One-click payments are not illegal in themselves, but the EU requires that online purchases go through an explicit Checkout Confirmation screen. From what others have said on this thread, it appears this is the step that Humble Bundle skips.