E-commerce legal requirements: what must a Dutch webshop comply with?

A Dutch webshop must identify itself clearly, give consumers a fixed set of information before they order, label the order button as a payment obligation and offer a 14-day right of withdrawal. If you get these basics wrong, the main risk is usually not a fine: contracts can be undone and the withdrawal period can run for twelve months longer than you expected.

The rules come from three layers: the information and identification duties in Books 3 and 6 of the Dutch Civil Code (Burgerlijk Wetboek, BW), the European consumer directives implemented in that code, and directly applicable EU regulations on data protection, product safety, geo-blocking and platforms. The Netherlands Authority for Consumers and Markets (ACM) supervises most of these rules.

What must your webshop show about your business?

Your business name, address, email address, Chamber of Commerce number and VAT number must be easy to find on your website at all times. A contact form alone is not enough.

A business that sells online in the Netherlands must be registered in the Commercial Register of the Chamber of Commerce (Kamer van Koophandel, KvK). The KvK issues the registration number that must appear on your website. The procedure for registering and filing is explained in our article on electronic filing in commercial registers.

Under Article 3:15d BW, every provider of an online service must make certain details easily, directly and permanently accessible. These are the name of the business, the address where it is established, contact details including an email address for rapid contact, the KvK number and the VAT identification number. If your activity requires a licence, you must also state the supervisory authority.

A footer link to a page with these details meets the requirement.

What information must you give before the contract?

Article 6:230m BW lists the information you must give before a distance contract is concluded. It includes the main characteristics of the product, your identity and address, and the total price including taxes and all delivery and other costs. It also covers the arrangements for payment and delivery, the duration of the contract, the existence of the statutory guarantee of conformity, and the conditions, period and procedure for withdrawal, together with the model withdrawal form.

The consequences of leaving something out are concrete. If you do not state that the consumer pays the cost of returning goods, you bear that cost yourself.

What are the rules for the ordering process?

Immediately before the order, you must show the key information again, and the order button must make clear that ordering means paying. If it does not, the consumer is not bound by the contract.

Just before the consumer places the order, you must display the main characteristics of the product, the total price, the duration of the contract and the minimum term of any subscription. The button must be labelled unambiguously, for example “order with obligation to pay”. A button that just says “continue” or “confirm” does not meet the requirement.

Your website must also offer technical means to identify and correct input errors before the order is placed. After the order, you must confirm receipt electronically without delay.

When do your general terms and conditions apply?

Under Articles 6:233(b) and 6:234 BW, the consumer must have had a reasonable opportunity to read your general terms before or when the contract was concluded. Online, you must make them available in a way that lets the consumer store them and consult them later. A link to a page that cannot be saved is not enough.

If you fail this test, the consumer can annul the terms clause by clause. Article 6:236 BW lists clauses that are always unreasonably onerous in consumer contracts, and Article 6:237 BW lists clauses presumed to be so. These cover, for example, far-reaching exclusions of liability, unilateral changes to the product and unreasonable notice periods.

These lists do not apply to sales between businesses. It is therefore worth having separate terms for consumers and for business customers. Drafting them is part of our legal advice for businesses.

How does the right of withdrawal work?

A consumer who buys online may withdraw from the contract within 14 days without giving reasons. If you do not inform the consumer properly about this right, the period is extended by twelve months.

For goods, the period starts on the day after the consumer, or a third party they have designated, receives the goods. For services and for digital content, it runs from the conclusion of the contract. You can read the statutory rules in Book 6 of the Dutch Civil Code.

Returns and refunds

Once the consumer has withdrawn, they must return the goods within 14 days. You must refund all payments received, including the standard delivery costs, within 14 days of being informed of the withdrawal. You may wait with the refund until you have received the goods back or the consumer has shown proof of dispatch.

The consumer only pays the direct cost of returning the goods if you told them so in advance. The consumer is liable for any loss in value caused by handling the goods beyond what is needed to establish their nature and characteristics, as they could in a shop.

Which products are excluded?

The exceptions are limited and exhaustive. They include goods made to the consumer’s specifications or clearly personalised, and goods that spoil quickly. Sealed goods that cannot be returned for health or hygiene reasons once unsealed are also excluded, as are sealed audio and video recordings and software once unsealed, and newspapers and magazines.

Accommodation, transport and leisure services for a specific date fall outside the right of withdrawal too. So does digital content not supplied on a physical medium, if the consumer expressly agreed to immediate delivery and acknowledged losing the right of withdrawal. An exception only applies if you told the consumer about it before the order.

Withdrawal is not the same as the statutory guarantee

The right of withdrawal is separate from the statutory guarantee of conformity. Under Book 7 BW, a product must have the properties the consumer could reasonably expect. In a consumer sale, a defect that appears within one year of delivery is presumed to have existed at delivery. It is then up to you to prove otherwise.

There is no fixed statutory guarantee period after which you are automatically released. What counts is what the consumer could reasonably expect of the product concerned. Digital content and digital services have their own regime, including a duty to supply updates for as long as the consumer can reasonably expect them.

What rules apply to prices, discounts and reviews?

Prices must include VAT and all unavoidable costs. When you announce a discount, you must state the lowest price you charged in the 30 days before it, and you must disclose how you rank search results and whether you check reviews.

These duties have applied since the EU consumer rules were modernised and implemented in Dutch law in 2022. For rankings, you disclose the main parameters and their relative weight, and you identify paid placements. Presenting unchecked reviews as verified is misleading.

These rules sit within the general prohibition of unfair commercial practices in Book 6 BW. That prohibition covers misleading acts, misleading omissions and aggressive practices. The ACM enforces it with fines and binding orders. Website design that pushes consumers towards a choice they would not otherwise make, such as false scarcity messages or a pre-ticked extra, falls within it.

What do you need for privacy, cookies and accessibility?

You need a lawful basis for each use of personal data, a privacy statement, processing agreements and proper security. Non-essential cookies require prior consent. Since 28 June 2025 your ordering process must also be accessible to people with disabilities.

Under the General Data Protection Regulation (GDPR), your privacy statement must set out the categories of data, the purposes and legal bases, the recipients, the retention periods and the rights of the people concerned. You need processing agreements with parties that process data on your behalf, and appropriate technical and organisational security measures.

Transfers of personal data outside the European Economic Area require one of the transfer mechanisms of the GDPR. The highest GDPR fines, up to EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, apply to breaches of the basic principles and of the rights of data subjects.

Cookies: two supervisors

Cookies have a Dutch peculiarity. The consent requirement for placing and reading information on a user’s device is in the Telecommunications Act (Telecommunicatiewet) and is supervised by the ACM. The processing of personal data collected through those cookies falls under the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Consent must be freely given, specific, informed and unambiguous (Article 11.7a Telecommunications Act). A pre-ticked box, or a banner that only offers an accept button, does not qualify. Refusing must be as easy as accepting. Functional and strictly necessary cookies, and analytics cookies with little impact on privacy, do not require consent.

Accessibility since 28 June 2025

Since 28 June 2025, the European accessibility requirements, implemented in Dutch law, apply to e-commerce services. The ordering process, product information and payment functions of your webshop must be perceivable, operable, understandable and robust for users with disabilities.

Micro-enterprises providing services, with fewer than 10 employees and an annual turnover or balance sheet total of no more than EUR 2 million, are exempt. The obligation applies to services offered to consumers in the EU, wherever the trader is established.

Which rules apply to product safety, marketplaces and cross-border sales?

Products must be safe and have a responsible operator in the EU, marketplaces must verify who their sellers are, and when you target consumers in other EU countries their mandatory consumer protection continues to apply.

Product safety

Product safety is governed by the General Product Safety Regulation (GPSR), which has applied since 13 December 2024 and replaced the earlier directive. A product placed on the EU market must be safe, and a responsible economic operator must be established in the EU. Online offers must show the identity of that operator, product identification details and any warnings before the purchase.

The GPSR also requires you to report accidents and to carry out recalls in a set way, including notifying affected customers directly where you have their details. Sector rules on conformity marking, such as CE marking, continue to apply on top of it.

Selling through a marketplace

Sellers on online marketplaces are also affected by the Digital Services Act (DSA), which has applied in full since 17 February 2024. Platforms must collect and verify identifying information about the traders they host before allowing them to sell. A seller who cannot provide that information is removed. In the Netherlands, the ACM acts as digital services coordinator. How these rules relate to the seller’s own duties is explained in our article on the Digital Services Act and Digital Markets Act.

Selling to consumers elsewhere in the EU

Selling to consumers in other EU countries brings two further rules. The Geo-blocking Regulation (EU) 2018/302 prohibits blocking or limiting access to your website based on a customer’s nationality or place of residence. It also prohibits automatic redirection without consent and different general conditions of access on that basis. It does not require you to deliver everywhere, but you may not refuse a customer who collects the goods or arranges their own transport.

Under Article 6 of the Rome I Regulation, if you direct your activities at consumers in another member state, you cannot deprive them of the mandatory protection of their own country. Their local rules on withdrawal, guarantees and unfair terms continue to apply alongside the law you choose. Sales to consumers in the United Kingdom fall outside the EU framework and require separate advice.

How are complaints and disputes handled?

You no longer need a link to the European online dispute resolution platform, because it closed on 20 July 2025. If you are bound to an alternative dispute resolution body, you must tell consumers which one and how to reach it.

The regulation behind the platform was repealed by Regulation (EU) 2024/3228. Remove any remaining links, because a link to a mechanism that no longer exists is misleading.

In the Netherlands, most consumer disputes about webshops are handled by a disputes committee (geschillencommissie), to which many traders are affiliated through a trade association or quality mark, or by the subdistrict court (kantonrechter). The subdistrict court hears consumer purchase claims regardless of the amount, and a lawyer is not required there.

The ACM does not settle individual complaints. It enforces in the general interest, but a pattern of complaints does draw its attention. A complaints procedure with a stated response time protects you towards consumers and the regulator.

What should you check as a webshop owner?

Start with the points that can make contracts unenforceable or extend the 14-day withdrawal period by twelve months. Then turn to the rules the ACM and the Dutch Data Protection Authority enforce.

• Your name, address, email address, KvK number and VAT number are permanently visible (Article 3:15d BW).
• The pre-contractual information of Article 6:230m BW, including the model withdrawal form, is complete.
• The order button says that ordering means paying, and your general terms can be saved before the order.
• Every discount shows the lowest price of the previous 30 days, and reviews and rankings are explained.
• Cookie consent allows refusal as easily as acceptance, and your privacy statement and processing agreements are current.
• Your products have a responsible operator in the EU under the GPSR, and your ordering process meets the accessibility rules in force since 28 June 2025.

A structured approach to compliance as a whole is described in our article on types of legal compliance. VAT registration and the one-stop-shop scheme are matters for a tax adviser.

What can we do for you with your webshop’s legal requirements?

Our IT lawyers advise online retailers and platforms under Dutch and EU consumer law.

• We review your checkout, order button and pre-contractual information against Articles 6:230m-6:230v BW.
• We draft separate general terms for consumers and business customers, tested against Articles 6:236 and 6:237 BW.
• We check your withdrawal information and model form, so the 14-day period is not extended by twelve months.
• We review your privacy statement, cookie banner and processing agreements under the GDPR and the Telecommunications Act.
• We assist you in disputes with consumers before the disputes committee or the subdistrict court, and in ACM investigations.

Summary

• Show your business details, KvK number and VAT number permanently on your website (Article 3:15d BW).
• Give the full pre-contractual information and label the order button as a payment obligation, or the consumer is not bound.
• Consumers have 14 days to withdraw; if you do not inform them properly, that period is extended by twelve months.
• State the lowest price of the previous 30 days with every discount, and be transparent about rankings and reviews.
• Check cookie consent, accessibility since 28 June 2025 and product safety under the GPSR.

Frequently asked questions