EU Compliance Checklist for a New Shopify Store

Launching a Shopify store to EU customers? Work through this practical checklist covering the right of withdrawal, terms, imprint, VAT, cookies, and privacy before your first order lands.

Launching a Shopify store for EU customers is exciting right up until you realize how many legal boxes need ticking before order number one. The good news: the requirements are knowable and finite. Work through this checklist in order and you'll cover the essentials that trip up new stores.

Treat it as a launch gate. Each item is something you can genuinely finish this week.

1. Right of withdrawal

The 14-day right of withdrawal is the single most-scrutinized area of EU distance selling, and the easiest to get partially wrong.

[ ] Publish a withdrawal policy stating the 14-day window, when it starts, and how customers exercise it.
[ ] Provide the model withdrawal form so customers have a standard way to declare.
[ ] Disclose who pays return shipping — you only get to pass it on if you say so before purchase.
[ ] List any exceptions you rely on (personalized goods, sealed hygiene items, perishables).
[ ] Confirm your refund process meets the 14-day, original-payment-method rule.

This is the area worth automating from day one. The Blockly — Right of Withdrawal app is purpose-built to present compliant withdrawal information and the model form to EU shoppers, so you're not stitching this together manually. It's free, which makes it an easy launch-day install.

2. Terms and conditions

Your T&C is the contract between you and the buyer. It should cover, at minimum:

[ ] Who you are and how the contract is formed.
[ ] Pricing, payment, and delivery terms.
[ ] Withdrawal and returns, cross-referencing your policy.
[ ] The legal guarantee of conformity for goods.
[ ] Dispute resolution and applicable law.

Don't copy a US "Terms of Service" template. EU consumer contracts have different mandatory content, and unfair or hidden terms are unenforceable against consumers.

3. Imprint / legal notice

Several EU countries — Germany's *Impressum* rule is the strictest — require a clearly accessible legal notice identifying the business behind the store. Include:

[ ] Legal/trading name and legal form.
[ ] Geographic address (a real one, not just a PO box where prohibited).
[ ] Contact details — email and, where required, phone.
[ ] Registration and VAT numbers where applicable.

Make it reachable in a couple of clicks from every page, typically in the footer.

4. VAT and OSS

Cross-border EU sales bring VAT obligations that new merchants routinely underestimate.

[ ] Understand the distance-selling threshold — once your total cross-border B2C sales pass EUR 10,000 across the EU, you charge VAT at the customer's country rate.
[ ] Consider registering for the One-Stop Shop (OSS) so you file one return instead of registering in every member state.
[ ] Configure Shopify tax settings to apply the correct destination rates.
[ ] Show VAT-inclusive prices to consumers, as EU pricing rules expect.
[ ] Keep compliant invoices with the required VAT details.

A quick illustration: sell EUR 4,000 into France, EUR 3,000 into Italy, and EUR 4,000 into Spain, and you've crossed the EUR 10,000 combined threshold — from that point you charge each buyer their home rate.

5. Cookie consent

If you use analytics, ads, or any non-essential tracking, EU rules (ePrivacy plus GDPR) require prior, informed consent.

[ ] Install a consent banner that blocks non-essential cookies until the user agrees.
[ ] Offer a genuine reject option as prominent as "accept" — no dark patterns.
[ ] Let users change their choice later.
[ ] Only fire tracking scripts after consent.

"By using this site you accept cookies" notices are not valid consent. The user has to actively choose.

6. Privacy policy (GDPR)

You're processing personal data the moment you take an order, so a proper privacy policy is mandatory.

[ ] Explain what data you collect and why (the legal basis).
[ ] Name your processors — Shopify, payment providers, email tools, analytics.
[ ] State retention periods and any international transfers.
[ ] Describe data-subject rights — access, deletion, portability, objection.
[ ] Provide a contact point for privacy requests.

7. The pay button and pricing transparency

Two small checkout details with real legal weight:

[ ] Label the final order button clearly, e.g. "Order with obligation to pay." An ambiguous button can leave the contract unenforceable.
[ ] Show the full price including taxes and delivery before the commit step — no surprise charges.
[ ] Ensure no pre-ticked boxes for paid add-ons or newsletter sign-ups.

Your launch-week sequence

If you're staring at the whole list, tackle it in this order:

Withdrawal policy + app — highest scrutiny, and free to set up.
Imprint and privacy policy — quick to publish, legally required.
Pay button + pricing transparency — five-minute fixes with outsized impact.
Cookie consent — before you switch on any analytics.
Terms and conditions — get proper EU-consumer wording, not a generic template.
VAT/OSS — set up early even if you're below the threshold, so you're ready when you cross it.

*This is general information, not legal advice; EU rules are transposed differently by member state, so confirm specifics with a qualified professional.*

None of these items is individually hard. What sinks new stores is treating compliance as a "later" problem and discovering the gaps during a dispute or a tax audit instead of before launch. Work the checklist top to bottom and you'll open with a store that's both trustworthy and defensible.

If you only do one thing today, make it the withdrawal setup — it's the most visible to customers and the fastest to get right.