If you run an online store that ships to U.S. customers, your business sits under a stack of e-commerce laws and regulations that touch advertising, shipping, privacy, payment security, sales tax, marketing messages, and website accessibility. Most of these are federal, some are state-by-state, and a few (like the GDPR) reach you based on where your customers live rather than where your business is located. Getting any single piece wrong can mean an FTC enforcement action, a class-action lawsuit, or losing your ability to accept card payments.
The map below walks through each area an online seller has to think about, what the rule actually requires, and where the penalties bite.
Advertising Claims, Reviews, and Endorsements
Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive business practices, and that single provision drives most of the advertising rules online retailers face. Any objective claim you make about a product’s performance, quality, or origin needs a “reasonable basis” of supporting evidence before you publish it. The FTC treats the absence of that evidence as deceptive on its own, because consumers would be less likely to rely on claims if they knew the advertiser had no basis for making them.1Federal Trade Commission. FTC Policy Statement Regarding Advertising Substantiation This covers product descriptions, comparison claims, and marketing on your site and social channels.
Endorsements and testimonials have their own rules under 16 CFR Part 255. If someone reviewing or promoting your product has a “material connection” to your business, that connection has to be disclosed clearly and conspicuously. A material connection includes payment, free products, affiliate commissions, or a family relationship.2Federal Trade Commission. FTC’s Endorsement Guides: What People Are Asking
In August 2024, the FTC finalized a separate rule targeting fake and manipulated reviews. It prohibits buying or selling fake consumer reviews, suppressing negative reviews, and conditioning incentives on positive reviews.3Federal Register. Trade Regulation Rule on the Use of Consumer Reviews and Testimonials If you offer a discount or freebie in exchange for a review, you cannot require the review to be positive.
Shipping Deadlines and Refunds
The FTC’s Mail, Internet, or Telephone Order Merchandise Rule (16 CFR Part 435) sets deadlines that many retailers overlook. If you promise delivery in a specific timeframe, you must have a reasonable basis for believing you can meet it. If you don’t state any timeframe, you have 30 days from receiving a completed order to ship. When the buyer applies for credit to pay, the window extends to 50 days.4eCFR. 16 CFR Part 435 – Mail, Internet, or Telephone Order Merchandise
If you can’t meet the deadline, you have to notify the buyer and offer a choice: consent to the delay or cancel for a full refund. For a definite delay of up to 30 days beyond the original deadline, silence counts as agreement. For longer, indefinite, or repeated delays, you need affirmative consent. If the customer doesn’t agree, you have to issue a prompt refund without waiting for them to ask.5Federal Trade Commission. Selling on the Internet: Prompt Delivery Rules
Pricing Transparency, Returns, and Website Agreements
The FTC’s general prohibition on deceptive practices means every cost the buyer will pay has to be visible before checkout. Burying shipping charges, handling fees, or surcharges that only appear at the final confirmation screen invites an enforcement action. The practical standard is simple: if the total the customer pays exceeds what your listing led them to expect, you have a problem.
Federal law does not mandate a specific return window for online purchases. Once you post a return or refund policy, though, you are bound by its terms. Advertising a “30-day hassle-free return” and then rejecting returns on day 25 exposes you to deceptive-practice liability. A clear policy that spells out time limits, who pays return shipping, any restocking fees, and whether refunds come as store credit or original-payment reimbursement is the safest approach.
Your terms of service and privacy policy are contracts, and presentation matters for enforceability. A “clickwrap” agreement, where the user checks a box or clicks “I Agree” after seeing the terms, holds up in court far better than a “browsewrap” that buries a link in the footer and assumes continued use equals consent. If you ever need to enforce an arbitration clause or limitation of liability, that assent record is what makes it stick.
Data Privacy: Which Laws Apply to Your Customers
Privacy is the area where retailers most often discover they are subject to laws they didn’t know applied. What matters is where your customers live, not where your business sits. Every e-commerce site needs a privacy policy that explains what personal information you collect, why, and who you share it with.
GDPR for EU Customers
The General Data Protection Regulation applies to any business that offers goods or services to people in the EU, whether or not the business has a European presence. Before processing personal data, you must identify a lawful basis. The GDPR lists six: consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interests of the business.6General Data Protection Regulation (GDPR). GDPR Article 6 – Lawfulness of Processing Consent has to be freely given, specific, and informed. Pre-checked boxes don’t count.
Individuals have the right to access the data you hold, to have it erased (the “right to be forgotten”), and to receive their data in a portable format they can transfer elsewhere.7General Data Protection Regulation (GDPR). Chapter 3 – Rights of the Data Subject Violations can carry fines of up to 4 percent of annual global revenue or €20 million, whichever is higher.
CCPA/CPRA for California Customers
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that collect personal information from California residents and meet certain revenue or data-volume thresholds. Consumers have the right to know what personal information you collect and how it’s used, to delete that information, and to opt out of the sale or sharing of their data. The CPRA amendments added rights to correct inaccurate information and to limit the use of sensitive personal information. Because California is the country’s largest consumer market, most mid-size and larger e-commerce operations will meet the thresholds.
Other states have enacted comprehensive privacy laws modeled in part on the CCPA, and the count keeps growing. If you build your data practices to comply with the GDPR and CCPA together, you’ll cover most of what other state laws require.
COPPA for Users Under 13
The Children’s Online Privacy Protection Act applies to any commercial website or online service that collects personal information from children under 13, regardless of whether the site is aimed at children. If you knowingly collect data from users in that age group, you must obtain verifiable parental consent first.8Federal Trade Commission. Children’s Online Privacy Protection Rule (“COPPA”) Third-party analytics providers and advertisers operating on your site have to comply too if they knowingly collect children’s data. Penalties are steep and enforcement is aggressive.
Data Security, Breach Notice, and Cookies
Collecting customer data creates an obligation to protect it. The FTC has consistently held that failing to implement reasonable security is itself an unfair business practice. Reasonable isn’t a fixed checklist, but it generally means encryption for data in transit and at rest, access controls, regular vulnerability testing, and an incident-response plan.
Every state plus the District of Columbia has a data breach notification law requiring you to inform affected individuals when a breach occurs. Notification deadlines range from 30 to 60 days in roughly 20 states that set a specific number, while the rest require notification “without unreasonable delay.” Many states also require notifying the state attorney general. Missing the deadline is a separate violation from the breach itself and tends to draw heavier scrutiny.
If your site uses cookies or other tracking technologies for marketing or analytics, you need a compliant consent mechanism. Under the GDPR, non-essential cookies require an explicit opt-in before they fire. Domestic laws like the CCPA focus instead on giving consumers the ability to opt out. A cookie banner that handles both is essentially mandatory for a retailer with a broad customer base.
Payment Card Security (PCI DSS)
Any business that accepts, processes, stores, or transmits credit card data must comply with the Payment Card Industry Data Security Standard. PCI DSS isn’t a government regulation. It’s an industry standard created by Visa, Mastercard, American Express, and Discover, and it’s enforced through your contracts with payment processors and acquiring banks. The current version requires encrypting cardholder data during transmission, maintaining secure networks, strong access controls, and regular security testing.
Consequences of non-compliance are severe even without government involvement. Your processor can levy fines, raise your fees, or terminate your merchant account, which shuts down your ability to take card payments. Many small retailers reduce their PCI scope significantly by using a hosted payment page from their processor, such as Stripe or Square, which keeps cardholder data off their own servers.
Trademarks, Copyrights, and Counterfeit Goods
Intellectual property runs in both directions. On the defensive side, your brand name, logo, and product names should not infringe on someone else’s registered marks. Discovering a conflict after you’ve built a brand around a name means expensive rebranding and possible damages, so a trademark search before launch is far cheaper than litigation after it.
On the offensive side, your original product photography, website copy, marketing videos, and brand elements are your intellectual property. When someone copies them, the Digital Millennium Copyright Act gives you the notice-and-takedown procedure: you submit a takedown notice to the platform hosting the infringing content, and the platform must act expeditiously to remove or disable access to it.9U.S. Copyright Office. Section 512 of Title 17 – Resources on Online Service Provider Safe Harbors and Notice-and-Takedown System The mechanism is codified in 17 U.S.C. § 512 and is the primary enforcement tool for copyright holders dealing with online infringement.10Office of the Law Revision Counsel. 17 U.S. Code 512 – Limitations on Liability Relating to Material Online
Selling counterfeit goods exposes the individual seller to trademark infringement claims with significant statutory damages. Proposed legislation like the SHOP SAFE Act would extend liability to marketplaces that fail to vet sellers, but that bill is not yet law.
Sales Tax After Wayfair
The Supreme Court’s 2018 decision in South Dakota v. Wayfair ended the old rule that a state could only require sales tax collection from sellers with a physical presence there. States can now impose collection obligations on any out-of-state seller that crosses an economic threshold, typically $100,000 in gross revenue delivered into the state within a year.11Supreme Court of the United States. South Dakota v. Wayfair, Inc.
The original South Dakota law also included a 200-transaction threshold as an alternative trigger. Many states adopted both, but the trend has been to drop the transaction count and keep only the dollar amount. As of early 2026, at least 15 states have eliminated their transaction-based threshold, including California, Colorado, New York, Washington, and South Dakota itself. If you rely on a low transaction count to avoid registration somewhere, confirm the threshold still exists there.
Once you have economic nexus in a state, you must register with that state’s tax authority, collect the applicable sales tax on shipments to that state, and remit on the state’s schedule. Registration is generally modest or free, but tracking nexus across dozens of states is a real administrative burden. Most growing e-commerce businesses eventually adopt automated sales tax software.
Marketplace Facilitator Laws
If you sell through a platform like Amazon, eBay, Etsy, or Walmart Marketplace, you may not be responsible for collecting sales tax on those transactions at all. Nearly every state with a sales tax has adopted a marketplace facilitator law that shifts collection and remittance to the platform. The platform calculates, collects, and remits on your behalf for sales made through its marketplace.
This does not cover sales made outside the marketplace. If you also sell through your own website, at trade shows, or from a physical location, you are still responsible for collecting and remitting tax on those transactions wherever you have nexus.
Marketplace Seller Disclosure (INFORM Consumers Act)
The INFORM Consumers Act, codified at 15 U.S.C. § 45f, requires online marketplaces to collect and verify identity information from high-volume third-party sellers. A “high-volume” seller is one who makes 200 or more sales and generates at least $5,000 in gross revenue through a single marketplace within any 12-month period during the prior 24 months.12Office of the Law Revision Counsel. 15 U.S. Code 45f – Disclosure of Seller Information
Marketplaces must collect the seller’s bank account information, a working email and phone number, and tax identification. High-volume sellers with $20,000 or more in annual gross revenue on the platform must also have their name, physical address, and contact information disclosed to consumers, either on the product listing page or in the order confirmation. Sellers have to certify their information annually and update it promptly when anything changes. Marketplaces that fail to comply face fines of up to $50,000 per violation.
Email and Text Marketing Rules
Email (CAN-SPAM Act)
The CAN-SPAM Act governs every commercial email whose primary purpose is advertising or promoting a product or service. Unlike the GDPR, CAN-SPAM does not require opt-in consent before the first contact. But every email you send has to include a clear opt-out mechanism, your valid physical postal address, and truthful header information and subject lines. When someone opts out, you have 10 business days to stop sending promotional messages.13Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
Each non-compliant email is a separate violation. Civil penalties currently exceed $50,000 per email.14Office of the Law Revision Counsel. 15 U.S. Code 7706 – Enforcement Generally The math gets alarming quickly for a retailer blasting a large list with a missing postal address or a broken unsubscribe link. State attorneys general can bring their own actions with statutory damages of up to $250 per unlawful message.
Text Messages (TCPA)
Text message marketing is stricter than email. The Telephone Consumer Protection Act requires prior express written consent before you send any marketing text using automated technology. That consent has to be clear and unambiguous, specify the phone number that will receive messages, and disclose that the recipient is agreeing to receive automated marketing messages from your specific company. You also have to make clear that consent is not a condition of purchasing anything.15Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent
A 2025 FCC rule tightened this further with a “one-to-one” consent requirement. If a consumer provides their number on a comparison-shopping site or lead-generation form, that consent applies only to the specific seller the consumer selected, not to every business listed on the page. TCPA violations carry statutory damages of $500 per unsolicited message, tripled to $1,500 for willful violations. Class-action lawsuits under the TCPA are common and expensive, making this one of the highest-risk areas in e-commerce marketing.
Website Accessibility Under the ADA
The Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities, and federal courts have increasingly applied that requirement to commercial websites and mobile apps. The Department of Justice finalized a rule in 2024 requiring state and local governments to meet WCAG 2.1 Level AA accessibility standards for their web content, but no equivalent final rule exists yet for private businesses under Title III of the ADA.16ADA.gov. Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Applications
The absence of a specific federal standard hasn’t slowed the litigation. Hundreds of lawsuits are filed each year against e-commerce retailers whose sites are inaccessible to screen readers or fail to provide text alternatives for images, keyboard navigation, or sufficient color contrast. Courts routinely look to WCAG 2.1 Level AA as the benchmark even without a formal regulation. Treating that standard as the target, running periodic accessibility audits, and addressing barriers promptly costs far less than retrofitting a site after a demand letter arrives.