{"id":71998,"date":"2026-11-05T01:17:20","date_gmt":"2026-11-04T23:17:20","guid":{"rendered":"https:\/\/www.lhr-law.de\/?p=71998"},"modified":"2026-11-05T01:18:31","modified_gmt":"2026-11-04T23:18:31","slug":"cancellation-button-login-federal-court-of-justice","status":"publish","type":"post","link":"https:\/\/www.lhr-law.de\/en\/magazine-en\/competition-law-antitrust-law\/cancellation-button-login-federal-court-of-justice\/","title":{"rendered":"Cancellation button with a login? What the BGH is to clarify on 5 November 2026"},"content":{"rendered":"

\ufeff<\/span>Graphic: red \u201cCancel now\u201d button with an arrow to a password field with a padlock, next to the headline \u201cCancel with login?\u201dCustomer number, password \u2013 and only then the cancellation? On 5 November 2026 the German Federal Court of Justice (Bundesgerichtshof, BGH) will hear whether providers may put the way out of a subscription behind a login.<\/em><\/p>\n

The Berlin Higher Regional Court (Kammergericht) said no in both cases. After what the BGH decided in July about the confirmation page, there is little reason to expect Karlsruhe to be more generous.<\/em><\/p>\n

The First Civil Senate of the BGH hears two appeals on 5 November 2026 that raise the same question: does a provider breach Section 312k of the German Civil Code (BGB)<\/a> if the consumer has to enter their login details in the course of cancelling online? In case I ZR 272\/25<\/a>, the Federation of German Consumer Organisations (vzbv) is suing a web hosting provider under the Injunctions Act (UKlaG) (lower court: Kammergericht, decision of 18 November 2025 \u2013 5 UKl 10\/25<\/a>). In case I ZR 275\/25<\/a>, the Centre for Protection against Unfair Competition (Wettbewerbszentrale) is proceeding against a streaming service under the Act against Unfair Competition (UWG) (lower courts: Regional Court Berlin II, decision of 27 November 2024 \u2013 97 O 81\/23<\/a>, and Kammergericht, decision of 11 November 2025 \u2013 5 U 6\/25<\/a>). Whether a judgment will be handed down on the day of the hearing is open.<\/p>\n

Two cancellation routes, two passwords<\/h2>\n

The web hosting provider had a button labelled \u201cVertragsbeendigung\u201d (termination of contract) in the header of its homepage. Clicking it led to a sub-page where the customer had to log in with customer number and password in order to continue in a protected customer area. The streaming service was a little more subtle: the cancellation button in the footer did lead to a confirmation page, but there the user had to enter an email address or telephone number and a password before the button \u201cK\u00fcndigung abschlie\u00dfen\u201d (complete cancellation) would do its job.<\/p>\n

The Kammergericht prohibited both designs. In the hosting case, the button did not lead directly to a permanently available confirmation page because the consumer first had to enter customer number and password. In the streaming case, there was no confirmation page on which only the statutory information is entered. The password prompt thus sat once before and once on the confirmation page, and in the court\u2019s view it was impermissible in both variants.<\/p>\n

What the law requires \u2013 and what it does not<\/h2>\n

Section 312k BGB describes the cancellation route in unusual detail. The cancellation button must be clearly legible and labelled with nothing other than the words \u201cVertr\u00e4ge hier k\u00fcndigen\u201d (cancel contracts here) or an equivalent unambiguous wording, and it must take the consumer directly to a confirmation page. There the consumer is asked and enabled to state the type of cancellation (and, for extraordinary cancellation, the reason), information allowing their unambiguous identification, the unambiguous designation of the contract, the date on which the cancellation is to end the contract and details for the electronic transmission of the cancellation confirmation. The process is completed by a confirmation button labelled with nothing other than \u201cjetzt k\u00fcndigen\u201d (cancel now) or an equivalent unambiguous wording. Both buttons and the confirmation page must be permanently available and directly and easily accessible.<\/p>\n

The statute also governs what happens after the click. The consumer must be able to save their declaration, with the date and time it was made, on a durable medium (subsection 3), and the trader must immediately confirm, electronically and in text form, the content, the date and time of receipt and the date on which the contract ends (subsection 4). A trader who fails to provide the cancellation route as required risks customers being able to cancel at any time without notice (subsection 6), quite apart from injunction claims by associations and competitors.<\/p>\n

A password does not appear anywhere in this list. Providers argue that the law expressly requires the unambiguous identification of the person cancelling, and that login details happen to be the safest means of achieving it. After all, not every third party should be able to cancel someone else\u2019s contract.<\/p>\n

Why we expect the BGH to uphold the rulings<\/h2>\n

Recent case law points against the providers. On 16 July 2026 the same Senate held (I ZR 200\/25<\/a>) that Section 312k(2) sentence 3 BGB regulates the content of the confirmation page exhaustively, so that further information, offers or notices have no place there. In that case, involving a gym chain, a mere reference to the option of pausing the contract free of charge instead of cancelling it was enough. According to the BGH, the confirmation page serves solely to record the information required for the cancellation and to submit the declaration. A court that takes the wording this seriously is unlikely to accept a password field as just another form of identification.<\/p>\n

The legislative materials point the same way. The information to be requested is both a minimum and a maximum; the trader is precisely not meant to ask for data the consumer may not have to hand (Bundestag printed paper 19\/30840, pp. 15, 18). A password is the classic example of such data, and experience shows it is forgotten precisely when the customer is done with the provider anyway. The Regional Court of Cologne (Landgericht K\u00f6ln) therefore prohibited a password prompt by way of a preliminary injunction shortly after the provision came into force (order of 29 July 2022 \u2013 33 O 255\/22), stressing that, alongside any login, cancellation must at least be possible by providing a name and common identifiers such as postal or email address.<\/p>\n

One may object that a provider accepting every cancellation unchecked invites abuse. The statute, however, resolves this conflict not by a barrier before the cancellation but through the information on the confirmation page and the immediate confirmation by email, which quickly exposes any mistake. The hearing notice does not reveal how the Senate will decide. We would nevertheless be very surprised if the Kammergericht\u2019s rulings were set aside. We have pointed out before, in our article on the button solution for concluding contracts<\/a> (in German), that courts leave little leeway when it comes to these buttons.<\/p>\n

What providers should do now<\/h2>\n

Anyone offering subscriptions, memberships, hosting or software contracts online to consumers in Germany does not need to wait for the judgment to adjust their cancellation route:<\/p>\n