Selling into a second or third EU member state sounds like a simple checkbox on an ecommerce platform – tick Germany, tick France, tick Poland, done. It isn’t. Cross-border compliance inside the EU means reconciling a single regulatory framework (GDPR, the Consumer Rights Directive, the Digital Services Act) with dozens of national implementations that differ in withdrawal periods, cookie enforcement posture, mandatory disclosures, and even how a price has to be displayed next to shipping costs.
Why EU-wide sales still mean country-by-country compliance
GDPR is a regulation, which means it applies directly and identically across all 27 member states – no local transposition needed. But large parts of what a checkout page has to show a buyer come from directives, and directives get implemented differently. The Consumer Rights Directive (2011/83/EU) sets a 14-day withdrawal right EU-wide, but Germany’s Fernabsatzrecht adds stricter formal requirements for the withdrawal form, and France’s Code de la consommation layers on its own pre-contractual information duties under Article L221-5.
A merchant based in Rotterdam selling to Munich, Lyon, and Warsaw is legally operating under Dutch company law, EU-wide GDPR, and then three separate consumer-protection overlays. Miss one and the risk isn’t abstract – German consumer associations (Verbraucherzentralen) are known for sending cease-and-desist letters (Abmahnungen) over missing withdrawal instructions, often within weeks of a site going live, with legal costs starting around €200–800 per letter even before any court involvement.
Language and local disclosure requirements
A privacy policy or terms page translated by machine translation and left unreviewed is one of the most common gaps found during audits. Article 12 of GDPR requires information to be provided “in a concise, transparent, intelligible and easily accessible form, using clear and plain language” – a poor translation with placeholder text or broken legal terminology fails that standard even if the English version is flawless. This gets more complex when a site serves regional variants rather than full translations; see compliance for multilingual websites and regional versions for how language switching itself can create gaps, such as a cookie banner that resets to English defaults when a French visitor switches locale.
Beyond translation quality, some countries require specific local information: Italy’s Codice del Consumo requires the seller’s tax code (codice fiscale) to be displayed, not just a VAT number. France requires mediator information (médiateur de la consommation) to be listed for B2C disputes. These aren’t GDPR items – they get missed precisely because compliance checklists tend to be GDPR-centric.
Pricing, VAT and checkout disclosures across borders
Since July 2021, the EU’s One Stop Shop (OSS) scheme lets merchants report VAT for all EU B2C sales through a single return filed in their home member state, instead of registering in each country separately. That solved a huge administrative burden, but it didn’t remove local display rules. Germany’s Preisangabenverordnung (PAngV) requires the final price including VAT and any mandatory surcharges to be shown as prominently as the base price – not revealed only at the final checkout step. Belgium requires energy-labelling disclosures for certain product categories that other member states don’t mandate on the product page itself.
A common failure pattern: a merchant configures one checkout flow, tests it against Dutch requirements, and assumes it satisfies everyone. It usually satisfies about 80% of requirements EU-wide and fails the remaining 20% that are country-specific – usually withdrawal-form formatting, mediator disclosures, or price-display order. Details on the checkout-specific pieces are covered in compliance for eCommerce – returns, refunds and disclosures.
Cookie consent enforcement varies by country in practice
The ePrivacy Directive sets the baseline consent requirement EU-wide, but enforcement posture differs sharply by data protection authority. CNIL in France has issued repeated fines specifically over cookie walls and pre-ticked consent boxes – including a €60 million fine against Google in December 2021 partly tied to cookie refusal mechanisms being harder to use than acceptance. The Dutch Autoriteit Persoonsgegevens and Spain’s AEPD have both published their own cookie guidance with slightly different thresholds for what counts as “equally easy” refusal versus acceptance. A banner that passes a UK ICO-style review isn’t automatically compliant with CNIL’s stricter symmetry requirement.
Consumer rights notices need to match the buyer’s jurisdiction
The 14-day withdrawal period is EU-wide, but what has to be disclosed about it, and how prominently, differs. This is where a lot of sites get caught: they display accurate rights information, but only in the default site language rather than matched to the buyer’s actual country. A visible, jurisdiction-correct notice matters more than most merchants assume; see consumer rights display legal requirements and best practices for the specifics on what has to be shown and where.
Common mistakes when scaling across EU markets
Three patterns show up repeatedly during audits of multi-country EU sites. First, treating GDPR compliance as sufficient proof of “EU compliance” overall – GDPR covers data protection, not consumer contract law, pricing display, or dispute-resolution disclosures. Second, copying a compliance setup validated for one country (often Germany, since its enforcement is aggressive) and assuming it automatically satisfies looser jurisdictions, when in fact some requirements like Italy’s tax code display aren’t covered by a German-style setup at all. Third, updating the checkout flow or a promotional banner without re-checking whether the change breaks a country-specific disclosure – a redesigned price display that hides VAT-inclusive pricing until the final step, for instance, can silently violate German PAngV rules while looking perfectly normal to a Dutch reviewer.
A GRC lead scaling into new EU markets typically starts by mapping which country-specific rules apply on top of the EU baseline – not treating “EU compliant” as a single binary state, but as a stack: GDPR at the top, national consumer-protection transpositions in the middle, and local disclosure quirks at the bottom.
Frequently asked questions
Does GDPR compliance automatically satisfy consumer protection law across the EU?
No. GDPR governs data protection and applies uniformly, but consumer rights, pricing display, and dispute-resolution disclosures come from directives implemented differently in each member state – a site can be fully GDPR-compliant and still violate Germany’s price display rules or France’s mediator disclosure requirement.
Do I need a separate VAT registration for each EU country I sell into?
Not since the One Stop Shop (OSS) scheme took effect in July 2021 – a single OSS return filed in the home member state covers B2C VAT reporting across the EU for most goods, though local price-display rules still apply regardless of how VAT is filed.
Is machine-translated content acceptable for legal pages?
It’s acceptable as a starting point but not as a final version. GDPR’s transparency requirement and several national consumer laws expect clear, accurate language – errors in legal terminology or placeholder text left in a translated withdrawal-rights section are a frequent trigger for consumer-association complaints, particularly in Germany.
Selling across multiple EU countries isn’t one compliance project, it’s several overlapping ones running in parallel, and the gaps tend to open quietly – a checkout redesign, a new locale added without its own legal review, a cookie banner that behaves differently after a CMS update. Reviewing each target country’s specific disclosure rules against the current live site, not just the original launch configuration, is what keeps a multi-country storefront out of the cease-and-desist pile.