Vastgeplakt (sticky) Right of Withdrawal

Hi Ruud!

As you may know on 19th of June 2026 a new rule in the EU "Right of Withdrawal" is in force. There are two ways to be compliant:

1) Withdrawal Request - a simple and accessible way for customers to request a withdrawal. This should be a direct link or button (e.g., 'Request Withdrawal') in the user's order history. The process should require minimal effort, and we must automatically send a confirmation email once the request is initiated. 
Key point: The process must be as easy to initiate as the purchase itself; avoid complex forms or support ticket requirements.

2) Digital Content Exemption - to limit withdrawal rights for digital downloads, we must obtain explicit consent from the user. During checkout, provide a checkbox stating: 'I agree to the immediate start of the download and acknowledge that I will lose my right of withdrawal.' This must be unchecked by default, and we must send a copy of this acknowledgment to the user via email after the purchase.
Key point: This acts as your legal safeguard to prevent customers from downloading the product and then requesting a refund.

Do you have any thoughts on it already?

For example, if I want to got with the second option, I need to implement these 4 steps:

1. Keep it Unchecked: Ensure the box is unchecked by default. Pre-ticked boxes are illegal under EU law for this purpose.
2. Make it Mandatory: The purchase button should be disabled (or the payment should be blocked) until this box is checked.
3. The "Reliable Medium" Rule: Once the user checks this and completes the purchase, your automated "Order Confirmation" email must include a sentence confirming this consent. Something as simple as this in your email template will suffice:
   • “Thank you for your purchase. You have consented to the immediate start of the download and acknowledged the loss of your statutory right of withdrawal.”
4. Log it: Ensure your database records that this specific checkbox was ticked for that specific order ID. This provides you with an audit trail if a customer ever disputes the charge with their bank.

Best regards,
Dmitrijs

Hi,
in short yes! but in the next major releaseas this is not a small feature to add but impacts the whole chain in ochSubscriptions.

and just to add to your good description (Thanks for that ), this only applies for consumer transaction not for b2b, so another 'complicating' factor to account for.

Lets keep this topic open so we can discuss if any insights change or questions arise.

and just for some more context on this.
option 2 (digital download) only applies for a transaction with which you get e.g. a mp3 or an ebook.
we don't sell transactions, we sell subscriptions and that changes the arena: subscriptions are classified as service under EU law (so not a digital download).
So the Digital Content Exemption checkbox doesn't cleanly apply to your business, and implementing it could actually create a false sense of legal protection.

The service exemption says the right of withdrawal is lost once the service is fully performed, but a 1-year subscription is never fully performed within 14 days, so that exemption doesn't help much either.

So option 2 doesn't apply, option 1 ( (withdrawal request mechanism) is the only viable way forward here: provide a simple way to exercise it, and handle it gracefully. Most EU consumers buying developer tools or software subscriptions don't withdraw, and having a clean process protects you more than a legally shaky checkbox.

maybe also an option to on first download of a file show a dialogue (agree /cancel) where the customer waives his right for withdrawal > the download dialog is more precise than a checkout checkbox because consent is given at the actual moment of consumption rather than upfront
 

maybe also an option to on first download of a file show a dialogue (agree /cancel) where the customer waives his right for withdrawal > the download dialog is more precise than a checkout checkbox because consent is given at the actual moment of consumption rather than upfront

This one is looks like a good solution.

EU Right of Withdrawal - current functional design

Background:

• EU regulation effective 19 June 2026 requires compliance with the Right of Withdrawal for B2C (consumer) transactions
• Applies only to B2C, B2B orders are exempt and unaffected
• ochSubscriptions sells subscriptions with download rights, classified as a service under EU law, meaning consumers have a 14-day right of withdrawal unless they actively waive it

Two complementary mechanisms are being added:

1. Withdrawal Request Button
   • A "Request Withdrawal" button appears per transaction on the customer's subscriptions page
   • Visible only within the configured withdrawal period (default 14 days from purchase date)
   • B2C only; hidden for B2B orders; hidden once a withdrawal has already been requested
   • Clicking it records the request, sends the customer an automated confirmation email (legally required), and notifies you as the merchant
   • Provides a compliant, low-friction way for consumers to exercise their right, EU law requires the process to be as easy as the purchase itself
2. Download Consent Dialog
   • When a paid B2C customer clicks a download button for the first time on a product, a modal dialog appears before the download starts
   • The dialog informs the customer that by downloading they waive their statutory right of withdrawal for that product
   • The customer must actively confirm; clicking Cancel preserves the right and the download does not start
   • Subsequent downloads of the same product skip the dialog (consent already recorded) , this includes downloads via the Joomla updater using a direct download URL
   • Once consent is given, the Withdrawal Request Button is no longer shown for that product
   • The consent check is enforced server-side in the download controller, bypassing the download button via a direct URL with download key is also gated until consent is recorded

Download Consent Dialog, scenarios where the dialog is skipped:

• Visitor downloads (no login): no user account means consent cannot be stored per user; the Right of Withdrawal requires a contract — a free anonymous download has neither a contract nor a payment, so nothing to withdraw from
• Free subscriptions (login required, no payment): the Right of Withdrawal is about refunds, a €0 subscription has nothing to refund; the dialog is not shown
• In both cases the download is served directly without interruption

What gets recorded:

• Withdrawal requests: timestamp per transaction; your audit trail if a customer disputes via their bank
• Download consent: timestamp per customer per product; legally defensible evidence the right was waived
• Consent is always recorded on first download regardless of whether the feature is enabled, this prevents disruption if the toggle is switched on later; customers who already downloaded will not be prompted

Configuration:

• Both features are off by default; non-EU shops are completely unaffected
• A single toggle (Enable Right of Withdrawal) in the component configuration activates both
• The withdrawal period is configurable (default 14 days) to accommodate jurisdictions with different windows