Who needs withdrawal-right consent?
Alva Digital Downloads is a Shopify app that delivers files the instant an order is paid. Under EU consumer law a customer normally has 14 days to withdraw from an online purchase. Article 16(m) of the Consumer Rights Directive lets that right be extinguished for digital content — but only if the customer gives explicit prior consent to immediate delivery and acknowledges that they lose the right once the download begins.
If you sell instant digital downloads to consumers in the EU, this feature captures that consent and waiver at the point of delivery. It is off by default, available on every plan, and has no separate cost. Merchants selling only to businesses, or only outside the EU, generally do not need it — but confirm your own obligations.
What happens when you turn it on
While the setting is off, nothing changes: downloads are delivered exactly as before. When you turn it on, Alva will not issue a download link or file for an order until the buyer ticks a consent box.
The gate is enforced server-side on every surface that can deliver a file: the download page reached from the delivery email, the thank-you page, the customer account page, the order status page, the external API, and link-redirect products. Surfaces that cannot show the checkbox inline simply direct the buyer to the consent box on their emailed download link.
When a customer consents, Alva records an immutable, timestamped audit record — including their IP address and browser — and emails them a confirmation as a durable-medium record of the waiver. Consent is captured once per order; the customer is not asked again for the same order.
Turn on withdrawal-right consent
Customer email sending must be enabled first: the consent confirmation email is the legally required durable-medium record of the waiver, so Alva refuses to turn on withdrawal-right consent while customer emails are switched off. If you have disabled emails, turn them back on in Settings before continuing.
Switch the feature on from the settings page:
- In the Alva admin, open Settings → EU right of withdrawal.
- Tick Require withdrawal-right consent.
- Save. The gate takes effect for new orders straight away.
That is all that is needed to start gating downloads. The two steps below cover the rest of your EU obligations, which the consent gate alone does not satisfy.
Two things you must also do
The consent gate captures the waiver at the moment of delivery. EU law expects two more things from you, and Alva surfaces both on the same settings page.
1. Tell customers before checkout (required)
EU law also requires a separate pre-contractual disclosure: you must inform customers before they buy that they lose the 14-day withdrawal right for digital content. The consent gate at delivery does not discharge this duty. The settings page gives you ready-made text to copy into your product descriptions, cart, or terms:
Digital downloads: you consent to immediate access and lose your 14-day right of withdrawal once the download begins.
2. Add the order-process checkbox (stronger)
For the strongest legal posture — recommended for German and EU-strict markets, where the so-called safe-harbour approach captures consent during the order process itself — add the EU Withdrawal Consent block to your product page in the Shopify theme editor. It collects consent at checkout rather than at the point of download.
The block enforces consent only for the product it is placed on, so add it to every product template your digital products use. Purchases that bypass the checkbox — for example quick-adds from other pages — are still protected by the download-time consent gate.
Customise the wording (optional)
By default, Alva shows the European Commission's official wording. The English version is built in word-for-word:
I hereby consent to immediate performance of the contract and acknowledge that I will lose my right of withdrawal from the contract once the download or streaming of the digital content has begun.
German and French official versions are also built in; other languages fall back to the English sentence. You can override the wording per shop in the Consent wording field. Changing it automatically bumps the consent version, and records already captured keep the exact wording the customer originally agreed to.
Custom wording is limited to 5,000 characters.
Your proof: export consent records
You hold the burden of proving that consent was given. Every order's consent appears on that order's detail page — a badge showing the consent version, the surface where it was captured, the IP address, and the exact wording the customer agreed to.
To keep a full copy, open Settings → EU right of withdrawal and use Export consent records (CSV) in the Consent records section. Records are deleted when you uninstall Alva, so export them before uninstalling.
In-store POS sales are exempt
On-premises point-of-sale purchases carry no right of withdrawal, so Alva skips the consent step for in-store POS orders automatically. The gate applies only to online orders.
What your customer sees
At the point of download the customer sees a consent checkbox — not pre-ticked — showing the wording above. The download button stays disabled until they tick it. As soon as they consent, the file is delivered.
If a customer declines, they do not get immediate access and their 14-day right of withdrawal is preserved. You may then receive a withdrawal or refund request, which you handle as you normally would.
Frequently asked questions
No. When withdrawal-right consent is enabled, the customer simply ticks a consent box and the download button unlocks — it takes one click, and the file is delivered immediately afterwards. Consent is recorded once per order, so the customer is not asked again for the same order. In-store POS sales skip the step entirely.
No. The consent gate captures the customer's waiver at the moment of delivery, but EU law also requires a separate pre-contractual disclosure that tells customers before checkout that they lose the 14-day withdrawal right for digital content. Alva gives you copy-paste text for that on the settings page, and you must add it to your product descriptions, cart, or terms yourself.
Alva writes an immutable, timestamped record containing the customer's email, the order it belongs to, the exact wording they agreed to, the consent version, the surface where it was captured, their IP address, and their browser user-agent. The record is never edited afterwards, and the customer is emailed a confirmation as a durable-medium record of the waiver.
Yes. Leave the wording blank to use the European Commission's official sentence — English, German, and French are built in, and other languages fall back to English — or enter your own wording per shop. Changing the wording automatically bumps the consent version, and records already captured keep the exact wording the customer originally agreed to.
Each order's consent appears on that order's detail page, showing the version, where it was captured, the IP address, and the exact wording. To export everything at once, open Settings, then EU right of withdrawal, and use Export consent records (CSV) in the Consent records section. You hold the burden of proof, so keep your own copy.
Consent records are deleted when you uninstall the app, along with the rest of your shop's Alva data. Because you carry the burden of proving consent, export the consent records to CSV before you uninstall so you keep your evidence.
The most likely reason is that customer email sending is switched off. The consent confirmation email is the legally required durable-medium record of the waiver, so Alva refuses to enable withdrawal-right consent while customer emails are disabled. Turn customer emails on in Settings first, then enable the consent gate.
This article describes how Alva Digital Downloads works and what it asks of you operationally. It is not legal advice. EU withdrawal-right rules vary by member state and change over time, and only you know your products and customers. Consult a qualified lawyer in your jurisdiction before relying on this feature for compliance.
See also
Was this helpful?
Last updated 2026-07-02