New here? Subscribe on Substack and the next Rabbit Hole lands in your inbox.

“I didn’t even want to buy a tee with a parrot… until that day”.

This totally happened: a YouTube creator I follow for parrot videos posted this. Read it twice, because almost every word is doing more work than it looks like:

“With the upcoming EU Directive 2023/2673 ‘withdrawal button’ coming into effect on June 19, we’re making the hard decision to no longer accept merch orders from the EU as of June 18th. Along with VAT taxes and other costs, this new legislation makes doing business in the EU unsustainable at our current size”. — Apollo and Frens, June 2026

If you’re not in the EU, you have probably never heard of Directive 2023/2673, and you have no particular reason to care.

If you are in the EU… well, you also likely never heard of it.

Unless you happened to discover that a cute parrot tee supporting your favorite blogger is, for reasons nobody quite explains, simply no longer for sale to you.

But that announcement gets one big thing wrong, and one big thing right.

The cursed “withdrawal button”—the literal subject of the long directive that gets named—costs zero dollars to add.

It is a button and a confirmation page. That’s it.

It does not: - collect tax, - involve talking to customs, - fine you if you don’t return goods at first demand, - require anyone physically in Brussels (or the other 26 countries in the EU).

On its own, it would never make a merch shop “unsustainable”.

Right?

Well, going dark on the EU is, honestly, a rational call.

Because “the withdrawal button problem” is not really about adding a button.

Behind it stands a stack of European rules that piled up for decades. That stack genuinely turns small cross-border selling into a pain.

“It’s called a”withdrawal button”, but the reality is… pages upon pages of paperwork?” — me while researching this

Exactly the confusion a small army of consultancies is, right now, being paid to amplify.

Go looking for a straight answer, and you get two kinds of result, both useless to a human actually selling to Europeans. First is AI-generated panic slop: enterprise blogs manufacturing fear, every one of them quietly funneling you toward a “compliance consultation”, starting at €20k in billable hours + retainer, promising to cure your pain.

The slop in question: FOMO, AI tropes, “it’s not X, it’s Y”, et al.

The second is the primary source itself: a europa.eu directive written, with great care, for solicitors (that’s lawyers for you in America!), full of legalese and jargon. Nobody in the middle is just telling the hypothetical “parrot content creator”, the Shopify store, the SME, or the exec who got volunteered last Thursday to “fix this by end of week”.

So, in this Rabbit Hole: the grounded, slightly devil’s-advocate version. For the business owner, the enterprise exec, the manager, the SME, and yes, digital creators. Here’s what each rule actually is, who it really hits, and what you can do that isn’t “panic” or “abandon 450 million customers”.

This is not legal advice. Let’s dive in.

What is the EU’s problem?

Say “new EU regulation” out loud, and the room splits: half eye-roll at Brussels inventing another form to fill in, half assume the worst about whatever “European Communism” cooked up this quarter. Both reflexes skip the boring, inconvenient part.

As always, the EU is reacting to something real.

Canceling, online, has been quietly engineered to be hard. You subscribe in one tap, but leaving means:

• a hunt through three settings menus,

• an “are you sure?” guilt screen with 5 steps,

• a phone line open Tuesdays from 6 to 8 AM,

• a cancel link rendered in 8-point gray,

• sending certified mail that will get lost anyway. Yes, not email—snail mail.

“🎵 you can check out anytime you like, but you can never leave”

The EU’s own Fitness Check (its periodic review of whether existing consumer law still works) found that roughly 69% of consumers who tried to cancel an online contract hit some deliberate technical difficulty. It’s a design pattern with a name (the “roach motel”: easy in, impossible out) and a whole discipline, “dark patterns”, built to keep you paying.

Then the second thing it’s mad about: Temu and Labubus.

Yes, really.

Genuine concerns about fast fashion, ethics, and the environment aside—around 4.6 billion parcels under €150 poured into the EU in 2024, roughly 91% of them from China, most riding a duty-free loophole that EU retailers, who pay the VAT (value-added tax, Europe’s sales tax), the safety testing, and the duties, simply do not get.

From Brussels’ chair, that looks like its own shops being undercut by an ocean of untaxed, untested, semi-disposable stuff, sold to its own consumers through a dopamine loop tuned in a lab.

So the “problem”, stated fairly, is very real: a digital marketplace in China optimized to trap you in subscriptions, undercut domestic sellers, and outrun consumer protection faster than any regulator can file the paperwork. Even allergic-to-Brussels people can look at that and concede something is off.

And yes, it’s also the tariff war the US kicked off—chaotic enough that the Supreme Court struck the tariffs down in February 2026 and the White House slapped new ones on within days—and the fact that logistics get pricier by the week, fuel prices are up no thanks to the 2026 Iran war, the closed Strait of Hormuz, and a Red Sea nobody’s sailing through. Not just another “ban plastic straws” law.

Which makes the instinct defensible, but the implementation… not as much.

no, they weren’t a fad. we’re still facing the consequences today.

Every tool the EU reaches for: a mandatory cancel button, a named EU “responsible person” on every product, a universal right with no minimum price or size, is aimed at AliExpress, Shein and Temu, the actual villains of the story.

The catch is that the giant companies can absorb every one of them, and the small can’t.

Every one of those tools lands hardest on the person the EU was likely not trying to disadvantage: the one human in Florida selling tees of their genius parrot, the small Australian studio handcrafting shoes, and the small Ukrainian shop knitting hats and teddy bears.

The fast-fashion giant will absorb all of it without even noticing—as proved by the €40 million fine France handed Shein in 2025, which it shrugged off while staying open for business.

The proposed solutions so far

Here is the part almost nobody explains: the “withdrawal button” is not a new right.

First, the 101, because the word hides a lot. A “withdrawal” just means backing out of a purchase and getting your money back, no reason owed. It exists because, for most of shopping history, the moment a stranger had your money you were on your own. The doorstep salesman vanished, the mail-order catalog never shipped, the dodgy early websites transmitting your credit card information unencrypted to an offshore server. The right to change your mind was invented to end that era, and the “button” is just the newest way to claim that right.

The “change your mind” idea behind it—the cooling-off period—goes back to 1960s installment-credit law, and the EU has guaranteed a version of it since its 1985 Doorstep Selling Directive, back when “online shopping” still meant a mail-order catalog.

The “button” is merely the latest patch in a decade of EU attempts to solve one messy, multifront problem. So climb into the regulator’s chair for a minute and watch the parade of fixes, each one plugging a leak the last one sprang.

“ladies and gentlemen, what shall we regulate today?”

(Image credit: JLogan on Wikimedia Commons, licensed CC BY-SA 3.0.)

What buying used to be

To see what each fix was actually for, follow one man through all of them.

Say I’m Bruno.

I live in Fürth (Bavaria, Germany). I order more off the internet than I’d admit at dinner, and above everything I like my life in order.

It’s 2008. The world financial crisis is making prices go uncomfortably up, and I want a phone charger for my Nokia. I’m well aware at this point that prices of goods on the Internet are often much cheaper, and it’s easy to order online, then collect at my post office. So I find a webshop (eBay, anyone?), type in my card details, wait a week, it shows up.

That’s the entire transaction: no “cooling-off”, no “responsible person”, no cookie banner, no “you owe us tariffs” note on a €4 trinket.

Beautifully simple… and beautifully unprotected. If it never arrived, came broken, or the shop evaporated overnight, Bruno was on his own. Every rule below is the EU trying to keep that simplicity while deleting the “you’re on your own; good luck!” part.

2014: Bruno gets buyer’s remorse

Bruno orders a jacket, hates it in the mirror, and ships it back inside two weeks for a full refund, no reason required. That is the Consumer Rights Directive: a 14-day “change your mind” window on anything bought at a distance.

Anything? Almost. There’s a short list of things you can’t send back, for common sense reasons.

Obvious exceptions: bespoke items, perishables, unsealed hygiene goods, and a handful more, software or a CD once you break the seal, that day’s newspaper, a hotel or flight booked for a specific date. The full list is longer and duller; the point is that a standard printed parrot tee is nowhere on it.

Clean, humane… and immediately leaky.

A jacket is easy to send back. A download is not. Watch what happens the first time that tidy little right collides with something digital.

Bruno buys a video game on Friday. Plays it all weekend. Then, next week, on a Monday morning he clicks “refund, I changed my mind”. According to the new law, he keeps the game; the seller eats the refund. You cannot un-sell a played download. The 14-day right, written for jackets, sprang a hole the instant it touched anything digital.

So Brussels and the platform lawyers bolt on a fix. A trader may switch the 14 days off for digital content if the buyer gives “express consent to immediate performance” and acknowledges they forfeit the right (the legal hook is Article 16(m)).

That box, “start my download now, I understand I lose my right to cancel”, is the one Bruno (and you) have clicked on Google Play, Steam, the App Store, and the Nintendo eShop for over a decade. A real, working solution, for digital. Physical goods got no such escape hatch.

these little guys.

Hold that thought.

Meanwhile, Bruno’s socks follow him around the internet

Different leak, same digital era.

It’s 2015. Bruno leaves a pair of socks in an online shop cart without buying them.

For three weeks every site he visits shows him socks while his inbox fills with “still thinking about these? you left something in your cart 🧦”.

That is the leak GDPR (2018) went after, the law Americans mostly meet as “the cookie banner law”.

It is far bigger than banners and cookies, but the part Bruno feels is the restrictions companies now must adhere to on exactly this: who gets to hoard his data and chase him across the web over one abandoned cart. And a “no, I don’t consent to tracking” decision is typically not ground for denying service.

“Did you know you can (and, arguably, should) click “Reject All” or “Manage Options - Only mandatory” on most cookie banners?

The fact that the EU’s own fix then saddled him with a cookie pop-up on every page is its own Rabbit Hole. So before we veer too deep…

2019—2022: name the friction

Somewhere in here the whole economy quietly rewires itself around “recurring revenue”.

Everything becomes a subscription.

Davos gleefully lands the now infamous “you’ll own nothing and be happy”, dishwashers suddenly start offering “monthly plans”, and a generation discovers the special joy of a “free” trial that auto-renews at €99 a year.

Bruno likes the convenience, though. He has a Spotify subscription for music, an iCloud subscription for his photos… and a new Xbox with a Game Pass membership. 100 games for only €9 a month, baby!

Until Bruno wants to switch, or the service stops suiting him.

Sellers honored Bruno’s right to cancel… but the “your subscription is now canceled” outcome had him go through cancel-by-phone, guilt screens, and 8-point-gray “cancel” links. So the EU passed the Omnibus Directive (2022). An “omnibus” law means one that amends several others in one fell swoop.

It did not ban “dark patterns” wholesale; that fight is still coming. What it actually outlawed was a specific menu of tricks: fake reviews (and deleting negative ones), undisclosed paid search rankings, surprise fees at checkout, and fake “was €99, now €9” discounts. It also forced sellers to admit when a price had been personalized just for you.

Those were the headline bans, the consumer-facing stuff. But two quieter moves in the same law mattered more for Bruno. First, it redefined “price” to include personal data, so the “free” apps he pays for with his data finally count as real contracts, carrying the same 14-day right and the same disclosure rules as anything bought with euros. That way, a “free” account, your Meta login, a games app, legally becomes a contract Bruno can walk away from, with the same rights as anything bought with euros. Second, it put a number on cheating: fines up to 4% of a company’s annual turnover, the same GDPR-scale stick that turns a wrist-slap into a line on the earnings call. The friction finally had a name and a price.

Remember: none of this is only digital. The same directive, the same right, the same 4% stick covers Bruno’s physical orders too—the jacket, the parrot tee, the Nokia (now iPhone) charger.

Which sets up the move every regulator went on to copy.

2022: Germany hands Bruno a button

The Omnibus told sellers what they must not do—hide the exit—but never what they must build instead. A vague “don’t bury the cancel” still leaves a thousand ways to make “easy canceling” ambiguous.

So Germany stopped describing the bad behavior and mandated the good one: not “make it easy”, but “put this exact button, here”. A permanent, clearly-labeled, two-click Kündigungsbutton (“cancel here”), written into law as §312k BGB.

Bruno cancels his gym in two clicks instead of a registered snail-mail letter.

Retailers howled, and a wave of competitor and consumer-group warning letters followed (a year in, a consumer-group sweep still found barely 40% of subscription sites compliant). But the sky stayed up, and Brussels took notes.

The other front: Bruno’s €4 phone charger

Cancellation was only half the headache. Now let’s address the other elephant in the room.

The deluge of 4.6 billion cheap parcels a year.

Little to none of them had to undergo the duty, safety, and tax checks. Most of them landed on doormats exactly like Bruno’s.

Back in 2008, Bruno’s €4 charger sailed in untaxed thanks to an old rule: any parcel declaring a value of €22 or less owed no import VAT at all.

That floor vanished in 2021.

VAT from the first cent means every parcel now owes tax, even the €4 one, and the seller remits it through IOSS (the Import One-Stop Shop): one EU portal and one monthly tax return instead of registering in 27 countries.

So why do you, a European, still feel like you pay zero tax on your Temu hauls?

You don’t.

Either the seller used IOSS and quietly baked the VAT into the price you already paid at checkout, or it under-declared the parcel’s value to skip it—which is rampant, and is the whole reason the rules below exist.

Then came the DSA (Digital Services Act, 2024). It put the platforms themselves on the hook: Brussels opened proceedings against Shein, fined Temu €200 million, and pinned AliExpress to binding commitments, all for letting illegal and unsafe products (counterfeits, banned goods) flood their feeds. The shift was philosophical: stop chasing millions of dodgy sellers one at a time, and make the marketplace itself legally answer for what it lists.

The GPSR (General Product Safety Regulation, 2024) demands a named, EU-based “responsible person” accountable for every product’s safety. The catch is in “EU-based”: it has to be a real legal entity inside the EU, an importer, a distributor, or a paid representative, who takes on liability for the goods. A one-person shop in Ohio can’t just type in their own name and address; it has to find and pay an EU company to stand behind every product. For a hobby seller, that overhead alone is the difference between shipping to Europe… and quietly switching it off. This was the quiet patch that actually killed small cross-border shipping: the week it took effect, small sellers paused EU and Northern Ireland orders rather than fund a compliance agent most had only just heard of.

Have I mentioned Bruno also loves importing odd novelties from Japan or the US? A Blu-ray box set of the Pokémon anime, a new PlayStation Portal, that fancy American BBQ sauce Reddit won’t shut up about. Here’s the rule he’s leaned on without knowing its name. The €150 “de-minimis” law meant a parcel worth €150 or less skipped customs duty, the import tax that sits on top of VAT. (Not VAT itself; that’s been due on everything since 2021. This is the extra layer.)

Anything above €150, like that $199 gaming device, always paid full duty plus VAT, so nothing there changes. What changes in 2026 is the lower end: killing the de-minimis rolls out a flat €3 charge on the small parcels that used to ride free. On Bruno’s €4 charger, that €3 is almost the price of the thing again. Trivial on one parcel, brutal across four billion of them—which is exactly the point.

2026: the fronts collide

Germany’s cancel button goes EU-wide as Directive 2023/2673, scaled to all 27 member countries.

That, in a nutshell, tells you everything about how Brussels moves, smuggled into a bill about the distance marketing of financial services. Bruno can now hit “Withdraw” on almost anything he buys online. The cancellation button patch and the parcel spam patches are all inside the same eighteen months. What reads like a coordinated assault is really a decade of separate meetings finally getting approved all at once.

Already coming: the next patch

Two more bricks in the wall are already waiting. The Digital Fairness Act, a proposal the European Commission (the EU’s executive branch, the body that drafts and proposes its laws) is expected to table in late 2026.

It aims straight back at the dark patterns the whole saga started with, but where the 2022 Omnibus banned a fixed list of named tricks, this one goes after the design itself: cancellation made deliberately hard, manipulative interface design, addictive feeds, and surge pricing tuned to exploit what a platform already knows about you. And a second file—the Digital Omnibus (a separate, parallel EU proposal)—finally goes after the dreaded “cookie banner” the EU inflicted on the world in the first place—the plan is a one-click “reject all” that your browser can remember and send for you automatically, so you stop re-answering the same pop-up, plus a six-month ban on a site asking again once you’ve said no.

Twenty years in, Bruno can: - cancel in one click - send almost anything back - not provide a cancellation reason - and is about to stop clicking “accept” forty times a day

He still has no idea any of it has a name.

all of that for saving a few euros on a phone charger 20 years ago.

Where we have arrived in 2026 (the TLDR)

As you can see, the so-called “withdrawal button” didn’t arrive alone. It’s the newest brick in a wall the EU spent years building. One rule at a time, each aimed at the swarm of packages, each rule affecting everyone in the world.

Here’s the whole stack, in plain words and plain dates.

Rule; What it means, in one line; Live since

• VAT from the first cent: The €22 tax-free floor is gone; VAT is due on everything, collected through one IOSS portal. 1 Jul 2021

• DSA trader traceability: Marketplaces must verify who their sellers really are before listing them. 17 Feb 2024

• GPSR, the “responsible person”: Every product needs a named, EU-based person liable for its safety. The brick that quietly ended small EU shipping. 13 Dec 2024

• The Withdraw Button: Directive 2023/2673: one-click cancellation for EU buyers. The headline act. 19 Jun 2026

• End of the €150 de-minimis: The duty-free pass on small parcels dies; a flat €3 duty per item replaces it. 1 Jul 2026

• The Digital Fairness Act: Still a proposal: aims to ban dark patterns, addictive design, and unfair personalization. The next brick. Expected late 2026

Notice the headline act, the button, is the cheapest line on that list, and it’s the one everyone’s panicking about. The genuinely expensive bricks (GPSR, VAT) arrived quietly, eighteen months early, with no countdown.

So why does the parrot content creator blame this “cheap” law?

Put yourself in their chair.

• VAT, which (unlike US sales tax, collected for you at the register) the seller has to register for in the EU and file every month

• an EU rep—a person or company you pay to take legal responsibility for your products

• the €3-on-everything duty

Each was a survivable annoyance he’d swallowed one at a time. The button is different in two ways: it is the one with a hard, named, on-the-calendar date, the deadline that forces the decision he’d been deferring through every brick before it.

And it is the one that makes returns frictionless—so any EU buyer can now un-buy a €25 tee with a tap while he eats the transatlantic postage both ways—in one (mandatory-to-implement) click.

On parrot-tee margins, that is the straw. The button finally tips the whole decision-making process into “not worth it”.

And because it’s a Directive, not a Regulation, each of the 27 countries had to pass its own version—and some were late after the deadline. So whether it’s actually in force still depends on where your customer lives.

Yes, now you have to figure out “which of the 27 countries enforce this, and which ones are waking up to smell the coffee?”.

And that last table row—the Digital Fairness Act—is still yet to be proposed and finalized.

So what can you do?

If you didn’t get it yet—there is no size exemption. The 14-day right applies whether you turn over €5, €500, or €5 million a year. So the real question is never “comply or don’t”, but “which of three things you can afford to spend”.

Pick your poison below. It’s a triangle—your time, your margin, and your control—and you only get to keep two. You’re choosing the one you’ll give up.

Keep Europe and keep your evenings—pay in margin

This is the option nobody selling a compliance suite will mention, and it’s the one most small sellers actually want.

Hand the entire legal-seller job to a partner whose whole business is being the seller, and let them eat the VAT, the rep, the button, and the returns.

Selling digital goods? A merchant-of-record like Lemon Squeezy or Paddle—a company that legally becomes the seller—absorbs essentially all of it: EU VAT in every member state, the consumer-law duties, even the chargeback liability.

Selling physical goods? A marketplace (Etsy, Amazon), a print-on-demand partner (e.g. Printful), or Shopify’s Managed Markets (where Global-e becomes the merchant of record and adheres to local law for you) does the same for a cut of each sale.

You keep your store and your 450 million customers—but give up some margin and control. You already subscribe (= pay rent) to your storefront, your payments, and your hosting—renting the compliance is the same trade, and if your bottleneck is time and attention rather than cash, it’s the smart move, not a cop-out.

Keep your margin and your independence—pay in time

Do it yourself: register for IOSS, appoint one cheap EU rep, add the button, reprice for the €3 duty. Every point of margin stays yours and you control the whole experience; what you spend is the setup and the monthly filings. Initially slow work, but once you’re out of the start-up cost purgatory it just works.

Keep your time and your cash—pay in market

Switch EU checkout off.

Cleanly and dated, the way Apollo and Frens did. Cheapest in both money and effort, and a fair call when Europe is a rounding error. Just price in what you’re actually giving up: not only the sales, but the audience you quietly alienate and the upside you forfeit if your EU following ever takes off.

No single right answer. The corner you sacrifice depends on whether your scarcest resource is time, money, or being your own boss.

Concrete examples

The five rules are the same everywhere. What changes, platform to platform, is how much of them somebody else already carries for you. Here is the honest split, from “they do almost all of it” to “it’s entirely on you”. Find your row.

Shopify: it’s your problem, politely

Shopify has a help page for exactly this, and the first thing it does is hand the obligation straight back to you. It lays out the 19 June 2026 requirement—a visible withdrawal function, reachable without logging in, with a confirmation sent on a “durable medium” like email—and then says, in as many words, that “you’re responsible for reviewing this information and applying it to your business”. Shopify surfaces the rule. Shopify does not build the button.

There’s no native “withdrawal button” toggle in your admin (if Shopify ever ships one, use it), so two honest options remain:

• A Shopify app. The Shopify App Store already has purpose-built withdrawal-button apps that drop in a two-step form, match it to the order, and fire the confirmation email, several with a free tier. Fine, as long as you are not paying monthly rent forever on a glorified <form> tag.

• Do it yourself. A footer link reachable from every page (with no mandatory login), a confirm page, and Shopify’s own order-notification email as the durable medium. That is the whole job.

GPSR is similar: Shopify tells you a named EU “responsible person” is required, then tells you to go find and pay for one yourself. No built-in rep marketplace, just a product field to display the details. Good luck.

The platform that makes selling effortless is, when it comes to EU compliance, mostly a very polite sign that reads “your problem”.

WooCommerce: open source, so the community already fixed it

WooCommerce is the other half of the small-store world, and being open source, it punts even harder than Shopify. Its own guidance, published weeks before the deadline, ships no feature at all—it tells you to add a link, build a request form with any contact-form plugin, and process the refund through the order tools you already have. No native button, no “coming soon”.

The difference is that the ecosystem already solved it, for free. Germanized for WooCommerce, a free plugin with 70,000-plus installs, added a withdrawal button “in compliance with EU directive 2023/2673” in its current release—guest-accessible, with a timestamped confirmation email as the durable medium—and it carries the GPSR “responsible person” fields in the same free plugin. So on WooCommerce the honest answer is the cheerful one: install the plugin, fill in a couple of settings, done. Open source quietly hands you what Shopify wants you to rent.

Stripe: a refund is not a withdrawal

This is the most common mix-up, so let’s say it slowly: Stripe is your payments layer, not your consumer-law layer. There is no withdrawal button anywhere in Stripe, because that was never Stripe’s job.

When a customer withdraws and you push the refund through Stripe, the refund is the consequence of the withdrawal, not the withdrawal itself. The button, the two-step confirm, and the durable-medium email all have to exist before a single euro moves. Stripe’s customer portal can let subscribers cancel a plan in a click (handy, on by default), but that is a billing convenience, not the legally-labeled “withdraw from contract here” function that has to stay visible for the whole cooling-off period. Stripe’s one genuine EU-compliance footprint is SCA—the “confirm this in your banking app” step—which authenticates a payment rather than unwinds a contract. Different regime, different rulebook.

If you remember one line from this whole piece: “I refunded them in Stripe” is not “I was compliant”. The first is plumbing. The second is still yours to build.

There’s a darker corollary worth naming. A frictionless one-click withdrawal is also a one-click fraud surface: serial returners and fraudsters can withdraw, pocket the refund, and keep the goods (and the postage). So the moment you ship the button, fraud screening (Stripe Radar, a chargeback tool, a returns-abuse service) becomes the next thing you “need”. That’s the assimilation pattern again in miniature.

Etsy: the marketplace carries some of it

Etsy is the in-between case, and worth understanding, because “just move onto a marketplace” was the escape hatch from the last section: let a bigger platform absorb the compliance so you don’t have to. On Etsy you are still the legal seller, so the cancellation duty and the GPSR responsible person are technically yours—but Etsy quietly does a lot of the carrying.

It runs a built-in cancellation, refund, and case system, so the cancel mechanism already exists. For GPSR it lets you enter your “responsible person” once and applies it across every EU listing, and it partnered with EU-rep services so a maker in Ohio can actually appoint one instead of giving up. It even gives you a single switch to turn EU and Northern Ireland sales off entirely, which is how a lot of small shops “complied” in December 2024.

What Etsy had not, at the time of writing, shipped is a dedicated Directive-2023/2673 withdrawal button; it leans on its existing returns-and-refunds machinery instead. If that has changed by the time you read this, the underlying point has not: on a marketplace you inherit whatever the platform builds, for better and for worse.

The trade is the one from earlier: Etsy absorbs the painful parts, and in exchange takes its cut and its place between you and your customer. For many one-person shops that is the rational deal. It is also, precisely, becoming a tenant.

The App Store and Google Play: read the fine print on “who is the seller”

Selling a digital product through an app store? Whether the consumer-law machinery is yours hinges on one question—who is the legal seller—and the two big stores answer it differently.

On Apple’s App Store, the store is the seller. In the EU, Apple sells through an Irish entity, Apple Distribution International, which is the merchant of record: it takes the money, remits the VAT, and fields the cancellations, refunds, and the 14-day withdrawal. That part really is Apple’s problem, not yours.

Google Play is the trap. Google collects and remits the VAT for EU buyers, but its own terms say the purchase is “made from the developer of the app”. In other words, on Google Play you are usually the seller of record, and the consumer-law duty (including the withdrawal function) can land on you even though Google runs the checkout. Same kind of storefront, opposite answer. The plumbing is there, to be fair—Google gives you a one-click deep link to the Play cancel-and-manage-subscription screen you can wire straight to a button—so the mechanism was never the hard part; knowing the duty is yours is.

What both stores already give you, regardless, is the digital-goods escape hatch, the “I want this now, and I understand I waive my right to cancel” box from Bruno’s story, Article 16(m) in the flesh, plus built-in subscription cancellation in account settings. And the moment you take Apple’s or Google’s alternative EU payment terms and bill customers directly, every duty swings squarely onto you. So choose deliberately if you bill via Stripe in the EU.

Other digital storefronts

Steam, the Microsoft Store, the Nintendo eShop, Samsung’s and Xiaomi’s app stores, every other storefront collapses to the same single question: is the platform the legal seller, or just my payment processor?.

The big digital stores (Steam through Valve, Microsoft, Nintendo of Europe) generally sell as the principal, collect the EU VAT, and therefore carry the cancellation and withdrawal machinery for you, much like Apple. A thinner “we only process the payment” platform leaves it on you, like Google Play. Before you build anything, search your platform’s terms of service for the word “seller” and find out which one you are. That answer decides everything else in this article.

Your own storefront: the DIY route

If you run your own code, every piece is yours, which is also the good news—the whole thing is genuinely small. A visible “Withdraw from contract here” link on every page, a confirm step so nobody cancels by accident, a stored record with a timestamp, and a confirmation email as the durable medium. That is the entire spec.

Rather than paste a wall of code here, I built it once so you don’t have to: a free, open-source, copy-paste reference you can fork, at github.com/yuryv-info/parrot-tee-sample (with a live demo you can click through). It ships a plain button and confirm page and a tiny server handler. Ask your AI agent about wiring it into a Shopify theme or a mobile app’s settings screen—the notes and AGENTS.md are there for you.

If it’s still confusing

Yury, I just want to sell to Europeans and not leave my customers stranded. This is too complicated. What do I do, concretely?

Well, start by working out which of the five regulation packages even touch you—because most people owe far less than the panic implies.

If you sell physical goods to EU consumers from your own store, you owe four things:

1. Register for IOSS so VAT is handled in one place, through the EU’s One-Stop Shop portal (or let your accountant or an IOSS intermediary file it for you).

2. Appoint one shared EU “responsible person”. This is box-ticking, not a trust relationship: you are renting a name and an address that legally stands behind your product, usually for a flat annual fee in the low hundreds of euros. Search “GPSR authorized representative”, compare a few, pick one. You are buying compliance, not a co-founder.

3. Reprice for the €3 duty. Simplest path: fold it into your prices, or add a visible “EU import fee” line at checkout, the same way you already handle shipping.

4. Add the withdrawal button—an afternoon’s work with your web developer or an AI agent—or a free plug-in from your plugin’s app store.

That is the entire list. If you sell through a marketplace like Etsy or through the app stores, most of that is already carried for you, so check what they handle first (the per-platform breakdown is the section right above this one) before you build anything.

If Europe is a thin slice of your revenue, say under 5-10%, the honest answer might simply be to switch EU checkout off cleanly, the way Apollo and Frens did.

Just be clear-eyed that “off” is not free either: you are trading the compliance cost for the cost of alienating part of your audience and the upside you forfeit if your EU following ever takes off. Pick the cost you’d rather carry. (Product idea: you can add a waitlist for when you get a critical mass of European fans later in the future!)

What you do not do is buy a six-figure “compliance platform”, pay monthly rent on “withdrawal button as a service”, or panic in a lawyer’s office. Nobody is coming to fine a parrot merch shop on June 19th for a missing button. The real exposure is that 12-month cancellation window you trigger by never telling customers their rights at all, and that is fixed with one paragraph of plain copy that you asked ChatGPT to write for you.

The shameless plug

I’ll be honest about why this next section exists: untangling five overlapping EU rules for your specific shop is genuinely fiddly, and I find it weirdly fun, so I do it for people at yuryv.info.

I am not a lawyer, so I am not qualified to give legal advice on compliance and what you actually need to not get fined. What we can do is technical brainstorming—once you figure out what you need (a button, a cancellation flow, a rewritten copy, an IOSS signup), and the open-source code samples linked above are still too complicated, we here at Team YV can implement a compliant withdrawal flow in your store or app, then harden it with tests and automations.

“Consulting slots—and even discovery calls—run out fast. Don’t delay, buy today”

Conclusion

The EU’s “withdrawal button” is actually a slow, deliberate squeeze. VAT, traceability, product-safety reps, dead duty thresholds, and yes—a cancel button. It is aimed at making the bloc a harder place to sell cheap—not by banning Shein and Temu, but by making the cheap fast fashion stuff stop being so cheap, and at making customers harder to trap. The button is the part with a name and a date, so it gets the blame—just like “cookie banners” took the blame for the whole of GDPR in the 2010s.

Most of you reading this owe an afternoon of work, one tax registration, and one honest “is the EU worth it” reflection where you choose A, B, or C.

Apollo and Frens made a reasonable call given their audience is mostly US-based, and if naming the right decision saves even one of you from either overpaying a consultancy or needlessly switching off 450 million customers, this was worth writing.

— Yury Vashchylau • yuryv.info A deep dive into how apps, games, people, and money interact. yuryv.info | yvinsights.com | YV Podcast

• Subscribe on LinkedIn and send this to your boss: https://www.linkedin.com/newsletters/yv-insider-by-yuryv-info-7444467518737608704/

• Subscribe on Substack: https://yvinsights.com/

• The Rabbit Hole—out loud—on YV Podcast: https://yvpodcast.yvinsights.com/

The parrot that started all this gets the send-off—go give Apollo and Frens the views.

Links

The directive (primary) - Directive (EU) 2023/2673—EUR-Lex - Right of withdrawal and consumer rights—EUR-Lex summary

Dark patterns & cancellation friction (what the EU is reacting to) - EU consumer-law Fitness Check: 69% hit cancellation difficulty—Freshfields - European Commission behavioural study on dark patterns (2022) - FTC “click-to-cancel” / Negative Option Rule (2024) - Harry Brignull, the “roach motel” — deceptive.design - Mathur et al., “Dark Patterns at Scale” (Princeton, 2019) - Amazon Prime: Norwegian Consumer Council, “You can log out, but you can never leave” (2021) - Adobe: DOJ/FTC suit over hidden cancellation fees (2024) - The New York Times: phone-only cancellation—Deceptive Patterns - LA Fitness: FTC suit over certified-mail/phone cancellation (2025)

The logistics squeeze (2026) - US tariffs 2025-2026 tracker—Tax Foundation - The 2026 Iran war—Britannica - Strait of Hormuz / shipping impact—UK House of Commons Library - Oil prices and the Iran war—CNBC - Container lines unlikely to return to Suez in 2026—Air Cargo News

Withdrawal button analysis - The “Withdrawal Button”: a compliance risk for (non-)EU businesses—Taylor Wessing - EU Withdrawal Button: what US online sellers need to know—Arnold & Porter - Mandatory withdrawal button in Germany: penalties up to EUR 50,000 / 4% turnover—Bird & Bird - EU right of withdrawal compliance—Shopify Help Center

Germany’s precedent (Kündigungsbutton, §312k BGB) - Cancellation button in online sales—Noerr

GPSR (the responsible-person rule) - Selling consumer products to Europe under the GPSR—Etsy Seller Handbook - Some businesses suspend NI and EU sales due to GPSR—BBC News - What artists and makers on Folksy need to know about GPSR—Folksy - General Product Safety Regulation factsheet—UK Government (OPSS) - Understanding the GPSR—Shopify Help Center

Platform compliance (who carries the withdrawal duty) - EU right of withdrawal compliance—Shopify Help Center - Refunds—Stripe Docs - Strong Customer Authentication (SCA)—Stripe Docs - Apple Media Services terms and right of withdrawal—Apple Legal - Who is the seller / VAT on Google Play—Google Play Help - EEA consumer rights and the 14-day withdrawal—Google Play Help - Alternative business terms for apps in the EU—Apple Developer

VAT / IOSS - VAT One-Stop Shop—European Commission

End of the EUR 150 de-minimis - 150 EUR customs-duty exemption to be removed in 2026—EC Taxation & Customs

Fast fashion: the crackdown, the labor, the waste - France hands Shein EUR 40 million fine—Euronews - Shein suppliers’ workers face 75-hour weeks—BBC, via Business & Human Rights Centre - US Select Committee on the CCP: Shein & Temu forced-labor interim findings - The impact of textile production and waste on the environment—European Parliament

What’s next - Digital Fairness Act—European Parliament Legislative Train - Digital Fairness Act consultation (dark patterns, addictive design, personalization)—European Commission - The EU’s plan to tackle cookie fatigue (the Digital Omnibus)—Euronews - What the European Commission is and does—European Commission - UK’s own subscription regime (DMCCA), now set for spring 2027—Freshfields

A fresh Xcode install looks harmless.

But if you’ve been in the iOS game for a while, you know better—because nothing ages a developer faster than “No signing certificate ‘iOS Distribution’ found” on a release day combined with “where did all my hotkeys go??”.

I’ll spare you the history of Project Builder, and the fact that Xcode is a creaky, decades-deep codebase. The numbers back it up: you have to have a Mac and an Xcode toolchain as your primary IDE. Even though 95% of us are using Xcode as our main toolchain, the day you augment it with VS Code or Cursor is the day you realize you merely tolerated the default IDE Apple ships the mandatory stuff with.

The bottom line is: Xcode is just not pleasant to work with, and it never quite has been.

So this is the part where every micro-adjustment will make your life slightly better every time—and it compounds fast if you’re working on a moderately serious app or using a modern agent-assisted flow.

The Tough Part

If the Agentic AI hype wave taught you one thing, it’s that nobody can reliably predict what ships next month, let alone next decade.

This goes double for Xcode and Mobile development in general. There’s a real chance that tomorrow will bring web-based applets à la App Clips or Apple Glasses that compete with Meta’s Ray-Bans. Apple keeps quietly prototyping.

So I’ve written this list to be evergreen to the highest extent possible. If you’re reading this 10 years from now, unless Apple retires Xcode and does a full bottom-up rewrite, very few things here will be outdated. And judging by how the industry treats rewrites, where the canonical advice is literally “never rewrite from scratch”, plus Xcode’s own NeXT-era lineage, I would not hold my breath.

Light spoiler: Number 4 has been a game changer for me since 2019, and #5 has existed for over a decade now. Never went stale, never got retired by Claude Code, never went the way of Xcode Plugins.

Let’s dive in.

1. Install Xcodes to manage Xcode versions

_{A screenshot of Xcodes (source: GitHub)}

If you miss using JetBrains Toolbox—this one is for you.

Xcodes exists for one specific pain point: installing and switching between multiple Xcode versions without manually juggling giant app bundles. The official Homebrew formula gives you—and your favorite AI Agent—a command-line tool to install and switch between multiple versions of Xcode, while harnessing Apple’s own xcode-select tool—the latter only controls which already-installed developer directory is active for tools like xcodebuild, xcrun, and cc. It tells your system “hey, switch between different Xcode installations that I have on my machine”.

In a Beta season, if your next task is “ensure iOS Beta builds don’t break while you still need the latest stable version of iOS for maintenance work”, Apple’s answer is “use https://developer.apple.com/download/”.

When a “minor” Xcode upgrade breaks your CI pipeline, Apple’s answer is “well, have you tried Xcode Cloud?”.

Leave a comment

Xcodes is that switch + downloader + version browser—all the way down to Xcode 1.0. (Which you can’t run on a modern Apple Silicon machine. Sorry, no nostalgia Rabbit Hole this time.)

2. Enable “Show whitespaces and newlines”

The Xcode editor with invisible characters enabled

You can’t fix what you can’t see. By default Xcode hides every space, tab, and newline—which is how you end up with a diff that’s 40 “changed” lines and 39 of them are nothingness that you didn’t even touch.

Turn it on under Editor > Invisibles (recent Xcode also exposes it in Settings > Text Editing > Display). Spaces, tabs, and line endings become visible, so you catch a stray tab in a spaces file—or trailing junk—before it reaches the PR.

It looks noisy for a day. Then your brain filters the dots out and you never go back after noticing how tidy it makes your code look.

Pairs directly with the next one…

3. Disable “Leave whitespaces-only lines intact”

A stray whitespace-only line has entered your git diff.

Your “empty” lines still carry four spaces of invisible cruft that light up every diff.

It looks untidy, chaotic, and outright sloppy.

Now that you can see the whitespace, stop shipping it.

In Settings > Text Editing > Editing, turn on “Automatically trim trailing whitespace” and—crucially—its sub-option “Including whitespace-only lines”.

Prefer to script your machine setup? Execute these in your Terminal: defaults write com.apple.dt.Xcode DVTTextEditorTrimTrailingWhitespace -bool true and defaults write com.apple.dt.Xcode DVTTextEditorTrimWhitespaceOnlyLines -bool true. One shell script to solve both.

One known gap: blank lines inside multiline comments still don’t get trimmed.

…but the next tool catches the rest.

4. Install SwiftLint

Watch your language!

The one tool on this list I’ve run on every project since 2019.

SwiftLint enforces Swift style and conventions so code review stops being an argument about brace placement and goes back to being about logic.

brew install swiftlint, then add a Run Script build phase after Compile Sources.

That said, if you are using Homebrew, make sure you set ENABLE_USER_SCRIPT_SANDBOXING to NO, as its default YES value will block custom script execution since Xcode 15 (2023); add /opt/homebrew/bin to your PATH as well.

Drop a .swiftlint.yml at the repo root to pick your rules, and run swiftlint --fix && swiftlint if you want auto-correct plus warnings on the rest.

It’s scriptable and works great with Codex and Claude—ask your agent to do the setup for you, then watch the runtime do style policing for both manually- and automatically-generated code. (Hint: couple it with GitHub Actions, Xcode Cloud, or other CI of your choice—setup takes 2 minutes, zero API keys, and negligible compute time.)

Apple finally bundled swift-format into Xcode 16 (2024), which is nice—but SwiftLint had a six-year head start and a far deeper rule set.

5. Use Xcode templates aggressively

“This is the 200th time I’m creating an app with my preferred architecture. claude please fix”

The feature that’s been in Xcode for over a decade and almost nobody seemed to customize.

Every team has a “new screen” shape: a view, a view model, a TCA stack, a coordinator, a set of tests—all wired together. Rebuilding that by hand every time is how you introduce typos, half-missing boilerplate, and AI hallucinations.

It’s abstracted away from Xcode’s UI and has a hidden—almost undocumented—scripting language. In fact, the only properly documented articles I found online are reverse engineered over years of trial-and-error—either from GitHub OSS projects, or published on software agency blogs. But in this day and age, if you can now harness it by asking Claude or Codex to save yourself hours of unpaid labor, what’s stopping you?

Custom file templates live in ~/Library/Developer/Xcode/Templates/File Templates/ (create it—it does not exist by default). Each one is a .xctemplate folder with a TemplateInfo.plist and a base file. Name the base file ___FILEBASENAME___.swift and Xcode substitutes whatever name the developer types in the New File dialog.

Once your module template exists, “new feature” is a ten-second File > New—instead of a ten-minute ritual you will inevitably get wrong. Focus that energy on building business logic instead.

6. Enable the build performance benchmarks

Here’s a retro throwback screenshot for you. iOS programming has changed a lot since “CompileXIB” was a common build step, but the point still stands.

You can’t optimize a build time you never measure.

Apple’s answer to slow builds is “buy another MacBook”.

That works… up to a point where you’re optimizing CI time, or just trying to build more and live life instead of waiting for “Build Failed”.

When you realize how much of a sinkhole some Xcode builds become, you’ll be shocked. Talk about screen time!

First, surface the number of seconds it took you to build your Xcode project: defaults write com.apple.dt.Xcode ShowBuildOperationDuration -bool YES, then restart Xcode. The actual build duration now sits next to “Build Succeeded” in the toolbar, so every build tells you what it cost.

Second, find the “The compiler is unable to type-check this expression” culprits.

In Build Settings > Other Swift Flags, add -Xfrontend -warn-long-function-bodies=100 -Xfrontend -warn-long-expression-type-checking=100. Xcode then warns on any function or expression that takes over 100ms to type-check.

Which is almost always a sign of a SwiftUI body doing far too much, or a cursed line of chained operators, RxSwift-style.

“how to scare an ios developer”

7. Disable the crash reporter modals

“Xcode quit unexpectedly”

Nothing breaks flow like a modal you have to dismiss.

When you’re chasing a crash loop, macOS throws its “application quit unexpectedly” dialog every single time—stealing focus, stacking up, demanding a click before you can get back to work.

We will likely never achieve crash-free Xcode… or crash-free Apple apps, in general. But you can still cope with “quit unexpectedly” modals without having to retire from your work. (Yep, no need to retrain as a plumber.)

Share

defaults write com.apple.CrashReporter DialogType none makes it stop and write the report to a log instead.

Put it back with defaults write com.apple.CrashReporter DialogType crashreport when you want the dialog again.

Or, swap the modal with a nonintrusive Notification Center message instead: defaults write com.apple.CrashReporter UseUNC -bool YES

“‘tis a blessing!”

Honest caveat: this is system-wide, not Xcode-only. You’re silencing the crash dialog for every app and giving up the instant “Report to Apple” prompt. For a dedicated dev machine it’s an easy yes; on a Mac you also use for normal work—think twice.

8. Enable the spell checker

Image credit: Vincent Pradeilles

The compiler checks your syntax. Nothing checks your spelling.

Spelling bugs are the worst kind. Because they compile.

Turn on Edit > Format > Spelling and Grammar > Check Spelling While Typing. macOS then underlines typos in your identifiers, comments, and string literals. That matters more than it sounds: a misspelled dictionary key, a typo’d analytics event name, or a public method called intialize builds perfectly and ships straight to production—where someone finds it 18 months later.

Share YV Insights 🧑‍💻🔨 by yuryv.info

It is free, it is built in, and it has been sitting in that menu the entire time.

9. Anthropic and OpenAI integrations

Now you can ask Claude and Codex to “make no mistakes” without Cmd-tabbing.

The entry that did not exist two years ago.

Xcode 26 added Coding Intelligence with pluggable model providers—so the AI assistant is no longer a glorified autocomplete that’s somehow worse than GitHub Copilot in its heyday.

Open Settings > Intelligence. ChatGPT is built in: click Get in the Codex row to use it with a ChatGPT account. For Claude, either sign in with your Anthropic account or choose Add a Model Provider, enter https://api.anthropic.com/ and an API key from console.anthropic.com. Apple wired in the full Claude Agent SDK, so Claude runs as an autonomous agent inside the IDE—not just inline completion.

See Apple’s own setup docs for the full Rabbit Hole.

Subscribe now

For a company that spent years insisting on-device-or-nothing and a set of mid-2020s Apple Intelligence fiascos, shipping a settings panel whose entire job is to pipe your code to OpenAI and Anthropic is quite a welcome pivot.

10. Use xcconfigs

These little guys.

The .xcodeproj is where merge conflicts go to ruin your afternoon. Build settings live inside the project’s pbxproj by default—a format that is technically XML-ish and practically unreadable, and merge-hostile on top of that.

xcconfig files pull those settings out into plain text you can read, diff, and review like real code. One file per environment (Debug, Release, Staging), shared values in a base file—and your configuration stops being something you have to reverse-engineer deliberately.

Two rules: never add a .xcconfig to a target or to Copy Bundle Resources (that is, it must not end up in your .ipa), and migrate common settings one-by-one, since you can copy any setting’s resolved value straight from the Build Settings inspector.

This is the one that scales. On a solo toy app, you maybe won’t miss it. On a moderately serious app with three environments and a team of developers larger than one, a set of .xcconfigs becomes the difference between clean, flowing work… and a 600-line pbxproj merge conflict.

Summary

“People ask if Siri is finally smart now. And I say: she’s renting a brain from Google. It’s gonna be great.”

— Craig Federighi (source: i made it up)

As I’m writing this, WWDC26—and, with it, Xcode 27—are on the way.

Which means a fresh batch of new APIs piled on top of the old ones Apple still hasn’t finished burying. (Carbon took until macOS Catalina to fully die. Until you grep your system and find its leftovers still there. Go figure.)

In this first edition of YV Insights, you’re getting a bite-sized version of how I work at yuryv.info and my Tech, Mobile, and Biz day-to-day. There’s a lot more coming, and this newsletter is where it lands first.

So subscribe now, and you’ll discover how Apple will actually utilize Apple Intelligence in its Google Gemini-powered “comeback” move, and which parts of your future dev workflow are still Project Builder under the hood.

You’ll also get what’s genuinely new in Xcode 27, what breaks once Rosetta 2 is out of the game, and the, uh, insights your Project Manager is bothering you to dig for.

And one day, I’ll give one VIP Rabbit a free taco. So buy fast.

Welcome to the Rabbit Hole.

Links

Intro

• Things You Should Never Do (Joel Spolsky)

• Why is Xcode still rubbish (MacRumors)

• iOS dev statistics, 404 devs (RentAMac)

• VS Code

• Cursor

• App Clips (Apple)

• Apple Glasses, late 2027 (MacRumors)

• Ray-Ban Meta glasses

• The end of Xcode plugins / Alcatraz

1. Install Xcodes

• Xcodes

• Homebrew formula

• JetBrains Toolbox

• Apple Developer Downloads

4. Install SwiftLint

• SwiftLint

• ENABLE_USER_SCRIPT_SANDBOXING explained (Stack Overflow)

• What does export PATH mean (Ask Ubuntu)

• swift-format in Xcode 16 (Reddit)

5. Use Xcode templates

• Xcode templates tutorial (itCraft)

• Custom template for coordinators (Hacking with Swift)

• Yak Shaving Defined (Scott Hanselman)

6. Build performance benchmarks

• ShowBuildOperationDuration (macOS defaults)

• Build time optimization (On Swift Wings)

• The hidden costs of waiting on slow builds (GitHub)

• RxSwift

7. Crash reporter modals

• Disable the crash reporter dialog (OS X Daily)

8. Spell checker

• Enable spell checking in Xcode (Swift with Vincent)

9. Anthropic and OpenAI integrations

• Setting up coding intelligence (Apple)

• Anthropic API

• Anthropic Console (API keys)

• Claude in Xcode 26 (Simon B. Stovring)

• Copilot vs Xcode predictive completion

10. Use xcconfigs

• Xcode build configuration files (NSHipster)

• Property list / pbxproj format (Wikipedia)

Summary

• Carbon API (Wikipedia)

• Project Builder (Wikipedia)

• Apple to phase out Rosetta 2 (MacRumors)

• WWDC 2026 and Gemini-powered Siri leaks (Geeky Gadgets)

More from YV Insights

• yuryv.info

• yvinsights.com

• Subscribe on Substack

• LinkedIn newsletter