GS Vision
BG
Blog

2026 EU Regulatory Changes: What Every Online Store Owner Needs to Know

2026 is shaping up to be one of the most regulatory-intensive years in the history of European ecommerce. Within a span of nine months, six separate obligations derived from different EU directives and regulations come into force. They touch nearly every dimension of running an online business: store interface, marketing claims, packaging, artificial intelligence, and customs procedures.

This article provides a structured overview of each change, its effective date, and what it means in practice for PrestaShop store owners.

Timeline of Upcoming Requirements

EU E-commerce Regulations 2026

June 19, 2026: Mandatory Cancellation Button

Directive 2023/2673 requires merchants to provide a simplified mechanism for exercising the right of withdrawal directly online — through a clearly visible button or feature built into the store interface. Burying the return procedure in the Terms and Conditions or asking customers to send an email is no longer compliant.

The practical requirements include a clearly labeled button or link placed prominently in the user interface, a standardized withdrawal form accessible within no more than two steps, and an automated confirmation sent to the customer once the withdrawal has been submitted.

The directive took effect on June 19, 2026, across all EU member states. Implementation in PrestaShop requires theme customization and, in most cases, a dedicated module, since the default functionality does not fully cover the requirements out of the box.

We covered this topic in depth in a separate article: Directive 2023/2673 — The Mandatory Cancellation Button for Online Stores.

August 2, 2026: AI Act Transparency Obligations

The transparency obligations under the European AI Act enter into force on August 2, 2026. They apply to any system with an AI component used in a commercial context.

The transparency obligations taking effect on August 2, 2026 apply to two specific types of systems: chatbots and virtual assistants, where users must be informed they are interacting with AI, and systems generating synthetic content (deepfakes, AI-generated images or text), whose outputs must be marked as artificially generated. Practices such as social scoring or exploiting vulnerable consumers are also prohibited — these bans have applied since February 2025.

For PrestaShop stores, the most immediate practical consequence from August 2026 concerns customer service chatbots. Recommendation engines and pricing algorithms fall into the minimal-risk category and carry no specific transparency obligations under the AI Act, though auditing all AI integrations in the context of the broader regulatory landscape remains sensible practice.

August 12, 2026: New Packaging Rules (PPWR)

The European Packaging and Packaging Waste Regulation (PPWR) introduces concrete obligations from August 12, 2026. The regulation covers the design, materials, and labeling of all packaging, including the shipping packaging used when fulfilling orders.

For online merchants, this means reviewing current packaging solutions against recyclability requirements, updating labels to comply with new environmental marking standards, and adjusting logistics processes where existing packaging does not meet the new criteria.

The regulation is particularly significant for stores with high shipment volumes or those operating in sectors such as food, cosmetics, and household chemicals, where packaging is already regulated on multiple levels.

September 27, 2026: Greenwashing Crackdown (EmpCo Directive)

The Empowering Consumers Directive (EmpCo) tightens the rules around what environmental claims merchants can make about their products and business. From September 27, 2026, any marketing claim using terms like "eco-friendly," "green," "natural," "sustainable," or "carbon neutral" must be backed by specific, verifiable documentation.

Vague descriptions without certification or a measurable basis become illegal. Penalties are substantial — the directive allows for fines of up to 4% of annual turnover in the relevant member state (unlike the GDPR, where penalties are calculated against global annual turnover).

For store owners, the practical steps include reviewing all product descriptions, category pages, and marketing materials; identifying and either removing or substantiating every environmental claim; and documenting the verifying certifications or data for products where such claims are retained.

This change has the greatest impact on stores operating in natural cosmetics, organic food, textile, and building materials segments.

2026: End of the Customs Duty Exemption for Small Parcels

The European Council gave its final approval to changes in the customs regime for small parcels imported from outside the EU. Under the previous rules, shipments with a declared value below €150 were exempt from customs duties — a rule that effectively gave platforms like Temu and Shein a significant price advantage over European merchants.

With the removal of this exemption, all shipments from third countries will be subject to customs duties regardless of their declared value. The change is primarily aimed at regulating direct imports from China and will be phased in during 2026.

For Bulgarian and European online merchants competing against Asian platforms, this represents a potentially leveling shift in the competitive landscape. Stores with international shipping operations outside the EU will need to revisit their pricing and logistics models.

GDPR: Stricter Enforcement

The substance of the GDPR is not changing in 2026, but enforcement is intensifying significantly. The European Data Protection Board has signaled a move from an "education" phase to an "action" phase, with supervisory authorities across the EU expected to become considerably more active.

This means inspections are becoming more frequent, documentation requirements more rigorous, and fines more likely. Penalties can reach up to 4% of global annual turnover or €20 million, whichever is higher.

For PrestaShop stores, the specific areas under scrutiny include cookie and consent management, data processing by third parties (payment processors, marketing tools, analytics platforms), and the documentation of data processing activities. A cookie banner configured three years ago may no longer meet current standards.

How to Prepare

The six changes carry different deadlines, but preparing for each requires technical modifications to the store, content reviews, and updates to internal processes. Leaving everything to the last moment carries serious risk — particularly for changes with more complex technical implementations, such as the cancellation button and GDPR compliance infrastructure.

The sensible approach is to prioritize changes by both deadline and implementation complexity, and to plan technical tasks with sufficient lead time before each date.

"Many merchants treat regulatory compliance as a purely legal concern, leaving it to the last minute. In reality, changes like the cancellation button or GDPR consent updates require deep technical integration into the PrestaShop core and theme. Planning these early is key to avoiding penalties and store disruption." — Stefan Nikolov, PrestaShop Expert at GS Vision

If you manage a PrestaShop store and need an assessment of its current compliance status and a plan for the upcoming requirements, feel free to reach out through our contact page.

Frequently Asked Questions

When does the mandatory cancellation button requirement take effect? Directive 2023/2673 has been in force since June 19, 2026. The obligation applies to all online merchants selling to consumers in the EU.

Does the AI Act apply to small online stores? Yes, to the extent that they use AI-powered tools — chatbots, recommendation engines, or marketing automation. Transparency obligations apply regardless of business size.

What happens to customs duties on parcels under €150 from China? The customs duty exemption for small parcels is being phased out during 2026 following the European Council's final approval. All incoming shipments from outside the EU will be dutiable regardless of declared value.

Do I need a lawyer for GDPR compliance? For complex cases, yes. For a standard online store, however, most technical requirements can be addressed with properly configured tools and documentation, without necessarily engaging legal counsel for every step.

Sources