Use Shopify in Germany in a legally compliant manner

A Shopify store is quick to set up, but operating in Germany—one of the most heavily regulated e-commerce markets—can be difficult.

The platform itself makes it possible to use Shopify in Germany in a legally compliant manner from the outset. Nevertheless, as a merchant, you need to be aware of the current legal framework in order to act accordingly.

You must comply with regulations on pricing, data protection (GDPR), and new consumer protection laws (the cancellation button pursuant to Section 356a of the German Civil Code (BGB) and the Act to Strengthen Accessibility). Failure to comply can result in heavy fines and costly legal consequences such as warnings.

In this article, Latori, a Shopify Platinum Partner, shows how merchants can ensure their Shopify store complies with German law. The guide (as of October 9, 2026) explains the obligations under German and EU law and how to implement them in Shopify: Legal notice (§ 5 DDG), legal texts, data protection (GDPR, TDDDG), cookie consent, price labeling (PAngV), product labeling (GPSR), accessibility (BFSG), and the “cancel order” button (§ 356a BGB), which has been mandatory since June 19, 2026. New as of September 27, 2026, are the stricter rules against greenwashing in the UWG and additional information requirements. The article includes a checklist, specific Shopify settings, and an FAQ.

Key Points at a Glance:

• Shopify is available in Germany; legal responsibility for text and settings lies with the merchant.

• As of June 19, 2026, B2C stores must provide a two-step electronic return function. With its self-service returns and cancellations, Shopify only provides a basic framework that you should review.

• As of September 27, 2026, stricter rules apply to environmental claims such as “climate-neutral.”

• As of July 20, 2025, the reference to the EU ODR platform is no longer required. Old links should be removed.

• As of June 28, 2025, the BFSG applies, with an exception for micro-enterprises.

• Discounts require the lowest price from the past 30 days to be stated.

Protected terms and brand names

The use of protected terms and brand names should be avoided as a matter of principle. Likewise, the use of names of other companies should be avoided, as this could result in sanctions under competition law due to an existing risk of confusion.

Newsletter

In the best case, you use the "double opt-in procedure" to realize a customer registration for your newsletter. In this process, the customer confirms his or her agreement to receive the newsletter by checking a box and then clicking on a confirmation link in an e-mail. An already set check mark, which the customer must remove in order not to receive the newsletter, is not permitted. Merely an e-mail informing the customer after setting the check mark entails considerable risks of abuse.

When are you allowed to send newsletters?

Retailers are generally only allowed to send newsletters if they have the express consent of the recipient (usually via the double opt-in described above). An important exception to this is the so-called existing customer privilege under Section 7 (3) UWG (Unfair Competition Act). This allows newsletters to be sent without explicit consent if the email address was collected in connection with the sale of a product or service, the advertising relates to similar products or services, and the recipient has not objected to its use (with reference to the right to object in each message).

The latest ECJ ruling (C-654/23) from November 2025 expands the scope: It clarifies that the collection of the email address does not necessarily have to take place through an actual purchase, but that free registration for a customer account can also be considered sufficient “purchase context” as long as the other requirements of the UWG are met. This makes it easier for Shopify store operators who collect customer data themselves to send newsletters, but the following still applies:

• The advertised products must be similar.

• The right to object must be clearly communicated.

Shopify imprint

The legally compliant design of your Shopify store begins with a correct legal notice. You should choose “Legal Notice” as the name of an independent, permanently functional link. The link must be compatible with the default settings of common internet browsers and accessible from any subpage with a maximum of two clicks. The necessary mandatory information is currently mainly derived from Section 5 of the Digital Services Act (DDG).

Separate disclosures may be required for special case groups.

To integrate the legal notice into your store, simply go to Settings -> Guidelines in your admin area.

Important update: Discontinuation of the ODR platform

One frequently discussed issue was the obligation to provide information about the EU Online Dispute Resolution platform (ODR platform). This topic is no longer relevant:

• The European Commission's ODR platform has been discontinued.

• Since July 20, 2025, the obligation to refer to this platform has been completely abolished.

• Please note: All references and links to the ODR platform must be removed immediately from the legal notice, the terms and conditions, and email signatures, as a link to a platform that no longer exists can be considered misleading and result in a warning.

Even though the ODR platform no longer exists, you must still inform consumers in accordance with Section 36 of the VSBG (German Consumer Dispute Resolution Act) whether you participate in dispute resolution proceedings before a consumer arbitration board. This information must be included separately in your legal notice.

Domain

Do not use names of natural persons, such as "www.helge-schneider.de". Also avoid municipality or city names, for example "www.dortmund.de" and terms that describe government institutions, such as "www.gesundheitsamt.de". Equally problematic are film, book or software titles and the like, for example "www.sturmderliebe.de". You can also avoid warnings if you avoid so-called "typo domains", for example "www.googel.de" instead of "www.google.de".

Privacy policy

Any processing of data is only permitted if there is specific permission (legal basis) for it. Without this permission, the use of personal data is prohibited. Furthermore, the data may only be used for the specified purpose (purpose limitation, Art. 5 GDPR).

Your privacy policy must clearly state which of the six legal bases of the GDPR (Art. 6) you rely on:

• Consent (Art. 6(1)(a)): The customer expressly agrees to the processing, for example for the newsletter or marketing cookies. Consent must be given voluntarily and in an informed manner and must be revocable at any time.

• Contract performance (point (b)): Data that you need for ordering, shipping and payment may be processed for this purpose.

• Legal obligation (point (c)): A law requires the processing, for example tax retention obligations for invoices.

• Vital interests (point (d)): They concern the protection of life and physical integrity and play practically no role in an online shop.

• Public task (point (e)): It applies to authorities and bodies with a public mandate and is not relevant for private merchants.

• Legitimate interest (point (f)): Possible if your interest outweighs the rights of customers, for example in fraud prevention or IT security. Document this balancing test.

You determine the appropriate legal basis separately for each processing purpose and state it in the privacy policy. In an online shop, contract performance, legal obligation, consent and legitimate interest are the most relevant in practice.

Further Obligations and Changes for Your Privacy Policy

Important changes and obligations:

• Cookies & tracking: Notices are no longer sufficient. Section 25 TDDDG requires the user’s active, informed opt-in consent for all non-essential cookies. For this, integrating a Consent Management Platform (CMP) is mandatory.

• Deletion obligations: Data that is no longer necessary for contract performance must be deleted without undue delay (exception: statutory retention periods).

• Third-country transfers (USA): When using US services (e.g. Shopify or Google), the legal basis for the data transfer must be stated explicitly. Currently this is the Trans-Atlantic Data Privacy Framework (TADPF). The EU General Court confirmed the framework in September 2025, and an appeal has been filed against the ruling. Check the current status with your legal text provider.

• Comprehensive information: The policy must continue to contain all details on credit checks, newsletter dispatch, social media plugins and licensing rights.

• Withdrawal function: The withdrawal function processes additional data (name, contract data, contact channel). Adapt your privacy policy accordingly.

Integrate privacy policy into Shopify

The privacy policy is stored in the admin area under Settings → Policies. Please note: Do not use the Shopify standard template. Instead, use texts from professional providers (e.g., Händlerbund or avalex) to ensure compliance with the requirements of the GDPR and the TDDDG.

General Terms and Conditions (GTC)

Although not required by law, terms and conditions are essential for limiting liability and clarifying complex contract details. To be legally effective, two requirements must be met:

• They must be reasonably accessible to customers before the purchase, for example, via a clearly visible link during checkout. A checkbox for confirmation is common practice, but not mandatory.

• They must be sent to the customer in text form (e.g., as an email attachment) after the contract has been concluded.

Caution: The greatest risk of warning letters arises from inadmissible clauses that violate consumer protection law. We therefore strongly advise you to use only professionally drafted texts and not to copy content from competitors.

You can also easily enter the terms and conditions in your settings -> Guidelines.

You can then add the terms and conditions, privacy policy or legal notice to your menu. To do this, go to Sales channel -> Online store -> Navigation. Here you can decide where the information should be displayed in the store, e.g. in the footer menu.

Cookie Consent

Simply providing information about cookies is no longer sufficient: The Telecommunications Digital Services Data Protection Act (TDDDG, § 25) requires the active, informed opt-in consent of the user before you are allowed to load non-essential cookies or tracking tools.

• Opt-in requirement: Customers must actively consent. Rejecting cookies must not be made difficult.

• Technical requirement: Obtaining and documenting this consent, as well as blocking scripts before consent is given (pre-blocking), requires the integration of a consent management platform (CMP). A simple banner is usually not sufficient for this purpose.

• Shopify solution: Shopify offers a built-in cookie banner and the Customer Privacy API, which passes consent data to apps and pixels. You can find the settings under Settings → Customer Privacy. For cookie scanning, reliable script blocking, and long-term proof of consent, a specialized CMP app from the Shopify App Store is often a good choice. According to Cookiebot, Shopify only stores its consent log for 30 days. Check this for your store, as you’ll need to be able to provide proof of consent.

• Practical Check: Use your browser to verify that tracking scripts (e.g., Meta Pixel, Google Ads) are indeed not firing before consent is given.

Payment options

The possible payment options must be visible before the contract is executed; the General Terms and Conditions (GTC) are best suited for this purpose. You must offer your customers at least one payment method that is free of charge for them. Shopify offers you a direct connection to German payment processing services, SSL certificate included. In addition, information about the time of the debit is mandatory.

Right of Withdrawal and Withdrawal Button

The right of withdrawal is no longer required to be in writing. Therefore, make sure that, in addition to your email address, your store’s legal notice and contact information include another quick way to contact you (e.g., a phone number or contact form) (Section 5 DDG).

Customers must be able to view the right of withdrawal immediately before completing the order process. You can set this up in Shopify by adding the full withdrawal policy text and the sample withdrawal form in Settings -> Policies. Shopify automatically links these texts on the shopping cart and checkout pages.

Right of withdrawal – requirements and Shopify implementation:

According to § 5 DDG (imprint obligation), it is mandatory to provide a telephone number, as the right of withdrawal is no longer bound to the written form. Therefore, make sure that this is included in the legal notice and contact details of the store.

The model cancellation notice must be provided as a legally required form and integrated directly into the text of the policy.

After the purchase, the right of withdrawal must be communicated to the customer once again in writing. You can fulfill this obligation by including the right of withdrawal (or a clear link to it) in the purchase confirmation email that Shopify sends automatically.

Cancellation button pursuant to Section 356a of the German Civil Code (BGB): mandatory as of June 19, 2026

As of June 19, 2026, merchants who offer contracts to consumers via an online user interface must provide an electronic cancellation function. This requirement applies to all B2C online stores where a statutory right of withdrawal applies. Purely B2B online stores and contracts without a right of withdrawal under Section 312g of the German Civil Code (BGB) (e.g., custom-made goods) are exempt. This requirement is based on EU Directive 2023/2673.

The function must consist of two steps:

• Step 1: A clearly labeled button, such as “Cancel Contract,” leads to a page where consumers can enter their information.

• Step 2: A confirmation button, such as “Confirm Cancellation,” submits the notice.

Here are the specific requirements set forth by the legislature:

• The feature must be easy to find and available at all times throughout the entire cancellation period, without requiring a login.

• Only the following information may be requested: name, details identifying the contract, and the channel for the acknowledgment of receipt. You may not ask for the reason for cancellation.

• You must immediately confirm receipt on a durable medium (e.g., via email), including the content, date, and time. This confirmation serves only to acknowledge receipt; it does not confirm the validity of the cancellation.

• The function must be accessible to all users.

• Your cancellation policy must include a reference to the online cancellation function. According to the Braunschweig Chamber of Industry and Commerce (IHK) and Shopify, if this reference is missing, the cancellation period may be extended to twelve months and 14 days.

Implementation in Shopify: Shopify refers in its Help Center to self-service returns and cancellations, which can be used to partially implement the right of withdrawal. With Managed Markets, compliant cancellation and return policies are applied automatically. You should check with your legal text provider to confirm whether the process meets German requirements, particularly regarding use without a login. In the Shopify Community, users have criticized the fact that the native process requires a login to the customer account. You have three options:

• Legal document providers: Händlerbund and eRecht24 offer solutions for Shopify.

• App from the Shopify App Store: There are several “Cancel Order” button apps available. Check whether the feature remains permanently visible in every pricing plan. The IT-Recht law firm points out that a feature that is no longer displayed is considered a violation.

• Implementation directly in the theme code, which requires more testing effort.

Anyone who relies solely on an app bears the legal risk themselves. Be sure to also include the marketplaces through which you sell.

Latori Expert Tip: Test the cancellation button as a customer would: without logging in, on a smartphone, using a screen reader, and by checking the email after submitting the form. Also make sure the feature remains permanently visible in your current app plan.

Important additional obligations:

• The legally mandated cancellation button makes it easy for consumers to exercise their right of withdrawal directly via the online store. To meet this requirement, merchants typically implement the button using specialized Shopify legal compliance apps or through targeted code adjustments in the theme.

• In the event of a withdrawal, all payments, including standard delivery costs (no costs for express shipping), must be refunded to the customer immediately. This is processed via the Shopify admin area under Orders -> Refund.

• The use of a contractual right of return instead of the statutory right of withdrawal is not permitted.

Information obligations immediately before conclusion of the contract

In order to fulfill your obligations as a retailer in a legally compliant manner, you must clearly state the essential characteristics of the goods or services. In accordance with the Price Indication Regulation (PAngV), you must also display the total price and its composition. Please note that the base price (price per unit of measurement, e.g., 100 ml or 1 kg) is mandatory for all products that you sell by weight, volume, or area.

• Price details: The total price must include the product price, shipping costs, and, if applicable, costs for the means of distance communication.

• Delivery time: The terms of delivery, payment, and performance must be made transparent. It remains the case that courts have declared imprecise information regarding delivery dates (e.g., “the delivery time is usually ... working days”) to be inadmissible—exact delivery dates are mandatory in order to avoid warnings.

• Digital goods (new): For digital content or services, you must also provide information on functionality, compatibility, and the scope of necessary updates.

• Rights and complaints: You must describe your procedure for handling possible complaints and must indicate the existence of a statutory right to liability for defects.

• Correction option: In addition, there must be an easily accessible option for the customer to correct any erroneous entries (Section 312i of the German Civil Code (BGB)).

• Order Button (Section 312j of the German Civil Code (BGB)): The button used to complete the order must clearly indicate the obligation to pay, e.g., “Place Order with Obligation to Pay.” Check the labeling in the German-language checkout.

• Warranties, Repairs, and Delivery Options (effective September 27, 2026): According to the Braunschweig Chamber of Industry and Commerce (IHK), additional disclosure requirements apply, including those regarding warranties, environmentally friendly delivery options (where available), as well as repairability, replacement parts, and repair instructions. Check with your legal text provider to determine which disclosures are relevant to your product range.

Quality seals

In online retail, the following applies: You may not display any quality seals that you do not possess. You must always be able to prove that you possess a seal.

• Low standards: Refrain from using quality seals that are awarded for very low requirements or simply for paying a certain amount. Courts consider the use of such seals to be misleading.

• Clear validity: If you only hold a quality seal for a specific area or specific products, this must be stated explicitly and unambiguously (e.g., “Only applies to electronic items”).

• Transparency requirement (new focus): The seal must be linked to the provider's website at least until it has been verified, where the award criteria and current validity (expiration date) can be seen. An expired seal is misleading.

• Verifiability: You must be able to prove at any time that you are legally entitled to use the seal, including with regard to the transparency of the reviews that may be included in the seal.

Environmental Claims and Sustainability Labels (Greenwashing)

The amended Unfair Competition Act (UWG), which implements EU Directive 2024/825 (“Empowering Consumers for the Green Transition,” or EmpCo for short), has been in effect since September 27, 2026. According to the Palatinate Chamber of Industry and Commerce (IHK Pfalz), there is no grace period. For Shopify stores making sustainability claims, this means:

• General environmental claims such as “environmentally friendly,” “sustainable,” or “green” are now only permitted if you can demonstrate recognized outstanding environmental performance, such as the Blue Angel or the EU Eco-Flower.

• “Climate-neutral” through CO₂ offsetting may no longer be used as a product claim.

• Claims about the future (“climate-neutral by 2030”) are only permitted if backed by a concrete, verifiable plan.

• Sustainability labels must be based on a certification system or be established by the government. Self-awarded labels are problematic.

Here's what you should do now: Review product descriptions, badges, filters (e.g., “sustainable”), seals, and brand tags in your theme and marketing tools.

Mandatory labeling

The labeling requirement has been significantly expanded due to new EU regulations concerning both general safety standards and environmental laws.

1. General safety (GPSR): The General Product Safety Regulation (GPSR) requires you to provide the full contact details (name, address, email/phone number) of the manufacturer or EU importer directly on all physical products and in their online product descriptions.

Implementation in Shopify:

1. Use the Description field in the product editor to clearly label the manufacturer's/importer's full contact details in the body text.

2. Alternatively, add this information in a separate meta field, which you can then display in a prominent place in the theme (e.g., below the price).

3. For physical labeling: Ensure that this contact information is also visible on the product labels or packaging.

2. Extended producer responsibility (EPR): Compliance with the regulations requires not only labeling, but also mandatory registration. Before placing the following items on the market, you must register with the relevant German central offices:

• Packaging (VerpackG / LUCID register)

• Electrical equipment (ElektroG) and batteries (BattG) (EAR register)

• Single-use plastics (EWKFondsG): Certain plastic products (e.g., to-go cups) are subject to a new tax and registration requirement (since 2024).

Implementation in Shopify: Your LUCID registration number and WEEE registration number (ElektroG) must be stated in the legal notice or in the terms and conditions.

In addition, the EU Packaging Regulation (PPWR) will be phased in starting in August 2026. Check with your packaging or legal advisor to determine how this will affect your product line.

3. Special labeling: Traditional labeling requirements remain in place for food, pharmaceuticals, items with FSK/USK ratings, and goods with age restrictions (age verification system recommended for alcohol/tobacco).

Accessibility (BFSG / EAA)

The deadline for full compliance with the German Accessibility Enhancement Act (BFSG) expired on June 28, 2025. Accessibility is therefore a mandatory structural requirement for all e-commerce offerings.

• New requirement: The entire web store interface—including checkout, forms, and product presentation—must be designed to be accessible (e.g., compatible with screen readers and navigable via keyboard).

• Impact on Shopify: Merchants must ensure that their current Shopify theme and all third-party apps used comply with the EN 301 549 technical standard. The use of older, non-accessible themes now poses a high compliance risk.

Rules for price reductions (“was/now” prices)

Since the implementation of the EU Omnibus Directive, extremely strict rules apply to advertising discounts and sales promotions. This is currently a major source of warnings.

• New requirement: If you advertise a discount (e.g., “50% off!”), you must indicate the lowest price at which the product was offered in the last 30 days prior to the reduction.

• Administration: This rule applies to genuine price reductions. The system must correctly flag exceptions (e.g., personalized or loyalty discounts) and ensure that price history data is reliably stored in the Shopify backend.

• CJEU case law: In September 2024, the CJEU (C-330/23) clarified that the 30-day lowest price is also the reference point for discounts advertised as a percentage.

• Comparison price field: The Shopify "Comparison price" field can be filled in freely. Only enter the actual 30-day lowest price there.

Extended producer responsibility (EPR) for shipping abroad

The existing rules on EPR registration (packaging, electrical appliances) are becoming stricter if you sell goods to other EU countries (remote selling).

• New rule: If you sell products (e.g., electronics, batteries, packaging) to customers in another EU country (such as Austria or France), you must check whether your manufacturer/supplier is EPR-registered in that destination country. If not, you are considered the manufacturer in that country and must register there yourself and fulfill all reporting obligations.

What you should do: Shopify merchants must ensure that they check the EPR obligations for each country they ship to and register themselves if necessary.

DMA compliance and tracking: Google Consent Mode v2 (GCM v2)

The Digital Markets Act (DMA) imposes stricter rules on gatekeepers (Google, Meta). For Shopify merchants, this leads to immediate technical consequences in marketing tracking.

Key requirement: GCM v2

To continue using conversions and data for Google Ads (retargeting, optimization), you must implement Google Consent Mode v2 (GCM v2). Without it, you risk losing important campaign data.

What Shopify merchants need to do now:

• Check CMP: The app that manages your cookie banner (CMP) must be GCM v2-compatible (e.g., “Aboalarm,” “Cookiebot”).

• Check integration: Ensure that the CMP correctly connects Consent Mode v2 with your Google tags (GA4, Ads).

• Shopify settings: Go to Settings > Customer Privacy to verify that consent is enabled correctly. Shopify supports Consent Mode v2 once the privacy settings are configured correctly. Custom web pixels may require additional code. A professional CMP app is usually required for full GCM v2 implementation.

• Meta: Also check the compliance of your meta pixels and Conversions API.

International trade and cross-border sales

Selling internationally via Shopify opens up new market opportunities, but also brings with it legal considerations. Here are some important aspects to consider when selling internationally via Shopify:

Customs and import regulations

Each country has its own customs and import regulations. This concerns the declaration of goods, customs tariffs, import restrictions and prohibitions. Find out about the specific requirements of the countries you want to export to.

International shipping

Consider the shipping costs and the different delivery times for international shipments. Clarify whether you are able to ship worldwide and which shipping service providers are available in the destination countries.

Currency conversion

Shopify allows you to specify prices in different currencies. Take into account exchange rate fluctuations and the possibility of customers paying in other currencies.

Tax aspects

Sales tax regulations can vary greatly from country to country. Check whether and how you handle VAT for international sales correctly. This may include the issue of small business regulations and other tax considerations.

The Shopify Tax Exempt Manager app developed by Latori helps you to sell internationally in a legally compliant way.

Local laws and regulations:

Be sure to comply with all local laws and regulations in the countries you are exporting to. This may include product requirements, labeling regulations and other legal considerations.

Sales in Austria and Switzerland

• Austria: EU consumer law applies, including a 14-day right of withdrawal. Legal notices and pricing information are governed by Austrian law. Do not use German texts without verifying them first.

• Switzerland: The Swiss Data Protection Act, Switzerland’s own fair trading and price disclosure regulations, as well as customs and value-added tax obligations upon import apply. Switzerland does not have a general statutory right of withdrawal for online purchases.

Return policies:

Clarify if and how you handle international returns. Inform your customers transparently about the return policy and the associated costs.

Liability and guarantees:

Understand the liability laws and warranty requirements in the countries you export to. This can vary depending on the product category.

Trade sanctions monitoring:

Make sure your products are not affected by trade sanctions. Check the current lists and regulations to ensure that your international sales comply with the relevant laws.

Quick Check: Verify the Legal Compliance of Your Online Store

This checklist will help you identify the most serious gaps. It is not a substitute for legal advice:

• Legal Notice: Accessible from every page in two clicks, complete, and without a link to the OS platform?

• Legal Texts: Provided by a specialized vendor, up-to-date, and linked in the checkout?

• Cancellation Button: Permanently visible, no login required, two-step process, with confirmation of receipt including date and time? Cancellation policy updated?

• Checkout: Clear “Order” button, total price, shipping costs, and specific delivery time?

• Prices: Base prices listed; is the 30-day lowest price guarantee correct for discounts?

• Cookies: Does your banner actually block scripts before consent is given?

• Privacy: Are all apps and pixels listed in the privacy policy?

• Products: GPSR information provided; are environmental claims verifiable?

• Accessibility: Have the theme, checkout, and apps been tested, or are any exceptions documented?

• Registrations: Are LUCID, EAR, and, if applicable, international registrations in place?

Conclusion: Ensuring Shopify’s Legal Compliance Means Staying on Top of Things

Shopify can be operated in compliance with German law if the technology, legal texts, and processes are aligned. The platform provides the foundation, but the responsibility for the legal notice, legal texts, data protection, price disclosures, and product labeling remains with the merchant.

In 2026, the focus will be on three key points in particular:

• Cancellation button: Mandatory for B2C stores as of June 19, 2026. Check whether your solution works without a login, confirms receipt, and is mentioned in the cancellation policy.

• Environmental Claims and Disclosure Requirements: Stricter rules have been in effect since September 27, 2026. Review product descriptions, certification seals, and warranty information.

• Ongoing Maintenance: Review legal texts, cookie banners, pricing information, and accessibility after every theme change, every new app launch, and every new target country.

The quick check above will help you identify the biggest gaps, but it is not a substitute for legal advice. If you have legal questions, please contact your law firm or your legal document provider.