraph 1, Item 3 of the Introductory Act to the German Civil Code (EGBGB) lists the phone number alongside the email address—the simplest approach is to display both pieces of information in the same location on the online store.

What should be included in the privacy policy?

If personal data is collected from customers, the online store must inform them at the time of collection (Art. 13 GDPR)—in a precise, transparent, understandable, and easily accessible form, using clear and plain language (Art. 12(1) GDPR). The required content:

• Name and contact information of the controller and, where applicable, the data protection officer,
• The purposes and legal bases for each processing activity; in the case of legitimate interests, these interests must also be specified,
• Recipients or categories of recipients, as well as any planned transfers to third countries along with the safeguards in place,
• the retention period or the criteria for determining it,
• the rights to access, rectification, erasure, restriction, objection, and data portability; the right to withdraw consent at any time; and the right to lodge a complaint with a supervisory authority;
• whether providing the data is necessary for the contract and what happens if it is not provided.

For an online store, this means: Every service that receives data must be included in the privacy policy along with its purpose and legal basis—payment providers, shipping providers, newsletter services, review and analytics services, chat, or embedded videos. If a service is added or removed, the privacy policy must also be updated. Our article on GDPR-compliant online store systems explains what questions you should ask your store platform provider regarding hosting and data processing on behalf of others.

When does an online store need a cookie banner?

As soon as the store stores or reads information on the visitor’s device that is not strictly necessary. According to Section 25(1) of the TDDDG, this is only permitted if the visitor has given consent based on clear and comprehensive information; the information and consent requirements are governed by the GDPR.

No consent is required for what is strictly necessary for the store to provide a service expressly requested by the user (Section 25(2)(2) of the TDDDG)—typically, this refers to what is technically necessary for the shopping process, such as the shopping cart. You should have a professional review what falls under this category in each specific case.

Analytics, advertising, and marketing services, on the other hand, require consent as soon as they store or read information on the device. For the banner, this results in the following requirements:

• Nothing preselected: A pre-checked box that the user must uncheck does not constitute valid consent (ECJ, judgment of Oct. 1, 2019, C-673/17 “Planet49”).
• Active consent: Consent is an unambiguous expression of will through a statement or a clear affirmative action (Art. 4(11) GDPR).
• Complete information: This information must also include the duration of the cookies and whether third parties can access them (ECJ, Planet49).
• Withdrawal must be as easy as giving consent (Art. 7(3) GDPR), for example via a link to the cookie settings in the footer.
• Evidence: The online store must be able to demonstrate that consent was obtained (Art. 7(1) GDPR).
• Services requiring consent may only begin after consent is given —not simply upon loading the page.

If a store uses only strictly necessary cookies, it does not need consent for them. The privacy policy must still describe them, however, to the extent that personal data is processed in the process.

What applies to the cancellation policy, sample form, and cancellation button?

Withdrawal Policy and Sample Withdrawal Form

If consumers have a right of withdrawal, the online store must provide information on the conditions, time limits, and procedures; it must provide the model withdrawal form from Annex 2 of the EGBGB; and, if applicable, indicate that a withdrawal function is available and where it is located (Art. 246a § 1(2)(1) EGBGB). The withdrawal period is 14 days (Section 355(2) BGB). Anyone who submits the statutory model form from Appendix 1, properly completed in writing, fulfills this duty to inform.

The template was updated as of June 19, 2026: Design Note 3 provides a sentence for online stores with a cancellation function stating that cancellation is also possible online at a specific address and that a confirmation of receipt with the date and time will follow. You should therefore have any notices created before this date reviewed. This is because the withdrawal period does not begin without proper notification; the right of withdrawal then expires no later than twelve months and 14 days after the regular start of the period (Section 356(3) and (4) of the German Civil Code (BGB)).

If there is no right of withdrawal—for example, for goods custom-made to the customer’s specifications or for perishable goods (Section 312g(2) of the German Civil Code (BGB))—the online store must also provide this information (Article 246a(1)(3) of the Introductory Act to the German Civil Code (EGBGB)).

Withdrawal Function (“Withdrawal Button”) Effective June 19, 2026

If distance contracts are concluded via an online user interface, the consumer must also be able to withdraw from the contract there using a withdrawal function (Section 356a of the German Civil Code (BGB)). The function must be clearly labeled with “Cancel Contract” or an equally unambiguous phrase, and must be continuously available, prominently displayed, and easily accessible throughout the cancellation period. The procedure is as follows:

1. The consumer enters their name, the contract or part of the contract they wish to cancel, and the method for receiving confirmation of receipt —such as their email address—or confirms this information.
2. They submit the cancellation via a confirmation function labeled “Confirm Cancellation” or an equally unambiguous phrase.
3. The online store must immediately send a confirmation of receipt on a durable medium, including the content of the withdrawal as well as the date and time of receipt.

To meet the deadline, it is sufficient for the consumer to submit the withdrawal via the function before the deadline expires (Section 356a(5) BGB). Our guide on the withdrawal button describes how to set up the function and adapt the instructions.

What must be included on the store’s order page?

§ 312j BGB regulates the order page in three stages:

• No later than the start of the ordering process: whether there are any delivery restrictions and which payment methods the online store accepts (para. 1).
• Immediately before placing the order, clearly, comprehensibly, and prominently: the essential characteristics, the total price, shipping and other costs, a note regarding a personalized price if applicable, and for open-ended contracts and subscriptions, the total price as well as the term if applicable, cancellation terms, and minimum duration (para. 2).
• The order button must be clearly legible and labeled with nothing other than “place a binding order” or an equivalent, unambiguous phrase (para. 3). If in doubt, seek legal clarification as to whether another phrasing is sufficiently unambiguous.

In addition, Article 246a § 1, Paragraph 1 of the EGBGB requires a whole range of pre-contractual information. For a typical online store, this primarily includes the seller’s identity and address, phone number and email address, total price and shipping costs, payment, delivery, and service terms—including the delivery date and, if applicable, the handling of complaints, customer service, and warranties—as well as, for contracts with a fixed term, the duration and termination provisions.

New as of September 27, 2026: the EU Warranty Notice

Since September 27, 2026, a store that sells goods to consumers must prominently inform customers about the statutory warranty right and its minimum duration of two years using the harmonized notice set forth in Annex I of Implementing Regulation (EU) 2025/1960 (Art. 246a § 1(1)(11) EGBGB). None of its elements may be edited.

If the manufacturer provides a free durability guarantee for the entire product lasting more than two years and notifies the retailer of this, the harmonized label in accordance with Annex II (No. 11a) is added to the product; from that point on, it is also included in the information provided immediately before the order is placed. Our guide, “EU Warranty Label,” explains how to incorporate the notification and labeling.

Does an online store need terms and conditions?

Terms and conditions are not required by law, but are common in practice: they allow for the regulation of contract conclusion, payment, delivery, and retention of title in a single document. They do not replace the mandatory information required under Art. 246a EGBGB, and anyone who uses Terms and Conditions must also provide information on consumer arbitration along with the Terms and Conditions (§ 36(2)(2) VSBG). To find out how much legal documents cost during ongoing operations, see our guide “How Much Does an Online Store Cost?”.

What price disclosures are required?

• Total price: Anyone offering goods to consumers or advertising prices must state the total price; if a price is broken down, the total price must be highlighted (Section 3(1) and (3) of the PAngV).
• Base price: For goods priced by weight, volume, length, or area, the base price must be stated alongside the total price in a manner that is unambiguous, clearly recognizable, and easily legible (Section 4(1) PAngV). Exceptions are listed in Section 4(3), such as goods weighing less than 10 grams or measuring less than 10 milliliters.
• Distance Selling: The online store must state that prices include sales tax and other price components, and whether shipping costs apply; it must specify the amount of such costs, provided they can be calculated in advance (Section 6 of the PAngV).

Does an online store still have to provide a link to the ODR platform?

No. The obligation to link to the European Online Dispute Resolution (ODR) platform stemmed from Regulation (EU) No. 524/2013. This regulation was repealed effective July 20, 2025, and the platform was shut down; complaints could no longer be submitted there as of March 20, 2025 (Regulation (EU) 2024/3228).

Any remaining link no longer leads to the platform and may be removed from the legal notice, terms and conditions, and email templates. Background information can be found in our article on the shutdown of the ODR platform.

The obligation to provide information under Section 36 of the VSBG remains in effect: Anyone who maintains a website or uses terms and conditions must state, in an easily accessible, clear, and understandable manner, to what extent they are willing or obligated to participate in dispute resolution proceedings before a consumer arbitration board. If they do participate, they must name the competent body, including its address and website.

Exempt from the requirement to disclose willingness to participate are those who employed ten or fewer people as of December 31 of the previous year; the obligation under Section 37 of the VSBG to refer to a competent conciliation body in writing following an unresolved dispute applies regardless.

What applies to product safety and accessibility?

Product safety: As of December 13, 2024, every online offering of a product must contain clear and clearly visible information: the manufacturer’s mailing address and email address; for manufacturers outside the EU, the responsible person within the EU; information identifying the product, including an image, as well as any warnings and safety instructions (Art. 19 of the Product Safety Regulation (EU) 2023/988).

Accessibility: The Accessibility Enhancement Act applies to e-commerce services provided to consumers after June 28, 2025 (Section 1(3)(5) BFSG); Micro-enterprises that offer services are exempt (Section 3(3) BFSG). Our article “Accessibility in Online Stores” explains what this means in detail.

How XONIC Supports Mandatory Information

In the XONIC Shop System, an order button in accordance with Section 312j of the German Civil Code (BGB), a cancellation button, and a cookie consent form with a true opt-in are standard features in all packages. The order button is labeled “Place order with obligation to pay” by default; in the cookie banner, no category is preselected by default, and the “Accept” and “Reject” options are designed identically.

You can maintain the legal texts yourself in the shop’s CMS or obtain them through a legal text service—the guide “Legal Texts, Cookie Banners & Product Safety” explains how to do this and where to enter product safety information. You can compare packages and services on the pricing page.

Frequently Asked Questions About Legal Texts in Online Stores

Sources

• § 5 DDG: General Information Requirements
• General Data Protection Regulation (EU) 2016/679, Articles 4, 7, 12, and 13
• § 25 TDDDG: Protection of Privacy in Terminal Equipment
• ECJ, Judgment of October 1, 2019, C-673/17 (Planet49)
• Art. 246a § 1 EGBGB: Information Obligations, Annex 1: Model Notice of Right of Withdrawal, and Annex 2: Model Withdrawal Form
• § 355 BGB, § 356 BGB, and § 312g BGB: Right of Withdrawal
• § 356a BGB: Electronic withdrawal function for distance contracts
• Federal Law Gazette 2026 I No. 28: Act Amending Consumer Contract and Insurance Contract Law (Entry into force under Art. 10)
• Implementing Regulation (EU) 2025/1960: Harmonized Notification and Labeling
• § 312j BGB: Obligations toward Consumers in Electronic Commerce
• § 3 PAngV: Total Price, § 4 PAngV: Base Price, and § 6 PAngV: Distance Selling
• Regulation (EU) 2024/3228: Repeal of Regulation (EU) No. 524/2013 (ODR Platform)
• § 36 VSBG: General Duty to Provide Information and § 37 VSBG: Information Following the Arising of a Dispute
• Regulation (EU) 2023/988 on General Product Safety (GPSR), Art. 19
• § 1 BFSG: Scope of Application and § 3 BFSG: Accessibility and Exceptions