The right of withdrawal on PrestaShop: complying with the regulation while avoiding penalties

What Article 54-bis actually says (precisely, without alarmism)

The regulatory framework, verified against the sources:

• Legislative Decree 31 December 2025, no. 209 (published in the Official Gazette on 8 January 2026) implements Directive (EU) 2023/2673.

• It introduces the new Article 54-bis into the Consumer Code, which requires a digital withdrawal function for contracts concluded via an online interface.

• It also amends Article 49 on pre-contractual information obligations: you must now also tell the customer where this function is located and how it works.

• It applies to contracts concluded from 19 June 2026.

An honest clarification others won't give you. A minority view in legal scholarship holds that Article 54-bis applies only to distance financial contracts (the directive's "main" subject matter). The widely prevailing interpretation, shared by law firms such as CMS, Bird & Bird and Stefanelli & Stefanelli, instead applies it to all B2C contracts concluded online. When in doubt, given the risk involved (see below), the rational choice is to comply: the cost of compliance is always lower than the risk of a single withdrawal exercised 12 months later.

Who it applies to

To all businesses selling to end consumers (B2C) via an online interface: single-brand e-commerce sites, marketplaces, apps, digital subscriptions. No revenue threshold, no exemption for small businesses.

Excluded: relationships that are exclusively B2B and cases already excluded under Article 59 (custom-made goods, perishable products, sealed goods not returnable for hygiene reasons once opened, digital content already consumed with explicit consent).

The technical requirements, translated into PrestaShop specifications

The law doesn't describe "a button". It describes a complete workflow. Translated into what must concretely exist on your PrestaShop:

1. A visible withdrawal function, always accessible throughout the entire eligible window (normally 14 days), in the customer account area and in the order detail page.

2. Unambiguous wording, such as "Withdraw from the contract here" — not a generic link buried in the footer.

3. A structured form where the consumer enters their name, details identifying the order, and an electronic contact for confirmation.

4. A final confirmation command ("confirm withdrawal") — the double confirmation that validates the declaration.

5. An automatic receipt on a durable medium including content, date and time: this is the legal proof that withdrawal was exercised within the deadline.

6. Tracking and storage of the declarations received, for evidentiary purposes.

If even one of these points is missing, you are not compliant.

The mistake almost everyone makes: "Merchandise returns ≠ withdrawal"

This is the point that concerns us most, because it's where you build a false sense of security.

PrestaShop natively has Merchandise Returns. They handle return authorization, logistics, and the physical return of goods. Very useful. But legally, they are a different thing:

• The return is logistics: the item comes back.

• Withdrawal is a unilateral act by which the consumer terminates the contract. The law requires precise wording, double confirmation, and a dated receipt on a durable medium.

Native Merchandise Returns don't implement the legally required wording, don't have double confirmation of withdrawal, and don't generate a dated evidentiary receipt. So: keep them for logistics if you like, but alongside them you need a compliant withdrawal function. Having Merchandise Returns active and thinking you're compliant is exactly how you end up exposed without realizing it.

Your concrete options on PrestaShop

Option A — Custom code

Have the function developed to your specifications. Technically possible, but: it costs more than a module, you have to maintain it with every PrestaShop update, and you bear the responsibility of correctly interpreting the six requirements. It only makes sense for those who already have an in-house dev team.

Option B — Free module

There is some free module that adds the button and does part of the job. Let's be honest: it's not zero. But the free option leaves you to verify that all six requirements are covered, rarely implements the double confirmation and the dated receipt as required by art. 54-bis, doesn't give you support in Italian when it breaks with your theme, and above all doesn't guarantee future regulatory updates. It works if you have the skills to validate it yourself and take on the risk.

Option C — KeRecesso, done and guaranteed

KeRecesso is the module we developed to cover exactly the requirements of art. 54-bis, without modifying PrestaShop's core files (1.7 · 8.x · 9.x):

• withdrawal button visible in the customer area and order detail;

• guided online completion, with no PDF to download or PEC needed;

• mandatory double confirmation;

• automatic email receipt with date and time + PDF on durable medium;

• request archive tracked in the backoffice, multilingual;

• Italian support until it's fully working and guaranteed refund if it doesn't work on your store.

5-minute installation, one-time payment (no subscription), €69 VAT included.

Bring your PrestaShop into compliance with KeRecesso →

What you really risk if you don't comply

Here we distinguish the certain risk from the theoretical one, because the difference matters.

Certain and automatic risk — the extension of the withdrawal period. If the function or the information notice are not compliant (art. 49), the withdrawal period doesn't stop at 14 days: it automatically extends to 12 months and 14 days pursuant to art. 53, with no need for any judicial intervention. In other words: your customers can withdraw for a year. Even on modest volumes, this is an exposure that accumulates every day.

Theoretical risk — the AGCM fine. Failure to provide the function can be classified as an unfair commercial practice (art. 27), with administrative fines that in the most serious cases reach up to €10 million (and up to 4% of turnover for cross-border violations). That's the maximum ceiling: it doesn't automatically apply to every merchant, but it's the framework you operate within.

In practice, for the average SME the real operational problem is the first one, not the second.

There's a bigger problem than the single module

Stop for a moment and look at the bigger picture. Art. 54-bis is only the latest in a series: GDPR, the Omnibus Directive on pricing, cookies, and now digital withdrawal. Every new European regulation, on PrestaShop, translates into the same script: you look for a module, buy it, configure it, keep it updated, and hope it doesn't break with the platform's next update.

KeRecesso solves this regulation, today, well. But if you're tired of chasing every directive with a new module to manage, the real question is another one: how much does it cost you, over time, to keep an e-commerce store running on a stack that pushes every adjustment onto you?

That's why some of our clients, after yet another patch, chose to migrate from PrestaShop to KeideaCMS: compliance and security are built into the core, maintained by those who maintain the platform, with no third-party modules to chase. It's not the solution for those who just need to add a button by Friday — that's what the module is for. It's the solution for those who want out of the game.

Want to find out if it makes sense for your store? Request a free technical audit →

In summary

From June 19, 2026, your PrestaShop must offer a withdrawal function compliant with Article 54-bis: visible, with double confirmation and a dated receipt. Native merchandise returns are not enough, and the real risk isn't just the fine—it's the withdrawal period extending to a year. You have three paths — custom code, a free module to validate at your own risk, or a module built and guaranteed. If you want to close the matter today, KeRecesso does it in five minutes. If you want to stop chasing every regulation with a new module, let's talk about your store.