EU Website Requirements for Non-EU Companies: 12 Checks (2026)

A website built for customers outside Europe is not automatically ready for European customers. Translating the text is the easy part. What changes is how prices are displayed, how personal data is handled, how returns work and when customers expect an answer. These rules are decided by EU law and by the national law of each member state, and they apply to a company based anywhere once it sells to people in the EU.

This article is for companies outside the EU that are planning a website for European consumers or business customers. Chapters 1 to 12 are the twelve items to settle before you build; chapters 13 to 17 cover common pitfalls, a working order, a checklist and a summary. Everything was checked against public sources on 30 October 2026. It is general information, not legal advice, so confirm the details with a specialist or the regulator in your target country.

1. Decide first: which countries, which customers, which offer

Three questions come before everything else: which countries you sell to, whether the buyer is a consumer or a business, and what you sell. Without them you cannot choose a language, a price format or the legal notices you need.

"Europe" is too large a unit for a website. The EU has 27 member states with different languages, VAT rates and expectations about what a consumer is told. Countries such as the United Kingdom and Switzerland are outside the EU altogether. Starting with one to three countries is cheaper and easier to run than aiming at the whole continent.

Consumers or businesses

Selling to consumers (B2C) brings in consumer protection rules almost across the board: VAT-inclusive prices, withdrawal rights, price-reduction rules. Selling only to businesses (B2B) removes many of them. The GDPR still applies to B2B, though, because a contact person's name and email address are personal data.

If one site offers both a business quote form and a shop where individuals can buy, the consumer rules apply to the consumer path. "We are B2B" is a safe claim only when the paths are fully separate.

What changes compared with a domestic site

The table below lists what a site built for your home market usually assumes, and what changes for the EU. Later chapters take each row in turn.

2. Language: when English is enough and when it is not

"Is English enough?" is the usual first question. The answer depends on the buyer, the product and the country. Some sales work well in English alone; others will not be trusted without the local language.

What the numbers say

The European Commission's survey "Europeans and their languages", fielded in September and October 2023 with almost 27,000 respondents across the 27 member states, found that 47% of Europeans can speak English. That is five percentage points more than in 2012 and the highest share for any foreign language, yet less than half. It was published on 21 May 2024.

That figure is an EU-wide average. The gap between countries is large, so "everyone speaks English" does not hold as a planning assumption.

Where English alone tends to work

This table is DevNJ's own reading and does not describe legal language requirements. "Enough" means a deal or purchase is likely to go through in English. Even then, replies and forms work better the closer they are to the customer's language.

Where local language is worth adding

For consumer sales and high-value service sign-ups, local-language pages are a trust signal. Guidance from the Dutch Chamber of Commerce (KVK) says French consumers prefer to shop on a French-language web shop and expect customer service in French. In countries where English is less widely used the effect is stronger.

France also has a language law, the Toubon law. A law firm's analysis describes it as covering most information exchanged with consumers in commercial dealings, while noting that French courts limit it to providers based in France or situations where the targeted consumers are in France. It also says enforcement has centred on products affecting health and safety. That analysis dates from 2015, so current practice may differ.

For a website aimed at French consumers, French is the safer choice on both legal and commercial grounds. For other countries, check with the authority or a local adviser before you sell.

Translation quality and machine translation

The most common mistake when adding a language is publishing raw machine translation. A readable translation may be fine for product descriptions or an about page, but text that carries responsibility, such as prices, returns and personal data notices, should be reviewed by a native speaker. KVK's guidance makes the same recommendation.

Every added language also multiplies maintenance. A change to a price, a promotion or the terms has to be made in every language. Starting with English plus the local language of your most important country, and expanding after you see results, is easier to sustain.

3. Domains and URLs: making the country and language clear

Once languages are chosen, the URL structure comes next. Whether you add a /de/ folder or register a country domain changes both your running costs and how you appear in search.

Whichever you choose, link the language versions of each page to each other so search engines can offer the right version, and put a visible language switcher on the page. Redirecting visitors automatically by browser language alone can stop them from reaching the page they wanted.

The European Data Protection Board (EDPB) lists the use of a top-level domain of an EU member state (such as .de) among the factors that can show an intention to offer goods or services to people in the EU. A country domain therefore also bears on the GDPR question in chapter 8.

4. Prices: VAT-inclusive totals and tax by destination country

Even if your home market already shows tax-inclusive prices, EU VAT rates differ by country, so the total for the same product changes with the destination. This chapter covers consumer price display and the VAT questions a non-EU seller meets first.

Show consumers the total price

The EU's consumer information portal (Your Europe) says consumers must be clearly told the total price including taxes and extra charges before they buy goods or services. A price that grows at checkout through delivery or fees should be avoided.

The same guidance sets out further rules.

Many shops add delivery and payment fees on the last page. For EU consumers the expectation is that the total is visible from the start.

VAT: three situations a non-EU seller meets

VAT is complicated and depends on how you sell. The summary below follows KVK's guidance; for a specific transaction, consult a tax adviser.

If you ship goods directly from outside the EU, who pays VAT and where feeds straight into your displayed price. Whether you use IOSS or leave the customer to pay at import changes the total you show. The conditions for IOSS, such as when an intermediary is needed, should be checked with the tax authority of the member state concerned.

Duty and fees on parcels

KVK's guidance says that for e-commerce shipments of up to €150 from outside the EU, a fixed import duty of €3 per product type applies from 1 July 2026, and from 1 November 2026 a handling fee of €2 per product type applies to all e-commerce shipments, including those above €150. This affects how you build price and shipping for small direct-to-consumer orders.

These figures come from the KVK page checked on 30 October 2026. Details change often, so check current customs guidance for your destination before you ship.

Prices on B2B-only sites

A site that sells only to businesses commonly shows prices without VAT. But if any path lets a consumer buy, that path needs the VAT-inclusive total. A quote-only design that shows no prices avoids the question entirely.

5. Sale prices: the lowest price of the previous 30 days is the reference

Many shops show a "regular price" struck through next to a "sale price". For EU consumers this presentation has clear rules.

What the Omnibus Directive decided

The Price Indication Directive (98/6/EC) was amended by the Omnibus Directive ((EU) 2019/2161). When you announce a price reduction, you must show a prior price, and that prior price is the lowest price you applied during a period of at least 30 days before the reduction.

On 26 September 2024 the Court of Justice of the EU confirmed the point in a case referred by a German court. A reduction announced as a percentage, or as a promotional statement stressing the advantage, must be calculated from the lowest price of the previous 30 days. Merely stating a prior price is not enough; it must be the real basis of the reduction.

A worked example

The numbers below are hypothetical and only illustrate the rule.

The lowest price in the previous 30 days is €50, so the discount is calculated from €50, not €60. €45 is a 10% reduction from €50, so "20% off" is not allowed. "25% off the regular price of €60" would not match the 30-day rule either.

Enforcement differs between member states. Some authorities have issued stricter guidance, for example refusing to accept alternative labels such as "reference price". Check the rules of your target country from official sources.

What to prepare before running a sale

Following the rule needs a daily price history. If your shop software does not keep one, you cannot show the base afterwards. Deciding at build time that the shop stores price history avoids rework.

6. Returns and withdrawal: 14 days, and the withdrawal button

In many countries a seller decides the return policy. For EU consumers, the law sets a right of withdrawal that a trader cannot remove through its terms.

The 14-day right of withdrawal

Your Europe states that consumers who buy online have a 14-day right of withdrawal. It lets them cancel without giving a reason, with exceptions depending on the product or the nature of the service. The starting point of the period and who pays return postage are set in detail by the directive and national law.

A trader must tell the consumer before purchase that the right exists and how to use it. A "no returns" notice cannot simply be copied onto a site for EU consumers.

The withdrawal button from 19 June 2026

From 19 June 2026, distance contracts concluded online with consumers need an electronic withdrawal function. It comes from Directive (EU) 2023/2673, and a trade commentary describes these requirements.

Some member states prescribe the wording, and how far each has transposed the directive differs. The table rests on a vendor's blog, so confirm it against the law of your target country.

How this differs from a domestic shop

A typical shop points to a return form or a contact address, and does not have to complete the withdrawal on the site. For an EU-facing shop you build a path from the order history or the confirmation email into the withdrawal procedure. This is a system requirement, not a design choice, so check at the quotation stage that it is included in the build.

7. Business details: your home legal notice is not enough

Most countries require some business details on a website. In the EU, member-state law sets what must be shown, so a plain translation of your home notice may fall short.

An example of required items: Germany

Section 5 of the German Digital Services Act (DDG) requires providers of commercial digital services to keep the following information easy to recognise and directly reachable at all times. German-language sites call it the Impressum.

Germany is only one example; other countries have comparable rules. For sites aimed at German-speaking customers an Impressum page is standard practice. Whether the act applies directly to your business depends on factors such as where you are established, so confirm with an adviser for the target country.

What non-EU companies should watch

Your company registration numbers and tax identifiers will not match the EU's formats. Do not leave a field blank because your country has no equivalent; give the closest accurate information, such as your national company number. An adviser can tell you which of your identifiers can stand in.

A business address is also public contact information. If your office is a home address, decide whether it is acceptable to publish before you add it.

Remove the dispute-resolution link

Older EU-facing sites had to link to the EU Online Dispute Resolution (ODR) platform. The platform was discontinued on 20 July 2025. The European Consumer Centre Finland states that new complaints stopped in March 2025 and that user data is deleted. Check terms and footers for a leftover link.

8. GDPR: when it reaches you, and the EU representative (Article 27)

The GDPR is where non-EU companies are most often surprised. It can apply even when you have no establishment in the EU.

The test is intention to offer

The GDPR applies to a non-EU business that offers goods or services to people in the EU (Article 3(2)). The EDPB guidelines list factors that can show such an intention.

The same guidelines say that mere accessibility of a website from the EU, or use of a language common in your own country, is not enough by itself. The test is whether several factors together show an intention to target people in the EU.

A company profile site that is simply visible from Europe is normally outside the rule. A site that prices in euros, has German pages and delivers to Germany should be treated as in scope.

The EU representative: when you need one

A non-EU business subject to the GDPR must designate a representative in the EU in writing (Article 27). The representative is a contact point that supervisory authorities and individuals can approach in addition to, or instead of, you.

The exemption is narrow. A shop that takes orders continuously is not "occasional".

On 12 May 2021 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Locatefamily.com €525,000 for breaching Article 27. The company had no EU establishment and had not appointed an EU representative. According to the authority's announcement, the base fine was set within a range of €300,000 to €750,000, and the company was ordered to appoint a representative within twelve weeks. It is an example of a fine imposed for not appointing a representative, which is a useful benchmark when you weigh your own position.

What the privacy notice must say

Where the GDPR applies, the privacy notice states what data you collect, for what purpose, on what legal basis, who receives it and how long you keep it, how people exercise their rights of access, correction and deletion, and how to reach your representative. A translated domestic notice is usually missing these items.

9. Cookies: consent for anything non-essential

In many places a cookie notice with a "continue" button is the norm. In the EU, Article 5(3) of the ePrivacy Directive requires prior consent for cookies and similar technologies other than those strictly necessary for the service the user asked for. Advertising and analytics tags are normally on the consent side of that line.

The EDPB has issued guidelines on the technical scope of this provision (2/2023, final version of 16 October 2024), explaining that it can reach not only cookies but other ways of accessing information on a device, such as pixels and fingerprinting.

What the consent screen must do

How you configure analytics to respect consent is a topic of its own that depends on the measurement method. For this article, remember that "measure nothing until consent is given" is the baseline for the EU.

How this differs from a domestic site

Many sites outside the EU show no consent banner at all. Extending such a site to the EU often leaves tracking tags firing before consent. Before you build, list the tags you use and sort them into essential and non-essential.

10. Where to host, and moving data across borders

Many companies assume that "because of the GDPR our servers must be in the EU". That is a misconception. The GDPR does not restrict where a server is located. What needs a basis is transferring personal data of people in the EU out of the EU.

Adequacy decisions

The European Commission's adequacy list includes Japan, Korea, Switzerland, the United Kingdom, Canada (commercial organisations), the United States (commercial organisations taking part in the Data Privacy Framework) and several other countries. For Japan the page links to a first periodic review report published on 4 April 2023, and for the UK it shows decisions renewed on 19 December 2025.

If your country is on the list, transfers from the EU to you have a ready basis. If it is not, you will rely on other tools such as standard contractual clauses. An adequacy decision is not an exemption from the GDPR itself: your obligations remain, and what the decision covers is the transfer basis.

Using US services

Most sites use US cloud or analytics tools. The EU-US Data Privacy Framework received an adequacy decision on 10 July 2023. On 3 September 2025 the EU General Court dismissed a challenge to it (case T-553/23). An appeal has been discussed in commentary and the position may change, so check whether each provider participates in the framework and keep a fallback basis such as standard contractual clauses.

Hosting options

Some rules of thumb:

• For a mostly static company site, configuration and a CDN matter more than the server location
• If you keep customer or order data, decide where the database lives first
• A business customer may require EU hosting in a contract. That is a contractual matter, not a legal one

Choose the location for speed and ease of operation as well as for the legal position.

11. Accessibility: check whether the EAA applies to you

The European Accessibility Act (EAA) has applied since 28 June 2025. Businesses that offer e-commerce, booking, banking, passenger transport, e-books and similar services to EU consumers must make their sites and apps usable by people with disabilities.

This is only an outline. The exact scope, the WCAG AA technical standard, cost ranges and why overlay widgets do not make a site compliant are covered, with primary sources, in a separate article: Redesigning Your Website for the European Accessibility Act.

If you are building a new EU-facing site, making WCAG 2.2 AA a requirement from the start costs less than repairing it later.

12. Enquiries: time zones and how to write opening hours

The last item sits outside the site itself: whether you can answer European customers during your own working day. Decide this before you build. How enquiries turn into deals differs between regions too, which we cover in our article on B2B enquiry flows.

How much of the day overlaps

The EU spans several time zones, and clocks changed on 29 March and 25 October in 2026. The overlap between your working day and a customer's depends on your offset. Assuming both sides work 09:00 to 18:00, the overlap is the nine working hours minus the offset, and it disappears at nine hours or more.

A company eight hours away from its customers shares one hour of the day with them. That is not enough for live phone or chat support as the default.

How to write opening hours

"Open 9:00 to 18:00" does not say in which country's time. A European customer will not convert it for you, so always state the time zone.

Publishing a reply-time target is usually the most realistic way to bridge a time difference. An enquiry that arrives in a customer's morning can be read in your day and answered before their next morning.

Use the form to narrow the request

A time difference makes every round trip slow. Design the form so that the first message contains what you need.

• Make country, company and request type (quote, support, data request) selectable
• Let the customer choose a reply language
• Provide fields for attachments and URLs so the situation arrives in one message

Data requests have a deadline

Under the GDPR, a request from an individual to access or erase their data must be answered without undue delay and at the latest within one month of receipt. For complex or numerous requests the period can be extended by two further months, but you must tell the person about the extension and the reasons within the first month.

Your enquiry channel therefore needs a way to catch data requests rather than letting them sit in a shared inbox during holidays or absences.

13. Where businesses most often trip up

Of the twelve items, these are the ones businesses outside the EU overlook most often.

14. What not to do

Some habits that feel natural in a home market are hard to undo later.

15. A working order: decide first, then build

This is the order we suggest for an EU-facing site.

1. Decide the market. Choose one to three countries and consumer or business customers.
2. Decide the languages. For each country, decide whether English is enough or a local language is needed.
3. Decide prices and VAT. Consumer totals include VAT; if you ship from outside the EU, check import VAT and IOSS.
4. List the legal notices. Business details, withdrawal rights, terms and privacy notice, adapted to each country.
5. Decide whether the GDPR and a representative apply. Use the tables in chapter 8 to test intention and exemptions.
6. Decide hosting and measurement. List the hosting location, the tags in use and the consent screen.
7. Add accessibility requirements. Check whether the EAA applies and, if so, require WCAG 2.2 AA.
8. Decide how enquiries work. Opening hours, reply targets and who watches for data requests.

Working in this order shows what will drive the cost before design or build begins. Two local languages, a withdrawal function and a stored price history are examples of items that change a quotation directly.

16. Checklist

Before launch, confirm each of these.

• Target countries and consumer or business focus are written down
• Languages are chosen per country, and native speakers reviewed text that carries responsibility
• Language versions of each page link to each other
• Consumer prices show the VAT-inclusive total
• Import VAT and duty are settled if you ship from outside the EU
• Sale displays use the lowest price of the previous 30 days as the base
• A daily price history is stored
• The right of withdrawal is explained and an electronic withdrawal function exists
• A business details page meets the rules of the target country
• No link to the ODR platform remains
• The GDPR and the representative question have been assessed and recorded
• The privacy notice covers data types, purposes, retention, rights and the representative
• Non-essential cookies do not fire before consent
• Hosting location and the transfer basis are documented
• EAA scope has been checked and, if applicable, WCAG 2.2 AA is a requirement
• Opening hours show a time zone and a reply target
• Someone can handle a data request within one month

17. Summary

• An EU-facing website is not a translation of a domestic one; start from country, customer and offer
• 47% of EU citizens can hold a conversation in English, so add local languages for consumers where needed
• Consumer prices include VAT, and a sale is measured against the lowest price of the previous 30 days
• There is a 14-day withdrawal right and, since 19 June 2026, an electronic withdrawal function
• If you have no EU establishment and target EU residents, consider a GDPR Article 27 representative
• There is no rule to host in the EU; you need a basis for transferring data out of the EU
• For enquiries, state a time zone and a reply target to align expectations

If you are not sure where to start, begin with steps 1 and 2 of chapter 15 inside your own team: once the country and the customer are settled, the work and the assumptions behind a quotation become clear. Our range of work is on the services page, and you can ask about an EU-facing site on the contact page.

Sources used

GDPR and international transfers

• Art. 27 GDPR — Representatives of controllers or processors not established in the Union: the article on representatives
• Art. 12 GDPR — Transparent information, communication and modalities: the one-month response period and the two-month extension
• Guidelines 3/2018 on the territorial scope of the GDPR — EDPB (full-text reproduction): targeting factors and the representative
• Dutch DPA imposes fine of €525,000 on Locatefamily.com — Autoriteit Persoonsgegevens: primary source for the 12 May 2021 fine (Article 27 breach, base fine range, twelve-week order)
• Boete van 525.000 euro voor Locatefamily.com — Autoriteit Persoonsgegevens: the Dutch version of the announcement
• Dutch DPA fines company 525,000 EUR for failure to designate EU representative — Hunton: background on the 12 May 2021 fine (law firm report)
• Adequacy decisions — European Commission: the list of countries, the EU-US framework
• Latombe v Commission (T-553/23) — Lewis Silkin: the 3 September 2025 General Court ruling (law firm report)
• Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive — EDPB: cookie provisions (final version 16 October 2024)

Consumer law, prices and VAT

• Shopping online — Your Europe: the 14-day withdrawal right, prices including taxes
• Pricing and payments — Your Europe: total price, card surcharges, pre-ticked boxes, currency conversion
• The CJEU confirms that a price reduction must be calculated based on the lowest price in the last 30 days — Baker McKenzie: the 26 September 2024 judgment (law firm report)
• The new online withdrawal function: what EU Directive 2023/2673 means — iubenda: the 19 June 2026 withdrawal function (vendor commentary)
• VAT rules for e-commerce in the EU — KVK: the €10,000 threshold, OSS, IOSS, duty and fee on small parcels
• E-commerce in France — KVK: French consumers' language preference, French VAT
• Online Dispute Resolution platform discontinued — European Consumer Centre Finland: closure of the ODR platform (20 July 2025)

Language, business details and time

• Europeans strive toward multilingualism — European Commission: 47% can speak English, fieldwork September to October 2023, published 21 May 2024
• Toubon Law 20 years on — Technology's Legal Edge: the reach of the French language law (2015 analysis)
• Section 5 DDG — gesetze-im-internet.de: German business details requirements
• Clocks go forward as summer time begins on Sunday 29 March — Finnish Government: start of EU summer time in 2026

Related article

• Redesigning Your Website for the European Accessibility Act: EAA scope, the microenterprise exemption, WCAG 2.2 and costs

All sources were checked on 30 October 2026. Rules and tax treatment change, so confirm the current position with official guidance and a specialist before you sell. This article is not legal advice. Parts of the 26 September 2024 judgment, the withdrawal function and the EDPB guidelines could not be reached on the EUR-Lex legal database automatically, so they were checked through law-firm and vendor commentary and reproductions. Figures 1, 2 and 4 were made by DevNJ; the dates in figure 3 follow the sources above.