Winery website: what EU law requires it to show

Any business offering services online, which includes a commercial website, must give visitors easy, direct and permanent access to the following (Directive 2000/31/EC, Article 5):

• your name (or company name);
• the geographic address where you are established;
• contact details, including an e-mail address, so that customers can reach you quickly and directly;
• the trade or similar public register you are entered in, with your registration number;
• your VAT identification number, if you have one;
• the supervisory authority, if your activity is subject to an authorisation scheme.

When the site shows prices, they must be clear and say whether tax and delivery costs are included (Article 5(2)).

These details usually sit on a "Legal notice" page linked from the footer of every page. National law often adds to this list. In France, for example, the phone number, the host and the publication director are also required; in Portugal, limited companies must show their share capital, and every supplier of goods or services with a website must link to the electronic complaints book.

Photos: credit the photographer. Moral rights are governed by national law, and in some countries, such as Portugal, the right to be named cannot be waived, so credit by default.

A commercial communication on your site must be clearly identifiable as such, along with the business behind it. Promotional offers such as discounts or free gifts, and promotional competitions or games, must be clearly identifiable, with conditions that are easy to access and clearly presented (Directive 2000/31/EC, Article 6).

There is no single EU rule on how a winery may advertise its wines on its website. EU law limits alcohol advertising in audiovisual media services: audiovisual commercial communications must not target minors or encourage immoderate consumption (Directive 2010/13/EU, Article 9), and television advertising and teleshopping have more detailed limits (Article 22). These rules do not apply as such to an ordinary website.

One EU rule does apply to your website: no health claims. A drink with more than 1.2% alcohol by volume may not bear health claims ("good for the heart", "antioxidants"), nor nutrition claims other than those referring to a reduction in alcohol or energy content (Regulation (EC) 1924/2006, Article 4(3)).

Beyond that, each country sets its own rules, and they differ widely:

• France (loi Évin): a closed list of what an advertisement may say, and a mandatory health message.
• Portugal (Código da Publicidade, Article 17): a list of prohibitions (targeting minors, encouraging excess, suggesting success…), and no mandatory health message.

Check the rules of the country where your winery is established, and of any country you target with a campaign.

The age at which wine can be bought is set by each country. It is 18 in France and Portugal, while some countries allow unfortified wine to be sold from 16, such as Germany and Belgium (fortified wines and spirits are 18 in Belgium). Whatever your country's age, do not sell wine to a customer below it. We recommend stating the age limit in your shop and asking for an age declaration at checkout.

We found no EU text that requires an age gate at the entrance of a winery website.

Before the order, the customer must find (Directive 2011/83/EU, Article 6):

• the main characteristics of each wine, and on its page the mandatory food information (Regulation (EU) 1169/2011, Article 14). For wine, the ingredient list and nutrition declaration are required by Regulation (EU) 1308/2013, Article 119, and may be given electronically. Details in our electronic wine label guide;
• the total price including taxes, the delivery costs and, next to the selling price, the price per litre (Directive 98/6/EC, Article 3; check your country's exemptions);
• your identity, geographic address, phone number and e-mail address;
• the legal guarantee, and any out-of-court redress mechanism you are subject to;
• the right of withdrawal, with the model withdrawal form: 14 days from delivery (Article 9). If this information is missing, the period is extended by up to 12 months (Article 10). For wine, the sector-specific exception is alcoholic drinks whose price is agreed at the order, delivered after more than 30 days, and whose value depends on market fluctuations, such as wine sold en primeur (Article 16(g)). Personalised goods, such as bottles with a custom label, are also excluded (Article 16(c)). A bottle delivered now remains subject to the 14 days.

At the latest at the beginning of the ordering process, show any delivery restrictions and the accepted means of payment (Article 8(3)).

The order button. The button that places the order must be labelled only "order with obligation to pay" or an equally unambiguous wording; otherwise the customer is not bound by the order (Article 8(2)).

The withdrawal function. Member States must apply, from 19 June 2026, national rules implementing Directive (EU) 2023/2673: for contracts concluded through an online interface, you must offer a withdrawal function ("withdraw from contract here" or an equally clear wording), available throughout the withdrawal period and prominently placed, followed by a "confirm withdrawal" step and an acknowledgement of receipt on a durable medium (Directive 2011/83/EU, Article 11a). Check whether your country has transposed it.

No geo-blocking. You may not block access to your site, or redirect a visitor to a different version of it without their explicit consent, because of their nationality or place of residence (Regulation (EU) 2018/302, Article 3). You may choose which countries you deliver to, but buyers from other EU countries must get the same general conditions for those deliveries (Article 4).

All this information is usually gathered in terms and conditions of sale, which the customer must be able to read before ordering, store and reproduce (Directive 2000/31/EC, Article 10(3)).

If you have committed to, or are obliged to use, an alternative dispute resolution (ADR) body, your website and your terms must say so, with the body's website address (Directive 2013/11/EU, Article 13). From 20 September 2028, this information must also be clear and prominent (Directive (EU) 2025/2647). Some countries go further: in France, every business selling to consumers must offer a consumer mediator.

The EU online dispute resolution (ODR) platform no longer exists. It stopped accepting complaints on 20 March 2025, and the regulation requiring a link to it was repealed on 20 July 2025 (Regulation (EU) 2024/3228). If your site or terms still contain the link, remove it.

Privacy notice. When your site collects data (contact form, newsletter sign-up, order, booking), you must tell people at the time of collection who processes the data, why, on what legal basis, for how long, who receives it, whether it leaves the EU, what their rights are, and that they can complain to a data protection authority (GDPR, Regulation (EU) 2016/679, Article 13). In practice, a "Privacy policy" page with a link under each form.

Newsletters. Marketing e-mails need the person's prior consent. The exception is your own customers, for similar products, as long as they can refuse easily and free of charge, at sign-up and in every message (Directive 2002/58/EC, Article 13).

Cookies. Storing or reading information on a visitor's device requires their prior consent, unless it is strictly necessary for the service they asked for (Directive 2002/58/EC, Article 5(3)). Typically, consent is needed for third-party analytics, advertising pixels, and embedded content (video, map, social media) that sets non-essential cookies, but not for a shopping cart, a customer session or a language choice. A site that only uses strictly necessary cookies does not need a consent banner. Each country's data protection authority publishes its own guidance.

Since 28 June 2025, national laws implementing the European Accessibility Act (Directive (EU) 2019/882) apply to e-commerce services. Microenterprises providing services are exempt: fewer than 10 people and an annual turnover or balance sheet total not exceeding €2 million.

Penalties are set by each country. For personal data, the GDPR allows fines of up to €20 million or, for a business, 4% of its total worldwide annual turnover, whichever is higher, for the most serious breaches (Article 83). Missing legal notices, cookies set without consent or illegal alcohol advertising are also fined under national law.