Introduction
Have you ever read the Terms of Service of an online store and wondered whether anyone could actually enforce them? If you run an EU e-commerce business, that question cuts both ways. Your ToS are not a legal formality you copy from another store. They are either functioning risk infrastructure or a regulatory liability waiting to be invoked against you, and since 2022 the stakes include fines whose maximum must be at least 4 per cent of your annual turnover for widespread cross-border infringements. We work daily with e-commerce sellers, dropshippers, Amazon merchants, and direct-to-consumer brands selling into the EU, and we see the same clauses voided over and over again, costing operators five-figure refund waves, regulator findings, and platform suspensions. This article is the first of two on Terms of Service and focuses on e-commerce. A follow-up will cover SaaS, where the rules look similar on the surface but bite very differently.
Your ToS sit at the intersection of at least four binding EU regimes plus a fifth on the horizon. The Unfair Contract Terms Directive 93/13/EEC applies the fairness test to every consumer contract term that was not individually negotiated. The Consumer Rights Directive 2011/83/EU, as amended by the Modernisation Directive 2019/2161, governs your pre-contract disclosures, withdrawal rights, and checkout flow. The Sale of Goods Directive 2019/771 sets the statutory conformity guarantee you cannot contractually limit. The Digital Services Act, Regulation 2022/2065, fully applicable since February 2024, adds transparency duties for online marketplaces and bans manipulative interface design on online platforms. And the Digital Fairness Act, expected as a Commission proposal in the fourth quarter of 2026, is set to tighten subscription cancellation flows, drip pricing, and contract design more broadly. So if your current ToS were drafted before 2022, or if you have quietly localised a US template, your document no longer matches the regulatory environment it operates in.
The Unfair Terms Test: How Courts Decide Whether Your Clauses Survive
Every other compliance question in your ToS flows from the fairness test. Under Article 3(1) of Directive 93/13, a term that has not been individually negotiated, which is essentially every clause in a standard ToS, is unfair if, contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations to the detriment of the consumer. That is the textbook test. The operational reality is simpler: if a clause shifts risk, cost, or inconvenience onto the consumer in a way they could not reasonably have anticipated and never actually negotiated, it is at risk.
Two consequences follow. First, under Article 5, your ToS must be drafted in plain, intelligible language, and where a term is ambiguous the interpretation most favourable to the consumer prevails. Legalese is not a defence. It is a liability. Second, under Article 6(1), an unfair term is not binding on the consumer, and the rest of the contract survives only if it is capable of continuing without the offending clause. In Case C-260/18 Dziubak, the Court of Justice confirmed that where the unfair term defines the main subject matter of the contract and the contract cannot continue without it, the whole agreement may fall. A single bad clause does not just lose you that clause. It can unravel the entire bargain.
The Grey List: Seven Clauses That Get Struck Down
The Annex to Directive 93/13 contains an indicative, non-exhaustive list of terms that may be considered unfair, which practitioners call the grey list. Appearing on the list is not an automatic kill at EU level, although many Member States have turned parts of it into black lists in their national implementations. These are the seven clauses we most often see challenged and voided in e-commerce:
- Liability exclusions for death or personal injury caused by your act or omission. This is treated as automatically void in many national laws.
- Blanket limits on statutory rights, such as “all sales final” clauses that try to override the two-year conformity guarantee under the Sale of Goods Directive or the 14-day withdrawal right. Statutory consumer rights cannot be contracted away.
- Unilateral modification clauses, the classic “we may change these Terms at any time without notice”. These fail unless the contract states a valid reason and you give reasonable notice and a free right to terminate.
- Automatic renewal clauses with unreasonably early cancellation deadlines for the consumer.
- Forfeiture of advance payments without equivalent compensation for the consumer where you are the party cancelling the contract.
- Excessive penalty clauses requiring a consumer who breaches to pay disproportionately high compensation.
- Forum selection and arbitration clauses that push the consumer into an inconvenient jurisdiction. These fall foul of the Annex and collide with the consumer’s right under Article 18(1) of the Brussels I bis Regulation to sue in their home Member State, from which a clause may depart only in the narrow situations allowed by Article 19.
The fix is not to delete all of these clauses, because many are commercially necessary. The fix is to draft them so they pass the fairness test, with proportionate notice periods, reciprocal obligations where possible, transparent calculation methods, and exclusions calibrated to what is actually reasonable.
Incorporation and the Checkout: Where Your ToS Are Won or Lost
For your ToS to bind anyone, the consumer has to validly agree to them, and EU law is increasingly precise about what valid agreement looks like online. Clickwrap, where the user actively ticks an unticked box or clicks a button that expressly accepts the terms, is the mechanism the Court of Justice validated in Case C-322/14 El Majdoub for incorporating a jurisdiction clause by electronic means, provided the text can be saved and printed, albeit in a business-to-business dispute. Browsewrap, where the user is deemed to accept by merely using the site, is consistently considered insufficient. If your ToS live in a footer under a “by using this site you accept our terms” notice, you do not have a binding contract. You have a footer. The Annex to Directive 93/13 reinforces the point, because a term that irrevocably binds the consumer to conditions they had no real opportunity to read before contracting is itself on the grey list.
The checkout button carries its own rule with a brutal sanction. Under Article 8(2) of the Consumer Rights Directive, where an electronic order entails an obligation to pay, the button must be labelled “order with obligation to pay” or a corresponding unambiguous formulation. In Case C-249/21 Fuhrmann-2 the Court of Justice held that the words on the button alone are decisive, without regard to the surrounding ordering process, and found “complete booking” insufficient. If your button says “Complete”, “Confirm”, or “Submit”, the consumer is not bound by the contract or the order at all. That is the most expensive misunderstanding in EU e-commerce, so test your checkout button today. And do not bundle your ToS acceptance, privacy policy, and marketing consent into a single tick box. Under Article 7(2) of the GDPR a consent request must be clearly distinguishable from other matters, and consent must be specific. The clean mechanic is one box for accepting the ToS, a clearly linked privacy notice provided as information rather than something to “accept”, and a separate, entirely optional opt-in for marketing.
The Cross-Border Traps: Rome I, Brussels I bis, and Geo-Blocking
If you sell across the EU, or target EU consumers from outside it, your choice-of-law and jurisdiction clauses face two layers of override. Under Article 6 of the Rome I Regulation, even a valid choice of law cannot deprive the consumer of the mandatory protections of the law of their habitual residence. If your ToS say “these Terms are governed by the laws of Delaware” and you ship to Lyon, French consumer protection still applies to your French customer. Under Articles 17 to 19 of the Brussels I bis Regulation, the consumer can sue you in their own Member State or in yours, and your forum clause cannot strip them of that choice.
Add the Geo-Blocking Regulation 2018/302, which prohibits discrimination based on nationality, place of residence, or place of establishment in the three scenarios of Article 4: sales of goods without physical delivery by the trader, electronically supplied services, and services received at a physical location. A nuance many operators miss: the Regulation does not oblige you to deliver to every Member State, and you may lawfully limit your shipping zones. What it prohibits is refusing a customer from another Member State who accepts the delivery terms you actually offer, so a French customer who accepts collection in Slovenia or arranges their own forwarding must be able to buy on the same terms as a Slovenian customer. The Commission launched an evaluation of the Regulation with a call for evidence in February 2025, and the European Court of Auditors published Special Report 03/2025 on unjustified geo-blocking, so attention on this file is intensifying, not loosening.
The Penalty Regime: Why This Matters Now
One number is worth memorising. Article 8b of Directive 93/13, inserted by the Modernisation Directive 2019/2161 and applicable since 28 May 2022, requires penalties for unfair terms infringements to be effective, proportionate, and dissuasive. For widespread infringements and widespread infringements with a Union dimension enforced under the Consumer Protection Cooperation Regulation 2017/2394, Member States must provide for fines whose maximum amount is at least 4 per cent of the trader’s annual turnover in the Member States concerned, or at least 2 million euros where turnover information is not available. The same penalty regime applies to Consumer Rights Directive infringements under its amended Article 24. National regulators have been using these powers since 2022, and ToS audits have become a routine first step in cross-border consumer protection investigations. With the Digital Fairness Act proposal expected in late 2026, cleaning up your ToS now beats retrofitting them under deadline pressure.
Conclusion
In summary, a defensible setup looks like this: a ToS document in plain, intelligible language with reciprocal obligations rather than one-sided rights, clickwrap incorporation with a separate unticked acceptance box, an “order with obligation to pay” button in the customer’s language on every checkout flow, a withdrawal information block with the model withdrawal form, a warranty section that acknowledges rather than limits the statutory conformity guarantee, modification clauses with reasonable notice and a free termination right, choice-of-law and forum clauses drafted in the knowledge that the consumer’s home protections and home courts override them, and a complaints handling policy displayed as prominently as your sales pitch. If you are not certain your Terms of Service, checkout flow, or withdrawal policy would survive a real challenge, book a call with our team or another qualified professional for personal guidance and concrete legal advice.
Reflecting on these obligations, your Terms of Service look like a paperwork item but function as one of the highest-leverage pieces of risk infrastructure your business has. The fairness test rewards transparency and reciprocity, the checkout rules reward precision, and the cross-border rules reward realism about whose law actually governs. The operators who thrive in EU e-commerce treat their ToS as a competitive moat rather than a template download, and the follow-up article in this mini-series will apply the same lens to SaaS terms, where the rules look similar but bite differently. Stay informed to navigate this landscape effectively, and remember: Compliance with the law – prevents the flaw!
