This paper critically examines the new European withdrawal function introduced under the amended Consumer Rights Directive (CRD) and its implications for consumer and data protection. The withdrawal function aims to simplify the process for consumers to exercise their right of withdrawal from distance contracts, addressing issues related to ‘digital traps’ where contracts are difficult to cancel. The paper explores the legal requirements of the withdrawal function, its scope of application, and the tensions between consumer protection and data protection. Key findings highlight that while the withdrawal function enhances consumer rights, its exclusion of certain off-premises contracts and other termination scenarios may leave some consumers unprotected. Additionally, the widely used requirement for customer accounts for using the withdrawal function raises data privacy concerns. The paper suggests that alternatives, such as providing access to the withdrawal function through order confirmation emails, could mitigate these concerns while maintaining robust customer identification to prevent fraud.