Online store legal requirements in 2026: a checklist before Black Friday

Before Black Friday, most stores think about banners, campaigns and stock. Meanwhile, consumer authorities are looking more and more closely at how stores show discounts, and fines run into the millions: in January 2026, the Polish competition and consumer authority (UOKiK) fined Zalando almost PLN 31 million and Temu almost PLN 6 million for incorrect information about the lowest price from the 30 days before a reduction (the decisions are not final).

Below we list the legal requirements an online store selling in Poland and the EU has to meet in 2026, with a focus on the ones that are most often forgotten. We see many of them every day in store audits. This article is for information only, reflects the legal situation as of October 22, 2026, and is not legal advice.

The Omnibus price rule before Black Friday 2026: when to set your prices

Under the EU Omnibus rules, implemented in Poland by art. 4(2) of the act on informing about prices of goods and services, whenever you announce a price reduction you must show, next to the reduced price, the lowest price of that product in the 30 days before the reduction. In Poland, this has applied since January 1, 2023, and it also covers ads that show a price.

Black Friday falls on November 27, 2026 this year. The lowest price you show with a deal will come from the 30 days before the deal starts:

• deal from November 27 (Black Friday): the period from October 28 to November 26 counts,
• deal from November 20 (Black Week): the period from October 21 to November 19,
• deal from November 30 (Cyber Monday): the period from October 31 to November 29.

In practice, this means regular prices have to be set before that period begins. If the product cost less at any point during those 30 days, that lower price becomes the reference for the deal. Raising prices right before Black Friday therefore achieves nothing, and UOKiK warned against this kind of price juggling before sales back in 2023.

How to calculate the discount percentage

Discount percentages and claims like “save 50” must be calculated from the lowest price in the 30 days before, not from a “regular” price. The Court of Justice of the EU confirmed this in its judgment of September 26, 2024 (C-330/23), and UOKiK relies on it in its cases. Example: the regular price is 200, the lowest price in the last 30 days before the deal is 180 and the deal price is 150. The discount is then about 17%, not 25%.

There are only two exceptions in Polish law. If a product has been on sale for less than 30 days, you show the lowest price since it was first offered. For perishable goods, you show the price before the first reduction. Polish law has no exception for progressive reductions, so each further step is calculated against the lowest price from the 30 days before.

Where and how to show the lowest price

According to UOKiK’s guidance, the lowest price must be shown in the same place and at the same time as the discount: on the product page, but also in product listings, search results, the cart, recommended products and ads with a price. A shortened form is acceptable in listings if the product page explains everything properly. A crossed-out price with no explanation of what it refers to is not enough, and neither is an asterisk explained at the bottom of the page. The rule also covers discount codes that apply to specific products or product groups.

Watch the wording. In Poland the correct label is “najniższa cena z 30 dni przed obniżką” (lowest price in the 30 days before the reduction), and for new products “najniższa cena od wprowadzenia towaru” (lowest price since launch). UOKiK lists labels such as “reference price”, “Omnibus price”, “was” and, to many sellers’ surprise, “lowest price in the last 30 days” as incorrect.

In Poland, the Trade Inspection can fine price display errors up to PLN 20,000, or up to PLN 40,000 for repeated breaches. If UOKiK finds a practice that harms the collective interests of consumers, the fine can reach 10% of turnover.

Customer reviews and personalized prices

If a store shows customer reviews, it must say whether and how it checks that they come from people who actually bought the product. Claiming reviews are verified without reasonable checks is an unfair commercial practice. In January 2026, UOKiK brought charges against Samsung over a “verified purchase” label based only on a box the user ticked.

If a price is personalized through automated decision-making, the customer must be told before the purchase.

Returns and the withdrawal button

Consumers have 14 days to withdraw from a distance contract. The store must tell them about this before the purchase, provide a model withdrawal form and clearly describe return costs and deadlines. A common issue we see in audits is exceptions defined too broadly, for example treating any product with any change as “personalized”. Exceptions to the withdrawal right have to be applied precisely.

In Poland, a store has 14 days to respond to a complaint. If it does not respond in that time, the complaint is deemed accepted. Since 2023, consumer sales of goods are covered by the rules on non-conformity of goods: the seller is liable for non-conformity that shows up within 2 years of delivery.

The “withdraw from contract here” button

Directive (EU) 2023/2673 requires stores to offer a one-click withdrawal function. It covers all distance contracts concluded online, including sales of goods, not just financial services. The EU application date was June 19, 2026. The button, labelled “withdraw from contract here” or something equally clear, must be available for the whole withdrawal period and lead to a simple form, and sending the statement must be confirmed with a “confirm withdrawal” button. The store then sends an acknowledgement on a durable medium, such as email.

Poland has not implemented these rules yet. The draft law (UC169, Ministry of Finance and Economy) is planned for government adoption in the first quarter of 2027. Until the Polish law takes effect, the obligation is not enforced against stores in Poland, but it is worth preparing now: the change affects the customer account, forms and transactional emails. In other EU countries, check the local implementation.

Sole traders with consumer rights (Poland)

Since 2021, Polish sole traders who buy something unrelated to their profession have some consumer rights, including the right to withdraw from a distance contract and protection when goods do not conform to the contract. Since November 27, 2025, such a buyer may declare at checkout whether the contract is professional for them, but the store may not make the contract conditional on that declaration. A mandatory “I am buying as a business and waive consumer rights” checkbox is asking for trouble today. This matters especially for B2B stores that also sell to small businesses.

Terms, the order button and pre-purchase information

• Terms and conditions are mandatory. They must be available before the contract, free of charge and in a form that can be saved.
• Pre-purchase information: seller details and contact, total price with taxes and delivery costs, payment and delivery methods, the complaint procedure and the withdrawal right. Delivery restrictions and accepted payment methods must be shown at the latest when ordering begins.
• The order button must say “order with obligation to pay” or something equally clear. If it does not, no contract is concluded.
• The ODR platform link can go. The EU online dispute resolution platform closed on July 20, 2025, and the obligation to link to it ended. Information on out-of-court dispute resolution should stay.
• Unit prices, for example per kilogram or liter, must be shown for products covered by the price display rules.

GPSR: manufacturer details on every product

The EU General Product Safety Regulation (GPSR) has applied since December 13, 2024. Under its Article 19, every online offer must clearly show:

• the manufacturer’s name or trademark and its postal and electronic address,
• if the manufacturer is outside the EU: the details of the responsible person in the EU,
• information identifying the product (picture, type, other identifiers),
• warnings and safety information in a language consumers can easily understand (in Poland: Polish).

The Polish act on general product safety surveillance has applied since January 3, 2026. UOKiK can fine missing information up to PLN 500,000, and the Trade Inspection can make test purchases. Our audits show this is one of the most commonly skipped obligations: store platforms have fields for this data, but they are rarely filled in.

Digital accessibility (European Accessibility Act)

Since June 28, 2025, the European Accessibility Act has applied to e-commerce services aimed at consumers; in Poland it was implemented by the act on accessibility requirements for certain products and services. A store must be perceivable, operable, understandable and robust for assistive technologies, with the EN 301 549 standard (based on WCAG) as the reference. The terms of service or a similar document must explain how the service meets accessibility requirements.

Microenterprises providing services are exempt, meaning companies with fewer than 10 employees and annual turnover or balance sheet total of up to EUR 2 million. In Poland, the Minister of Digital Affairs supervises online stores.

Cookies, GDPR and Consent Mode v2

In Poland, cookie rules have been set by the Electronic Communications Law (art. 399) since November 10, 2024. Storing or reading information on a user’s device requires prior information and consent, except for files strictly necessary for the service. The telecom regulator (UKE) can fine breaches up to 3% of revenue. A common mistake: the consent banner works correctly, but the privacy policy still says the browser accepts cookies by default. It is also worth checking in practice that Google Analytics and ad pixels really do not load before consent.

Often forgotten: in Poland, consent to email and SMS marketing is now governed by art. 398 of the Electronic Communications Law, and the old provision of the e-services act was repealed. The consent wording in newsletter forms is worth updating. Every form that collects personal data also needs a GDPR information notice. A checkbox is not always required, but information on who processes the data and why is.

Consent Mode v2 is not a law but a Google requirement (EU User Consent Policy), in force since March 2024 for traffic from the European Economic Area. Without it, a store loses remarketing audiences and part of its conversion data in Google Ads and GA4. Consent Mode passes consent signals to Google, but it does not by itself make a store compliant with cookie rules. In advanced mode, Google tags load before consent, and whether that is compliant is disputed, so basic mode is the safer option.

What else applies or is coming

• AI chat in the store. Since August 2, 2026, the AI Act requires that people know they are talking to an AI system, unless it is obvious from the context. If you use an off-the-shelf chatbot, check that the vendor handles this.
• Environmental claims. The Polish law implementing Directive 2024/825 takes effect on September 27, 2027. Generic claims such as “eco” or “environmentally friendly” without proof will be banned, and sustainability labels will only be allowed when based on certification or a public authority.
• KSeF e-invoicing (Poland). Since 2026, invoices to businesses are issued in the national e-invoicing system (the smallest taxpayers have until the end of 2026). Invoices to consumers may, but do not have to, go through KSeF.
• Deposit return system (Poland). Since October 1, 2025, selling drinks in covered packaging requires charging a deposit.
• Digital Services Act. The Polish implementing law takes effect on November 6, 2026 and mainly affects stores that run a marketplace or publish user content.

Checklist before Black Friday

• Regular prices set before the 30-day period before the deal begins.
• The lowest price from the 30 days before the reduction shown wherever you show a discount, including listings and ads.
• Discount percentages calculated from that lowest price.
• Information on whether and how you verify reviews.
• Up-to-date terms, a model withdrawal form and clear return rules.
• An “order with obligation to pay” button and the ODR link removed.
• Manufacturer details and warnings (GPSR) on products.
• A consent banner that matches the privacy policy, with marketing tags firing only after consent.
• GDPR information notices on forms.
• No mandatory “buying as a business” checkbox at checkout.

Frequently asked questions

When does the withdrawal button become mandatory?

Under EU law from June 19, 2026, but in Poland the rules are still a draft (government adoption planned for the first quarter of 2027). The obligation will be enforced once the Polish law takes effect. In other EU countries, it depends on local implementation.

Can I raise prices before Black Friday?

The rules do not forbid it, but it makes no sense: if the product was cheaper at any point in the 30 days before the deal, you will show that lower price with the deal and calculate the discount from it.

Does the Omnibus price rule apply to B2B stores?

It applies to stores that sell to both businesses and consumers. For a store open only to businesses, the situation is not clear-cut, so it is worth checking with a lawyer.

Is Consent Mode v2 mandatory?

It is a Google requirement, not a law. Consent for non-essential cookies, however, is mandatory. Consent Mode is needed if you want to use Google Ads and GA4 fully.

Some of these requirements are about the wording of your terms, which is worth checking with a lawyer. Many, however, are technical: price display, product fields, forms, consents and tags. In a store audit we check them from the technical and UX side and then implement the fixes. If you want to be ready before Black Friday, describe your store in the free quote form.