Terms and Conditions for an Online Store: requirements, AI risks and online withdrawal in 2026

Current as at 20 October 2026. This article reviews the requirements for terms and conditions, online sales and the withdrawal function under the legal framework described below.

A practical guide for online merchants and e-commerce business owners

A practical guide for online merchants and e-commerce business owners

Author: Attorney-at-law Gabriela Ivanova | Ivanova Legal Solutions

Editorially current as at: 20 October 2026

Terms and conditions for an online store must match the actual sales, payment, delivery and returns process. A copied template or unreviewed AI-generated text can leave a business with unclear contractual rules. This guide addresses the necessary checks, the online withdrawal function under Article 52a of the Bulgarian Consumer Protection Act, and practical steps for updating an online store.

Launching a successful online store requires an attractive design, functional software, logistics and focused marketing. In the drive to go live quickly, many online-business owners underestimate the legal framework and treat terms and conditions as a formality — a compulsory footer link or a tick-box at checkout. Two risky shortcuts are common: copying terms from a competitor’s website or generating them wholesale with AI tools in a few minutes.

Copied or unreviewed automated text may not correspond to the business’s actual commercial, technical and logistical processes. In the event of a complaint, consumer dispute or inspection, those mismatches can lead to unenforceable clauses, administrative measures and financial loss. The precise consequences depend on the breach and the applicable procedure.

Following the latest amendments to the Bulgarian Consumer Protection Act, promulgated in State Gazette No. 87 of 24 September 2026, the transparency requirements for e-commerce have increased materially. This article explains why terms must reflect the real business activity, why AI cannot replace legal expertise, and the nature of the new mandatory online withdrawal function under Article 52a of the Consumer Protection Act.

What are terms and conditions, and why must they reflect the real activity?

Terms and conditions are pre-formulated contractual clauses which become part of an individual distance-sales contract once properly accepted by the customer. To produce their legal effect and protect the stability of transactions, they must accurately describe what the online store actually does.

A mismatch between the terms and the real operation of the website may have serious consequences:

• Logistics and payment. If the terms provide only for card payments but checkout also offers cash on delivery through a postal money transfer, the information does not reflect the actual process. Cash on delivery and a postal money transfer are not interchangeable concepts. Where a licensed postal operator handles a payment as a postal money transfer, an exemption from issuing a fiscal receipt under Article 3(1) of Ordinance No. N-18 may apply. That is not the end of the documentation requirements: the Bulgarian National Revenue Agency also refers to a customer document with specified minimum content. The payment model and documents should be checked with the accountant. NRA guidance.

• Delivery times and costs. Promised delivery times must be realistic. Failure to inform the customer of applicable additional costs may release the customer from paying them. An unrealistic delivery time does not, by itself, automatically eliminate every courier charge; the consequences of delay are assessed separately.

• Misleading commercial practice. False or misleading information about price, delivery, complaints or customer rights may fall within the prohibitions in Article 68g et seq. of the Consumer Protection Act where the statutory conditions are met. Not every editorial inaccuracy is automatically an unfair practice.

• Unfair terms. Articles 143 and 146 of the Consumer Protection Act require an assessment of good faith, significant imbalance to the consumer’s detriment and individual negotiation. General clauses shifting transport risk to the customer or allowing unilateral changes to an agreed price require particular attention. Acceptance of the terms does not cure an unfair term.

AI-generated terms or a copied template: five practical risks

Generative AI tools are useful for structuring ideas, translation and text processing, but using them uncritically to produce legal documents creates significant risk for online businesses.

The principal reasons why “terms generated in 30 seconds” can harm a business are:

1. Inaccurate or outdated legal references. AI may suggest repealed provisions, non-existent decisions or clauses unsuitable for the particular contract. Concepts such as a warranty disclaimer, indemnification or arbitration clauses cannot simply be transplanted from a foreign template: their permissibility and meaning depend on the applicable law and the parties.

1. Confusing applicable law and jurisdiction. A choice of foreign law is not automatically invalid. However, where Article 6 of the Rome I Regulation applies, it cannot deprive a consumer of mandatory protection. Case law highlights the risk that such a clause may create the false impression that only the chosen law applies. International jurisdiction and local venue are separate issues.

1. No knowledge of the physical and technical process. An AI model does not know how your stock software works, which courier you have contracted with, which payment methods your checkout supports, or what happens when an item is out of stock. It will produce abstract language that may directly conflict with the actual steps on your website.

1. Ignoring product-specific rules. Selling clothing calls for a different approach from selling cosmetics, food supplements, sealed hygiene products, personalised gifts or digital content. AI rarely accounts for statutory exceptions to the right of withdrawal (Article 57 of the Consumer Protection Act) and the rules on legal conformity guarantees. That may lead a business to accept returns for products where the law in fact gives it protection.

1. No individual legal assessment. Generated text is not, by itself, a legal service and does not replace a review of the specific risks. Any potential liability of an AI provider is a separate question governed by the relevant contract and law.

Terms, GDPR and cookies: which documents are needed?

Documents must be clear, accessible and tailored to their different functions. For convenience and transparency, the following materials are usually separated; this does not mean the law always requires each of them to be a separate file:

• Terms of sale. They govern the contractual relationship between seller and buyer — ordering, contract formation, price, delivery, transfer of risk, withdrawal, legal conformity guarantees and complaints — under the Consumer Protection Act, the E-Commerce Act and the Bulgarian Act on the Supply of Digital Content and Digital Services and the Sale of Goods.

• Privacy notice. The information required by Articles 13 and 14 GDPR explains the purposes, legal bases, recipients, retention periods and data-subject rights. It must be easy to find and clearly distinct from contractual terms. Not every processing operation requires consent: fulfilment of an order, for example, may have another legal basis.

• Cookie information and consent management. The rules on storing or accessing information on the user’s terminal device must be checked, including Article 4a of the Bulgarian E-Commerce Act. For technologies outside the relevant exemptions — including many analytics and marketing cookies — prior valid consent is required. Strictly necessary technologies are assessed separately. The banner must reflect how the website actually behaves.

• Internal rules and procedures. These govern a merchant’s internal organisation, staff work or rules in a physical store; they are not the contract with the end customer.

Online withdrawal under Article 52a of the Consumer Protection Act: requirements in 2026

The amendments promulgated in State Gazette No. 87 of 24 September 2026 introduced a withdrawal function in Article 52a for consumer distance contracts concluded through an online interface. Its availability is linked to the period during which a right of withdrawal exists; it does not create such a right in cases excluded by law. Promulgated amendments.

Many merchants mistakenly see this as the creation of a new substantive right of withdrawal. The consumer’s right to withdraw from a distance contract within 14 days without giving reasons has existed in Article 50 of the Consumer Protection Act for years. The new Article 52a requirement concerns the technical ability which an online shop must provide on its website for exercising that right.

How does the withdrawal function work?

1. Visibility and wording

The website interface must include a button or link clearly labelled “withdraw from the contract here” or an equivalent unambiguous expression. The function must be visible, easy to access and active throughout the statutory withdrawal period.

2. Information in the online declaration

The function must enable the consumer easily to provide or confirm their name, contract details and details of the electronic means through which confirmation will be sent, such as email.

3. Confirmation of withdrawal

After entering the information, the interface must provide a confirmation button labelled “I confirm withdrawal” or a similarly clear expression.

4. Confirmation on a durable medium

Once the declaration is sent, the merchant must, without undue delay and no later than the end of the working day, send the consumer confirmation on a durable medium (by email) stating receipt, the contents of the withdrawal and the exact date and time of submission.

5. Pre-contractual information

Where applicable, the pre-contractual information must state the existence and location of the function. The terms and website guidance must be aligned with this process.

A declaration submitted before the relevant period ends is treated as exercise of the right in time. In practical terms, this requires reliable recording of the submission time and dispatch of confirmation. Design should not obstruct the customer with unclear buttons or unnecessary steps; special restrictions on manipulative interfaces are assessed under the applicable regime.

When does the consumer have no right of withdrawal? Exceptions under Article 57

A general clause saying “the goods cannot be returned once the transport packaging has been opened” is not a reliable way to restrict the right of withdrawal. Opening a courier box is not the same as unsealing goods to which a statutory exception applies.

The Consumer Protection Act contains an exhaustive list of exceptions in Article 57. The most practically relevant include:

• Goods made to the consumer’s specifications or clearly personalised (Article 57(3)). This covers personalised items such as custom-sized clothing, engraved jewellery or printed souvenirs. It does not apply to standard goods simply selected by colour or size from a ready catalogue.

• Sealed goods unsuitable for return for health-protection or hygiene reasons once unsealed after delivery (Article 57(5)). The statutory conditions must be met, including unsealing after delivery and an objective unsuitability for return for those reasons. Simply calling an item “underwear”, “swimwear” or a “mattress” does not decide the issue. Case law requires a restrictive approach to the hygiene exception: removing protective film alone is not sufficient to exclude the right of withdrawal.

• Perishable goods (Article 57(4)). Food, flowers and products with a short shelf life.

• Digital content not supplied on a tangible medium (Article 57(13)). For contracts involving a payment obligation, loss of the right after performance begins depends on prior express consent, acknowledgement that the consumer loses the right, and provision of confirmation under Article 49(8). Digital services and training products require separate classification; a blanket statement that “digital products are non-returnable” is insufficient.

Where a right of withdrawal exists and the merchant has not supplied the required information about it, Article 51 provides for an extended period. If the information is supplied during that additional period, the corresponding 14-day period runs from receipt. This does not automatically create a right of withdrawal for every contract excluded by law.

The order button: how must the payment obligation be labelled?

One of the most common omissions in e-commerce software is the wording on the final order button. Under Article 49(2) of the Bulgarian Consumer Protection Act and Article 8(2) of Directive 2011/83/EU, where an online order entails a payment obligation, the button must be labelled clearly and legibly with “order with obligation to pay” or an equivalent unequivocal formulation, such as “Buy and pay”.

Vague labels such as “Next” or “Continue” may not meet the requirement. Where the obligation to use an unambiguous label is not met, the consumer is not bound by the contract or order. Case law underlines the importance of the wording on the button itself, not merely explanations around it.

Immediately before the order, the required material information must be provided clearly and prominently, including the characteristics, total price and applicable information on the duration and minimum term of obligations. Delivery costs and restrictions must also be disclosed in accordance with the applicable rules.

Online-store review: a ten-question checklist

Use the following self-check as a starting point for legal and technical review:

1. Full identification of the merchant: are the company name, Bulgarian company registration number (UIC), registered seat, business and correspondence address, phone number, official email and VAT registration stated, as applicable under Article 4 of the E-Commerce Act and Article 47 of the Consumer Protection Act?

1. Supervision and disputes: is the relevant information on supervision, complaints and alternative dispute resolution provided? It is not necessary to list every institution mechanically regardless of the business.

1. Consistency with checkout: do the terms describe precisely the same steps, payment methods (for example, postal money transfer and card payments) and courier services that actually operate on the site?

1. Prices and currency: are prices displayed clearly, inclusive of VAT, and in the valid currency?

1. Final button: does it state the payment obligation unequivocally — for example, “Order with obligation to pay” or another equally clear expression?

1. New withdrawal function (Article 52a): is a visible and accessible “withdraw from the contract here” function integrated into the online interface, allowing details to be entered, “I confirm withdrawal” to be clicked and an email confirmation with date and time to be sent by the end of the working day?

1. Information about the function’s location: is the location of the withdrawal function stated in the terms as required by Article 47(1)(8) of the Consumer Protection Act?

1. Product-specific rules: are exceptions to withdrawal (Article 57) included only for items that actually meet the statutory criteria, such as sealed hygiene goods or personalised products?

1. Personal data and consent: is information about personal-data processing clear and accessible? Are acceptance of contractual terms and consent for other purposes distinguished where such consent is needed?

1. Durable medium: does the customer receive the required contract confirmation within the statutory period and by an appropriate means? Email and PDF can be practical solutions, but PDF is not the only permissible format.

When should you update your terms and conditions?

Terms and conditions are part of the sales organisation. A legal review is most useful when it covers the text, the technical process, logistics and customer communications together. This reduces inconsistencies and creates clearer rules for daily operations.

Bringing an online store into line with the new Article 52a requirements on the online withdrawal function in a timely manner is not only a legal commitment, but also a clear signal of professionalism and reliability to customers.

Frequently asked questions

Can I copy terms and conditions from another store?

That is an unreliable starting point. Another business’s text may describe different payments, products, deliveries and contract steps. The terms need a review against your own activity.

Is it enough to change the wording about online withdrawal?

No. Where Article 52a applies, a functioning interface feature is also required, as well as receipt of the declaration and confirmation on a durable medium.

Do I need separate rules for businesses and consumers?

The differences between B2B and B2C sales must be addressed. Consumer rights do not automatically transfer to every business customer, and a consumer cannot be deprived of mandatory protection merely by contractual labelling.

How much does preparing or reviewing terms and conditions cost?

The scope depends on the products, markets, languages, payment methods, subscriptions and whether a website review is required. For an individual quote, send the store address and a short description of the business.

How can we help?

Ivanova Legal Solutions supports online stores and digital brands based on their real operating model:

• Drafting and updating terms and conditions, withdrawal, return and complaint rules.
• Legal audit of the online store — pre-contractual information, checkout, pricing, promotions and customer communications.
• Legal requirements for the withdrawal function and coordination with the technical team on the necessary wording and processes.
• Personal-data and cookie documentation aligned with the services and technologies used.
• Contracts with suppliers, platforms and partners, including content and intellectual-property matters.
• Assistance with complaints, inspections and claims, as well as ongoing contractual support as the business grows.

Explore our legal support for online stores and digital brands.

Need terms and conditions for an online store, or a review of existing documents?

Send the website address, what you sell and whether you need new documents, an update or a legal audit. We will discuss an appropriate scope of support.

Send an enquiry ↗

givanova@ivanovalegalsolutions.com

Please do not send confidential documents or sensitive personal data in the initial enquiry. If needed, we will agree an appropriate secure channel. An enquiry does not create an attorney-client relationship.

This material is for general information only and does not constitute individual legal advice. Applicable requirements must be assessed against the specific business, products, customers and markets.