B2C compliance: the checklist regulators actually check
From the withdrawal button to AI chatbots - what Bulgarian and EU law actually requires from online stores in 2026, and what skipping it costs.
Most founders copy a competitor's Terms and Conditions and forget about them. But KZP checks whether the document contains the exact elements under Article 47 of the Consumer Protection Act (ZZP), whether the checkout button says the exact right words, and whether the cookie banner asks for consent before anything loads. Fines run from BGN 500 to €50,000 for unfair practice - stacking separately for every unfair clause found.
Here's what the B2C regulatory stack actually requires in Bulgaria as of mid-2026 - and what's still just a draft.
The regulatory stack: three tiers that touch you directly
EU regulations apply directly from their effective date - they don't wait for a Bulgarian law. EU directives require a national law to transpose them, and until that law passes, they create no direct obligation.
| Tier | Examples | Directly applicable? |
|---|---|---|
| EU regulations | GDPR (2016/679), GPSR (2023/988), AI Act (2024/1689) | Yes - from the EU-wide effective date |
| EU directives (transposed) | Directive 2011/83/EU → ZZP; ePrivacy → the Electronic Communications Act | Only once the national law is enacted |
| Bulgaria-specific legislation | E-Commerce Act, Digital Content and Goods Act (ZPTSSUPS), Ordinance N-18 | Yes |
The withdrawal button below is exactly this kind of gap in action.
The first 30 days: the minimum checklist
Five things get you to minimum compliance within the first month:
- Footer identification. Company name, EIK, address, phone, email.
- Tax registration. Card payments? Declare the store within 7 days of your first sale (Ordinance N-18).
- A legitimate cookie banner. No pre-ticked boxes, and a "Reject all" button with equal visual weight.
- Unambiguous checkout wording. "Order with obligation to pay" or equivalent.
- A withdrawal form and complaints register.
The Terms and Conditions: the 7 things KZP checks
Before the final order button, Article 47 of the ZZP requires clear disclosure of:
- Identification: name, EIK, address, phone, email.
- Core characteristics of the goods.
- The full price, VAT and delivery included.
- Payment method, timelines.
- The right of withdrawal: 14 days, standard form.
- The legal warranty: 2 years under the Digital Content and Goods Act.
- Out-of-court resolution: links to the EU's ODR platform and KZP.
The blacklist: clauses that void themselves automatically
Clauses restricting consumer rights are void under Article 146(1) of the ZZP - whether or not the consumer noticed them.
| Prohibited clause | Why it's void | Compliant alternative | Legal basis |
|---|---|---|---|
| "The trader reserves the right to unilaterally change the price of a confirmed order." | Bans unilateral changes to essential contract terms | "The price of a confirmed order cannot change, except for an obvious pricing error." | Art. 143(2)(11) ZZP |
| "All claims must be filed with the District Court in Varna." | Imposes a jurisdiction other than the consumer's own | "In a dispute, the consumer may file a claim with the court at their current address." | Art. 143(2)(19) ZZP |
| "The trader is not liable for defects appearing after delivery." | Limits the statutory 2-year warranty | "The trader is liable for any non-conformity per the Digital Content and Goods Act." | Art. 143(2)(2) ZZP |
| "The subscription auto-renews for another 12 months without notice." | No reasonable window to object to silent renewal | "The consumer is notified by email 14 days before renewal and may cancel any time." | Art. 143(2)(8) ZZP |
The right of withdrawal: 14 days - and the new withdrawal button
14 calendar days (Art. 50 ZZP) - from delivery for goods, from the contract date for services and digital content. Refunds due within 14 days of notification (Art. 54 ZZP).
Exceptions under Article 57:
- Digital content and SaaS - with explicit consent (point 13).
- Custom-specified goods (point 3).
- Sealed hygiene/health goods, once unsealed (point 5).
- Perishable goods (point 4).
- Unsealed software or media (point 9).
The withdrawal button: what it requires, and what it doesn't
The claim that "every site needs a cancel-order button" is overstated - it applies under Directive (EU) 2023/2673 only to contracts with a right of withdrawal.
Interface requirements:
- A permanently visible "Withdraw from the contract here" button - no login required.
- A form with three fields: name, contract number, email. No extra mandatory fields.
- A second-step "Confirm withdrawal" button.
- An automatic, timestamped email confirmation.
At EU level, in force since June 19, 2026. Bulgaria's own transposing bill (No. 52-602-01-12) is still before Parliament - but sell into a country with completed transposition (Germany, for instance), and you're already exposed to a fine there.
The legal warranty: 2 years, and the burden of proof flips
Under the Digital Content and Goods Act - 2 years from delivery (Art. 37(1)). In year one, non-conformity is presumed to have existed at delivery - the trader must prove otherwise. Repair or replacement within 1 month (Art. 34); for SaaS, a "reasonable time."
Cookies: the consent rule, as it actually works
Governed by Article 249(2) of the Electronic Communications Act and GDPR's consent requirements:
- Strictly necessary cookies - cart, session, language - no consent needed (Art. 6(1)(b) GDPR).
- Non-essential cookies - marketing, analytics, FB Pixel, GA - need explicit consent before loading.
- Banner in Bulgarian for Bulgarian-targeted sites; "Reject all" as visible as "Accept."
Selling physical goods? GPSR spreads liability across the chain
GPSR (Regulation (EU) 2023/988, in force since December 13, 2024) requires full traceability for physical products sold online:
| Role | Core responsibility | Product page requirement | Basis |
|---|---|---|---|
| Manufacturer (EU) | Safety assessment, technical file, labeling | Name, postal address, email | Art. 9 GPSR |
| Importer (non-EU goods) | Verifies the manufacturer's file, adds their own data | Importer's details + manufacturer's details | Art. 11 GPSR |
| Distributor (online retailer) | Factual check for labeling and EU responsible-person data | All the above + product photo + safety warnings in Bulgarian | Art. 12 GPSR |
| Online marketplace | Assists authorities, removes dangerous products within 2 business days | Technical fields for sellers to fill in the data | Art. 22 GPSR |
A description and a price aren't enough - the page needs the data above too, plus a Bulgarian-language warning.
AI chatbots: mandatory transparency from August 2, 2026 (Article 50, AI Act)
If your site runs an AI chatbot, Regulation (EU) 2024/1689 requires:
- A permanently visible chat-window message disclosing AI interaction, no later than the first reply - not just buried in the Terms.
- AI-generated text, images, or audio marked as such in machine-readable form.
In force from August 2, 2026; systems already live get a grace period until December 2, 2026. Fines up to €15,000,000 or 3% of turnover.
Dual pricing: leva and euro until August 8, 2026
From August 8, 2025 through August 8, 2026 inclusive - prices in leva and euro, at the fixed rate of 1.95583 (Art. 15, Bulgaria's euro-adoption act), rounded to two decimals. Getting it wrong: a fine of BGN 400-5,000 (Art. 59).
B2B vs. B2C: when a freelancer counts as a "consumer"
"Consumer" under the ZZP means an individual acting outside their trade or profession. An invoice under their own EIK/BULSTAT makes the deal B2B - they lose the 14-day withdrawal right and the 2-year warranty.
| Contract term | B2C (ZZP) | B2B (Commercial Act) |
|---|---|---|
| Freedom of contract | Heavily restricted | Full, within good-faith limits |
| Right of withdrawal (14 days) | Mandatory by law | None, unless separately agreed |
| Legal warranty | Minimum 2 years | Freely set, can be excluded |
| Jurisdiction | Exclusively the consumer's own address | Free choice of court or arbitration |
| Excluding liability | Void for defects and damages | Valid liability caps can be negotiated |
Enforcement: what KZP actually fines, not what the law caps
The statutory ceilings sound alarming - up to 4% of turnover under GDPR. In practice, fines match the scale of the violation: a first violation typically lands at BGN 500-3,000 per clause (Art. 210a ZZP) - but KZP fines each clause separately.
Three cases from 2025-2026 show where enforcement is heading:
- A water utility, June 2026 - €20,000 for a 145% price hike with no justification.
- A mobile operator, May 2025 - €50,000 for cutting service to pressure payment on an unrelated charge.
- Vivacom, Decision No. 202562-1 - the Supreme Administrative Court upheld a fine over unclear promo terms.
Founder's checklist
- Footer: legal name, EIK, address, phone, email - visible?
- Checkout button: wording unambiguously signals an obligation to pay?
- Dual pricing: leva and euro shown together until August 8, 2026, at 1.95583?
- SaaS/digital goods: checkbox for loss of withdrawal rights?
- Cookie banner: cookies off by default, equally prominent reject button?
- Withdrawal button: implemented for EU countries with completed transposition?
- AI chatbot: disclosure message visible ahead of August 2, 2026?
- Footer links: ODR and KZP?
Compliance isn't a one-time task - it's a moving target. Half the requirements above took effect in the last 18 months. Reviewing your Terms once a year costs far less than an enforcement order with penalties stacked clause by clause.