Ecommerce Compliance: The Areas Online Stores Need to Get Right

Ecommerce compliance spans several areas: consumer protection (clear pricing, terms, cancellation and returns), subscriptions and automatic renewals, reviews and advertising, privacy and data protection, accessibility, payments (PCI DSS and, in some regions, strong customer authentication), product safety and labelling, and tax. Which rules apply depends on where you operate, where customers live and what you sell. Keep a register of obligations by market, assign owners, build compliance into design and development, and take qualified legal advice. This is orientation, not legal advice.

Many compliance obligations show up in the storefront itself: how prices and discounts are displayed, what checkout says about terms and delivery, how subscriptions are sold and cancelled, whether reviews are genuine, whether the site is accessible, and how consent is collected. Getting them right is design and development work, not only legal review.

This article gives a map of the common areas with examples. It doesn't state what applies to your store. Laws vary by jurisdiction and change; confirm with qualified counsel.

Consumer laws generally require clear, accurate information before purchase: total price including taxes and unavoidable fees, delivery costs, main product characteristics, seller identity and contact details, and terms. Misleading practices, such as hidden fees, fake urgency or false scarcity, are prohibited in many jurisdictions. In the EU, announcements of price reductions generally must show the prior price, defined as the lowest price applied in the previous 30 days, with some national variations.

Design implications include showing full costs early, avoiding countdown timers and stock messages that aren't true, and keeping discount reference prices accurate. See merchandising automation for truthful badges.

Many jurisdictions give consumers rights to cancel distance purchases. Under EU consumer law, consumers generally have 14 days to withdraw from most distance contracts, with exceptions, and must be informed of the right. Other countries have different rules, and statutory rights for faulty goods usually exist alongside any returns policy you offer. Make policies clear, consistent across product pages, checkout, emails and help content, and aligned with the law in each market.

Subscriptions attract specific rules on disclosure, consent and cancellation. In the US, the FTC's "click-to-cancel" amendments to the Negative Option Rule were vacated by the Eighth Circuit, but the Restore Online Shoppers' Confidence Act (ROSCA) continues to apply, as do state automatic renewal laws, and the FTC has restarted rulemaking. Other jurisdictions have their own requirements. Practical design: clear recurring terms before purchase, express consent, confirmation, reminders where required, and cancellation that's as easy as sign-up. See subscription UX.

Reviews and endorsements are regulated in many places. The US FTC has a final rule banning fake reviews and testimonials and certain review practices, such as buying positive reviews or suppressing negative ones (FTC). EU and UK consumer law also address fake or misleading reviews and require information about how reviews are verified in some cases. Disclose incentivized reviews and material connections with influencers, and don't filter out negative reviews.

Privacy laws govern how you collect, use, share and keep personal data, and how you use cookies and similar tracking. Examples include the EU GDPR and ePrivacy rules, the UK GDPR, the California Consumer Privacy Act as amended, other US state privacy laws and national laws elsewhere. Common requirements include notices, a lawful basis or opt-out rights, consent for certain tracking, customer rights, vendor contracts, security and breach notification. See ecommerce privacy and customer data.

Accessibility laws increasingly cover online stores. The European Accessibility Act applies to many ecommerce services in the EU from 28 June 2025, implemented through national laws, with exemptions such as for microenterprises providing services. Other countries have disability discrimination or accessibility laws that may apply. WCAG 2.2 Level AA is the common technical reference. Publish an accessibility statement where required and fix barriers in code. See ecommerce accessibility and accessibility checklist.

Accepting cards brings PCI DSS obligations, which depend on how you process payments; hosted checkouts and payment provider fields reduce your scope. In the EEA and UK, strong customer authentication rules generally apply to many online card payments, usually handled through 3-D Secure by your payment provider. Buy now, pay later and instalment products can carry consumer credit rules in some markets. See ecommerce security.

Product rules depend on category and market: safety requirements, labelling, ingredient and allergen information for food and cosmetics, age restrictions, and restrictions on shipping certain goods. In the EU, the General Product Safety Regulation sets requirements for products sold online, including information that must be shown in listings. Categories such as supplements, cosmetics, children's products and electrical goods often have specific rules. Build required information into product templates and data models.

Sales tax, VAT and customs duties apply differently by market and threshold. Many jurisdictions require displaying tax-inclusive prices to consumers, collecting tax on cross-border sales above thresholds and issuing compliant invoices. Platforms and tax services help calculate and collect, but registration and filing remain your responsibility. See international ecommerce development.

Keep a register of obligations by market and area, with the source, owner, how it's implemented in the store and when it was last reviewed. Update it when entering a new market, launching subscriptions or new product categories, adding tracking or AI features, or when laws change. Share it with design and development so requirements become part of specifications.

Expanding internationally multiplies obligations. Before launching in a new market, review consumer rules (pricing display, withdrawal rights, language requirements), privacy and cookie rules, accessibility laws, payment rules, product and labelling requirements, and tax registration thresholds. Localize policies and checkout information, not just currency and language. See global checkout and Shopify Markets.

Some conversion tactics sit close to compliance lines: countdown timers, low-stock messages, reference prices, pre-selected add-ons, subscription defaults, review incentives and popups collecting consent. Before using them, check they're truthful and lawful in each market. Honest versions usually work: real deadlines, real stock levels, accurate reference prices, clear opt-ins. See experimentation mistakes for testing responsibly.

Use advisers efficiently: give them your compliance register, screenshots of key flows (pricing, checkout, subscriptions, consent) and a list of markets. Ask for requirements you can turn into specifications, and schedule reviews before launching new markets, subscription products or data-heavy features. Keep their advice with the register so implementation can be traced to it.

Ecommerce compliance touches pricing, cancellations, subscriptions, reviews, privacy, accessibility, payments, product rules and tax. Map obligations by market, build them into the storefront and take qualified legal advice. Related: security audit and checkout testing.