Digital Products Refund Policy: The EU 14-Day Rule, Chargebacks, and How to Write One

Digital product refunds trip up new sellers for one reason: the rules are not what people assume. In the EU, customers have a 14-day right of withdrawal for online purchases — but there is a waiver built specifically for digital content that most sellers have never read. In the US, there is no federal cooling-off period for digital goods at all, yet chargebacks arrive anyway, and the card networks decide those, not you. This guide covers what actually binds a store selling ebooks, templates, courses, and software licenses, the clauses that matter, and how to generate the policy set free instead of guessing.

The EU 14-day rule, and the waiver everyone gets wrong

The EU Consumer Rights Directive gives online shoppers 14 days to withdraw from a purchase, starting the day after delivery, for a full refund. For digital content, Article 16(m) removes that right under two conditions, and both must hold: the customer must expressly consent to the download or stream beginning before the 14-day period ends, and must acknowledge that they lose the right of withdrawal once it starts. Both acknowledgments need to be captured at checkout, in plain language, before the button. A line buried in your terms of service does not qualify, because consent must be given for each digital order, not once in a lifetime.

If your checkout does not capture that double acknowledgment, the waiver does not apply, and the customer keeps the 14-day right even after downloading the file. That is the gap most EU-facing stores fall into: they refuse a refund on day three, the customer calls the card issuer, and the chargeback lands because the store never collected valid consent.

US reality: no cooling-off, but chargebacks rule

There is no federal law forcing refunds on digital goods in the US. Your refund policy is a contract you write, and stores can lawfully sell digital products as non-refundable. What actually governs disputes is the card network rules: Visa and Mastercard let customers dispute a charge for reasons including "not as described" or "unauthorized," and the issuer decides based on evidence. A $29 template chargeback is usually cheaper to refund than to fight, which is why a written policy plus delivery proof matters more than legal theory.

Two US-specific notes. If you sell to California consumers and meet CCPA revenue thresholds, the privacy side of your store has obligations, covered in our CCPA compliance guide. And "all sales final" policies still have to respect state consumer protection law: California, for example, requires certain notices if you refuse refunds, credits, or exchanges entirely.

Five clauses every digital refund policy needs

1. What counts as a digital product. Define the scope — ebooks, PDFs, templates, courses, software licenses, credits — so a customer cannot claim a physical bundle was covered by the digital clause.

2. Refund window and decision rule. Either a fixed window (7 or 14 days) with conditions, or all-sales-final with the EU acknowledgment in place. Avoid vague wording like "case by case": ambiguity generates disputes because the customer assumes the generous reading.

3. License revocation on refund. If you refund, the license ends: the customer must delete the files, and access to course platforms or update feeds is terminated. Say so explicitly. Without this clause, a refunded customer can lawfully keep using what they bought, and you have no contractual basis to cut access.

4. What does not qualify. Progress consumed (half a course watched), products materially downloaded after the acknowledgment, or custom work. List these plainly, not in legalese.

5. How to request a refund. One email address or form, a stated response time (e.g., within 3 business days), and the refund method (original payment method, as card network rules generally require).

Do you even need a separate shipping policy? No.

Digital stores ask this constantly. No shipping means no shipping policy, but your terms of service should cover delivery method, download window, and what happens if a file link expires. Bundle digital and physical goods, though, and the physical half needs the full shipping policy treatment.

A template you can adapt today

"Due to the nature of digital products, all sales are final once the file is downloaded. Before completing your purchase you consent to immediate delivery and acknowledge that the statutory right of withdrawal expires upon download [EU customers]. If a file is corrupted, delivered incorrectly, or does not match its description, contact support within 14 days for a replacement or full refund. Refunds revoke the license: you agree to delete all copies and your access to updates ends when the refund is issued. Refunds are returned to the original payment method within 5 business days."

Adapt the window and conditions to what your support load can absorb. A generous refund window on a $12 ebook costs less than the chargebacks a strict one invites; a $900 course with instant full access may need the strict version plus the EU acknowledgment flow. Either way, put the policy on its own page, link it in the footer and at checkout, and keep the generator-made privacy and refund policy set consistent with it.

The legal boundary of 'no-refund': EU withdrawal exceptions and UK CCR 2013

EU Directive 2011/83/EU, Article 16(m), removes the 14-day right of withdrawal for digital content that is not supplied on a tangible medium, but only when two cumulative conditions are met at the moment of purchase. First, the consumer must expressly consent to performance beginning before the withdrawal period expires. Second, the consumer must acknowledge that this consent causes the withdrawal right to lapse. Both conditions must be satisfied separately and affirmatively — a checkbox next to "I agree to the Terms" that buries the acknowledgment in linked text does not clear the bar. Regulators in Germany and the Netherlands have fined sellers specifically for that pattern. If your checkout does not show a standalone tick-box confirming loss of withdrawal before the purchase button fires, the waiver is invalid and the 14-day right survives delivery.

The UK Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 — CCR 2013 — replicates the same structure post-Brexit. Regulation 37 removes the cancellation right for digital content once performance has begun, again only with the consumer's express prior consent and the acknowledgment of lost cancellation rights. The practical difference from the EU rule is that UK enforcement sits with Trading Standards rather than a dedicated consumer protection agency, and complaints tend to escalate through the ombudsman route rather than direct fines. But the legal exposure is identical: an invalid waiver means a refund obligation that your "all sales final" banner cannot override.

A compliant waiver notice for your checkout might read: "By completing this purchase you expressly request that delivery of the digital content begins immediately, and you acknowledge that you lose your right of withdrawal (EU) or cancellation (UK) once download begins." That sentence, plus a mandatory checkbox ticked by the consumer, satisfies both frameworks. Store the checkbox event in your order record — timestamp, IP, and order ID — because if a dispute escalates you will need to prove it was ticked, not just that your page contained the wording.

Subscriptions and memberships: pro-rata, trial cliffs, and cancellation mechanics

Subscription digital products create a different refund surface than one-time purchases. The two most common approaches to mid-period cancellation are pro-rata refund and no-refund-for-current-period. Pro-rata means the customer receives credit or cash for the unused portion of the billing cycle: a $30/month plan cancelled on day 10 would yield a $20 credit. No-refund-for-current-period means access continues until the cycle ends and no money is returned. Both are legally defensible in most jurisdictions when disclosed clearly at sign-up, but they carry different chargeback risk. The no-refund approach generates more disputes because customers who forget a renewal and cancel the same day often expect to recover at least something; when they cannot, a meaningful portion of them file a chargeback rather than accept the answer.

Trial periods create their own problem when they convert silently. Under the EU's 2022 Digital Services Act and the FTC's Negative Option Rule (updated 2024), sellers must send a reminder before a free trial converts to a paid subscription — the exact timing varies by jurisdiction, but the FTC expects notification "before the charge" and the DSA requires a specific reminder for trials longer than 14 days. That reminder must include the charge amount, the billing date, and a direct link or button to cancel. If your onboarding email sequence does not include that notice, you are creating a dispute backlog: customers who did not see the charge coming are the primary source of "did not authorize" chargebacks on subscription businesses.

Your policy page and your account dashboard should both be clear about how to cancel. "Contact support to cancel" is not sufficient under most current consumer protection frameworks — the UK, EU, and several US states require that cancellation be at least as easy as sign-up. If someone subscribed through a one-click checkout, they should be able to cancel through a single authenticated click in their account. Linking to the cancellation page in your subscription cancellation policy and making that link visible in every billing receipt is the floor, not the ceiling.

When platform rules and your policy collide: Shopify, PayPal, and Stripe

Shopify's Terms of Service, section 14, require that merchants comply with card network rules and applicable consumer protection law. In practice, that means your Shopify refund policy cannot override a chargeback that Visa or Mastercard has decided to honor. The card network rules — Visa's Core Rules, Mastercard's Transaction Processing Rules — sit above your store policy in the dispute hierarchy. A customer can file a chargeback for "item not as described" regardless of what your refund page says, and the card issuer can rule in their favor even when your policy is technically sound, because the evidence standard in chargeback arbitration is different from a contract dispute: you need documented proof of delivery, not just a posted policy.

PayPal's Buyer Protection covers "significantly not as described" disputes on digital goods, even though PayPal merchant agreements let sellers set non-refundable policies. The conflict resolves predictably: PayPal's buyer protection operates independently of your store policy and is governed by PayPal's own investigation process. Stripe's dispute process is closer to the raw card network layer — Stripe forwards the issuer's evidence request to you and submits what you provide, but the final decision sits with the card-issuing bank. Neither PayPal nor Stripe will defend your "all sales final" policy on your behalf; they are channels, not advocates.

The judgment order when rules conflict is: (1) mandatory consumer law in the customer's jurisdiction — this cannot be contracted away; (2) card network chargeback rules — these override your policy and the payment processor's stated terms; (3) the payment processor's buyer protection program (PayPal Buyer Protection, etc.) — these can grant refunds your policy does not; (4) your store's published refund policy — this governs only disputes that do not escalate to the layers above. Writing a strict policy and expecting it to hold at layer (2) or (3) is the most common mistake sellers make when reading a payment processor policy requirements guide for the first time.

Refusing a refund in practice: response language and evidence you need to keep

When you decline a refund request, the response email needs to accomplish three things at once: cite the specific policy clause, document the evidence you hold, and leave no ambiguity about the decision. A vague "per our policy, all sales are final" reply is not enough — it gives the customer no clear understanding of why their specific order does not qualify, which increases the probability they escalate to a chargeback rather than accept the decision. A better structure: state the order number and purchase date, quote the exact policy clause (e.g., "Section 2 of our Digital Products Refund Policy: refunds are not available once the download link has been accessed"), state what the record shows ("our delivery logs show the file was downloaded at 14:32 UTC on [date] from IP [prefix], associated with the account email used at checkout"), and offer an alternative where one exists (replacement file, account credit).

The records you need to retain are: download event logs (timestamp, IP, user agent, file hash), license key activation events if you use software licensing, and the checkout consent acknowledgment discussed in the EU section above. Shopify's order export captures purchase metadata but not download events — those require either a third-party digital delivery app (SendOwl, FetchApp, Sky Pilot) that logs access, or a custom webhook on your download endpoint. Without access logs, a chargeback for "item not received" on a digital order is nearly impossible to contest: the issuing bank needs evidence of delivery, and "the link was sent" is not the same as "the file was downloaded."

Recognizing serial refund abuse before it escalates saves both money and chargeback ratio points, which affect your payment processor standing. Indicators worth flagging: the same billing email or IP requesting refunds across multiple purchases, a refund request arriving within minutes of download completion (suggesting the download was the goal, not the content), or a pattern of purchases with discount codes followed immediately by refund requests. None of these are grounds for automatic refusal — they are grounds for a manual review before responding. Document that review process in an internal note attached to the order so that, if the customer does file a chargeback, you have a record showing you investigated rather than just denied.

Policy self-check: seven elements that determine whether payment processors trust your page

Payment processors — Shopify Payments, Stripe, PayPal — run periodic risk reviews of merchant policy pages. A policy page that is missing structural elements does not just create legal exposure; it can trigger a manual review flag on your account or, in the case of Stripe, contribute to a risk score that affects payout timing. The seven elements a digital product refund policy must contain are: (1) scope definition, naming the specific product types covered (ebooks, templates, courses, software licenses, credits) so the policy cannot be stretched to cover something not listed; (2) a clear refundable versus non-refundable matrix, specifying which scenarios qualify and which do not; (3) the time limit for submitting a request, stated in days from purchase or from the triggering event; (4) the request pathway — one channel, one email address or form link, no ambiguity; (5) a stated processing time from request to resolution and from approval to refund credit; (6) a statutory rights preservation clause ("Nothing in this policy limits your rights under applicable consumer protection law") — without this, a regulator can treat the policy as an attempt to contract away legal rights, which is itself a violation; and (7) a contact address or method for escalation.

The statutory rights clause at item (6) deserves particular attention because it costs nothing and removes significant legal risk. UK Trading Standards and the EU's national enforcement bodies have both issued guidance that a refund policy presented as absolute — "all sales are final, no exceptions" — without a carve-out for statutory rights misleads consumers about their rights, which is itself a breach of the Consumer Protection from Unfair Trading Regulations 2008 (UK) and the Unfair Commercial Practices Directive (EU). The carve-out does not mean you have to honor every refund; it means you are not telling customers their legal rights do not exist. That is a meaningful distinction when a claim lands.

A missing element is not always a missing section — sometimes it is scope that is inadequately defined or a time limit expressed in vague terms like "reasonable time." Payment processors train their risk review on machine-readable signals: the presence of a specific number of days, a named contact method, a visible link from the checkout page. If your policy page passes the seven-element check but is only linked from the footer with no reference at checkout, it still fails the practical test — the policy needs to be surfaced at the point of purchase, not just hosted somewhere on the site. Use the refund policy template guide to cross-reference your current page against each element, then run the free generator to produce a version that already includes all seven.