This article explains how the EU right of withdrawal interacts with digital downloads and how Alva Digital Downloads handles it operationally. It is not legal advice. Rules vary by member state and change over time — consult a qualified lawyer in your jurisdiction before relying on any feature for compliance.
What is the EU right of withdrawal for digital downloads?
The EU right of withdrawal gives consumers 14 days to cancel most online purchases and get a full refund, no reason required. For digital content delivered instantly — a PDF, a video, a font, a license key — Article 16(m) of the Consumer Rights Directive lets that right disappear early, but only if the buyer gives explicit prior consent to immediate delivery and acknowledges that the right is lost once the download begins.
The consent is the whole game. It is what closes the gap between "instant delivery" and "14-day cancellation". Without it on file, an EU customer can download your file, keep it, and still claim a refund inside the 14-day window.
Why digital sellers lose these disputes without a consent record
Under the Consumer Rights Directive the burden of proof sits with the merchant, not the buyer. If a customer requests a withdrawal or opens a chargeback, you are the one who has to show they knowingly waived the right. A checkout that simply hands over a download link records nothing, so there is nothing to show.
The practical result: the refund is granted, or the chargeback is lost, and the file is already in the customer's hands. A single consent checkbox at the moment of delivery — logged and timestamped — is what turns "your word against theirs" into documented evidence.
How Alva Digital Downloads captures withdrawal-right consent
Alva Digital Downloads captures the waiver with a server-side gate. When you enable it, Alva will not issue a download link or file for an order until the buyer ticks a consent box confirming they want immediate delivery and understand they lose the 14-day right of withdrawal once the download begins.
The gate is enforced on every surface that can deliver a file: the download page reached from the delivery email, the thank-you page, the customer account page, the order status page, the external API, and link-redirect products. Surfaces that cannot show the checkbox inline direct the buyer to the consent box on their emailed download link instead. The feature is off by default, free on every plan, and consent is captured once per order — the customer is never asked twice for the same order.
What Alva records as your proof
Every time a customer consents, Alva writes an immutable, timestamped audit record. It holds the customer's email, the order it belongs to, the exact wording they agreed to, the consent version, the surface where consent was captured, their IP address, and their browser user-agent. The record is never edited afterwards.
Alva also emails the customer a confirmation as a durable-medium record of the waiver — a requirement under the directive, not a courtesy. Each order's consent shows as a badge on that order's detail page, and you can export every record to CSV from Settings → EU right of withdrawal. You hold the burden of proof, so keep your own copy.
Two things the consent gate does not do for you
The consent gate captures the waiver at the moment of delivery. That is necessary but not sufficient. EU law expects two more things, and Alva surfaces both on the same settings page so you do not have to hunt for them.
1. Tell customers before they buy (required)
The directive requires a separate pre-contractual disclosure: you must inform customers before they purchase that they lose the 14-day right of withdrawal for digital content. Consent captured at delivery does not discharge this earlier duty. Alva gives you ready-made wording to paste into your product descriptions, cart, or terms:
Digital downloads: you consent to immediate access and lose your 14-day right of withdrawal once the download begins.
2. Add the order-process checkbox (stronger)
For the strongest posture — recommended for Germany and other EU-strict markets, where the so-called safe-harbour approach captures consent during the order process itself — add the EU Withdrawal Consent block to your product page in the Shopify theme editor. It collects consent at checkout rather than at the point of download, and records the wording the customer actually saw.
The block enforces consent only for the product it is placed on, so add it to every product template your digital products use. Purchases that bypass the checkbox — a quick-add from another page, for example — are still protected by the download-time consent gate, so nothing slips through.
Customising and translating the consent wording
By default Alva shows the European Commission's official wording, built in word-for-word:
I hereby consent to immediate performance of the contract and acknowledge that I will lose my right of withdrawal from the contract once the download or streaming of the digital content has begun.
The German and French official versions are also built in; other languages fall back to the English sentence. You can override the wording per shop, up to 5,000 characters. Changing it automatically bumps the consent version — and records already captured keep the exact wording the customer originally agreed to, so your evidence never rewrites itself.
In-store POS sales are exempt
On-premises point-of-sale purchases carry no right of withdrawal under EU law, so Alva skips the consent step for in-store POS orders automatically. The gate applies only to online orders — your in-person checkout stays exactly as fast as it is today.
How to turn on withdrawal-right consent
Customer email sending has to be on first: the consent confirmation email is the legally required durable-medium record, so Alva refuses to enable the gate while customer emails are switched off. With emails on, open Settings → EU right of withdrawal in the Alva admin, tick Require withdrawal-right consent, and save. The gate takes effect for new orders immediately.
That is the whole setup. For the full walkthrough — including where to find the export and the theme block — see the help article on EU right-of-withdrawal consent. And because compliance and protecting your files from misuse go hand in hand, it is worth reviewing both together.
Frequently asked questions
No. With withdrawal-right consent enabled, the customer ticks a single consent box and the download button unlocks immediately — the file is delivered the moment they consent. Alva Digital Downloads records the consent once per order, so the same customer is never asked twice for one order, and in-store POS sales skip the step entirely.
No. The gate captures the customer's waiver at the moment of delivery, but EU law also requires a separate pre-contractual disclosure telling customers before they buy that they lose the 14-day right of withdrawal for digital content. Alva gives you copy-paste wording for that, and you add it to your product descriptions, cart, or terms yourself.
Alva writes an immutable, timestamped record holding the customer's email, the order, the exact wording they agreed to, the consent version, the surface where it was captured, their IP address, and their browser user-agent. The customer is also emailed a confirmation as a durable-medium record, and you can export every record to CSV as your proof.
The 14-day right of withdrawal is EU and EEA consumer law, with comparable rules in the UK. It protects consumers, not business buyers. When you enable Alva's consent gate it applies to all online orders; on-premises POS sales are always exempt. If you never sell to EU consumers you generally do not need it — confirm your own obligations.
Consent records are deleted when you uninstall Alva Digital Downloads, along with the rest of your shop's data. Because you carry the burden of proving consent, export your consent records to CSV from Settings then EU right of withdrawal before you uninstall, so you keep the evidence even after the app is gone.