EU Right of Withdrawal Button for Magento 2

What you get

What Directive (EU) 2023/2673 Requires

The directive updates the rules for distance contracts and, from 19 June 2026, requires a usable online cancellation function. In short, a compliant store must:

1. Show a clearly labelled withdrawal button that is easy to find and stays reachable for the whole withdrawal period, on desktop and mobile.
2. Let consumers cancel without logging in, guest orders included.
3. Use a two-step process: first a short form asking only for the data needed, then a confirmation screen before the cancellation is final.
4. Ask for minimal data only. If a reason is requested, it must be optional.
5. Send an automatic confirmation on a durable medium (such as email) containing the date, time and content of the withdrawal.
6. Include a direct link to the cancellation function in every order confirmation email.
7. Keep consumers informed about exclusions, return shipping costs and refunds before purchase.

This module covers the technical side of all of the above. The compliance text on the form and in emails is fully editable so you can match it to your own terms.

Key Features

Storefront Entry Points

• Floating side tab that stays visible on every page (left or right, configurable).
• Header and footer links as optional alternatives.
• Customer account menu entry, placed right after My Orders.
• "Cancel my order" button on the order view page for logged-in customers, pre-filled and signed for that specific order.
• Pop-up modal, clicking any entry point opens the form in place; without JavaScript it falls back to the dedicated /withdrawal page.

Two-Step Withdrawal Flow

• Step 1 collects only order number, email and name, plus an optional reason.
• Logged-in customers get an order dropdown of their eligible orders, with name and email pre-filled.
• Step 2 shows an order summary and a "Confirm withdrawal" button before anything is recorded.
• A proof page with a unique reference closes the flow.

Durable-Medium Email Proof

• Customer confirmation email with the proof reference, exact date and time, and the full content of the withdrawal.
• Admin notification email for every new request.
• Signed, pre-filled withdrawal link injected into order confirmation emails, with no template editing required.
• Refund-deadline reminder email to staff before the 14-day refund window lapses.

Customer Account History

• A "My withdrawals" page lists every request with order, date, status and proof reference.
• A View action opens a read-only detail page for each request.
• Ownership is enforced, a customer can only see their own requests.

Admin Management

• A dedicated EU Withdrawal Requests grid under Panth Extensions, with filters, status column and links to each order.
• A request detail screen to read the full proof content, change status (Received, Acknowledged, Refunded, Rejected) and add an internal note.
• An "EU Withdrawal Request" panel on the admin order view, linking the order to its request and showing the current status.

Compliance, Window and Status

• Configurable withdrawal period (default 14 days), counted from the order date or the shipment date.
• Editable compliance notices for right of withdrawal, excluded products, return shipping and refunds.
• Optional order status applied on withdrawal; a status-history comment is always recorded.
• One request per order, a second attempt shows the status page instead of creating a duplicate.

Anti-Abuse and Performance

• Honeypot field, JavaScript speed-trap and per-IP rate limiting on the public lookup step.
• Signed HMAC tokens prevent order-number guessing and power the pre-filled email links.
• No personal data is exposed to anyone who cannot already prove order ownership.
• Front-end markup stays Full Page Cache friendly; customer-specific data loads through a session request.

How This Module Meets the Directive

This extension provides the cancellation function and the supporting workflow. It is not legal advice, set your compliance notices and refund handling to match your own terms and local implementation of the directive.

The Customer Flow

1. The customer opens the form from the floating tab, the link in an order email, or the order view page.
2. Step 1, they enter order number, email and name (logged-in customers pick the order from a list). The reason is optional.
3. The store checks that the order matches the email and is still inside the withdrawal period.
4. Step 2, a summary of the order is shown. The customer clicks Confirm withdrawal.
5. The withdrawal is recorded, a confirmation email is sent as durable proof, staff are notified, and a comment is added to the order.
6. The customer sees a proof page with a reference number.

If the order has already been withdrawn, the form shows the existing request's status instead of recording a second one.

Customer Account Area

Logged-in customers get a My withdrawals entry in the account menu, directly after My Orders. The page lists each request with its order number, date, status badge and proof reference, and a View link to a read-only detail page. The order view page also shows a Cancel my order button for orders that are still eligible.

Admin Management

Open Panth Extensions → EU Withdrawal Button → Withdrawal Requests for the grid. Each row links to its sales order; the Status column and filters help you work through the queue. Open a request to read the full proof content, change its status, and add an internal note.

On the sales order view, an EU Withdrawal Request panel appears for any order that has a request, showing the status badge and a link to the request detail. The relationship is visible from both sides, request to order, and order to request.

Anti-Abuse Protection

The public lookup step is open by design, so it is protected in layers:

• Honeypot field, a hidden input that real customers never fill.
• JavaScript speed-trap, submissions that arrive implausibly fast from a scripted client are rejected, while customers without JavaScript are still able to withdraw.
• Per-IP rate limiting, caps repeated lookups in a time window.
• Signed HMAC tokens, order-number guessing is blocked, and the pre-filled email links cannot be tampered with.
• Generic responses, a wrong order/email pair returns the same message every time, so the form cannot be used to confirm whether an order exists.

None of this stores extra personal data, and the markup stays cacheable.

Hyvä and Luma

The storefront detects the active theme through the shared Panth_Core theme helper and renders the matching markup. Styling is shipped as an external stylesheet, so it is identical on both themes and safe under Hyvä's strict Content Security Policy, no inline styles or inline scripts. Order emails are theme-independent. The floating tab, modal and forms have been tested on both Hyvä and Luma.

Batch Processing and Reminders

A cron job runs on a schedule and processes requests in configurable batches. It re-sends any confirmation email that failed the first time, so the durable-proof guarantee holds even if mail was briefly unavailable. It also emails staff a reminder when a request is approaching the 14-day refund deadline and is still unresolved, which helps the store meet its refund obligation.

Translations

The storefront ships with full translations for:

• English (en_US)
• Dutch (nl_NL)
• German (de_DE)
• French (fr_FR)

All strings use Magento's __() function, so you can add or override any locale from your own theme or language pack.

Troubleshooting

Compatibility

Installation

Composer Installation (Recommended)

composer require mage2kishan/module-eu-withdrawal
bin/magento module:enable Panth_Core Panth_EuWithdrawal
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

Manual Installation via ZIP

1. Download the latest release ZIP from Packagist or the Adobe Commerce Marketplace.
2. Extract the contents to app/code/Panth/EuWithdrawal/ in your Magento installation.
3. Make sure Panth_Core is installed (required dependency).
4. Run the same commands as above, starting from bin/magento module:enable.

Verify Installation

bin/magento module:status Panth_EuWithdrawal
# Expected output: Module is enabled

Configuration

Go to Admin → Stores → Configuration → Panth Extensions → EU Withdrawal Button.

General

Withdrawal Form

Compliance Content

Notifications and Emails

Batch Processing and Reminders

All settings respect Magento's scope hierarchy (default → website → store view).

License

Panth EU Withdrawal Button is licensed under a proprietary license, see LICENSE.txt. One license per Magento installation.