Summary
- UK e-commerce businesses must meet data protection, marketing consent, consumer rights and payment security rules at the same time.
- The ICO can fine up to £17.5 million or 4 per cent of global annual turnover, and the CMA can fine up to £300,000 or 10 per cent.
- PECR covers cookie consent as well as marketing emails, so non-essential tags load only after the visitor consents.
- This article explains e-commerce compliance for online retailers and business leaders in the United Kingdom.
- LegalVision’s ecommerce lawyers advise online businesses on cookie and marketing consent, cooling-off and refund handling, and checkout pricing that meets the drip pricing ban.
Tips for Businesses
Display the total price including VAT and delivery before the customer reaches checkout, since staged fees breach the drip pricing rules. Leave every marketing opt-in box unticked. Publish your business name, address, email and company number where a visitor finds them easily. Confirm your payment processor holds current PCI DSS certification. Speak to an ecommerce lawyer at LegalVision about auditing your checkout flow and cookie banner.
UK e-commerce compliance means meeting several overlapping sets of rules at once. The UK GDPR and the Data Protection Act 2018 govern customer data. The ICO can fine a business up to £17.5 million or 4 per cent of global annual turnover. The Privacy and Electronic Communications Regulations govern marketing consent and cookies. The Consumer Rights Act 2015 sets product quality standards. The Consumer Contracts Regulations 2013 give distance buyers 14 days to cancel. Since 6 April 2025, the Competition and Markets Authority can fine businesses directly for consumer law breaches. The Digital Markets, Competition and Consumers Act 2024 prohibits drip pricing and fake reviews. Card payments must also meet the Payment Card Industry Data Security Standard.
This article explains the data protection, marketing, consumer and payment rules UK e-commerce businesses must follow, plus the website information and cookie requirements that sit alongside them.
Starting or running an online business? Download this free guide to understand key legal essentials, including contracts, data, and compliance.
Why Is Compliance Important?
Social media compliance means following the laws that apply when users:
- share content;
- interact; or
- collect and use personal information on a social media service.
If you run social platforms, you may have a wide range of obligations, such as duties arising under online safety and data protection laws.
If you use social media for business marketing or branding, you will also be subject to various rules, including:
- advertising;
- consumer protection; and
- privacy laws.
What Responsibilities Can Arise?
If your platform lets users post, message, or share content, then you need to identify and manage the risks these features may create.
Online Safety Duties
The Online Safety Act 2023 imposes duties on in-scope service providers. If your service falls within scope, common duties include identifying risks of illegal and harmful content, and you must put proportionate systems and processes in place to mitigate those risks.
It is important to set up:
- content moderation;
- reporting tools; and
- clear terms of service that you enforce.
It is also vital to carry out risk assessments and regularly review them. The specific legal requirements depend on your service’s size and features, and Ofcom checks compliance and can issue penalties for breaches.
Data Protection Duties
The UK GDPR and the Data Protection Act 2018 require you to handle personal data in accordance with the set principles.
Personal data includes:
- names;
- photos;
- messages;
- device IDs; and
- usage data.
You need a legal reason to process data, and you must:
- only collect what you need;
- keep it secure; and
- not keep it longer than necessary.
Child Specific Rules
If children are likely to access your service, then you must meet additional standards, as children are afforded significant protection. The Children’s Code requires you to take the best interests of the child into account when designing and operating your online service. You should:
- apply high privacy settings by default;
- limit profiling and behavioural tracking; and
- switch off geolocation by default unless you can demonstrate a compelling reason to activate it.
Privacy information must be clear, use age-appropriate language and offer children accessible tools to manage their data and raise concerns.
You must also conduct a data protection impact assessment that specifically assesses risks to children where your service is likely to be accessed by them and comply with the Code’s standards. This includes requirements on:
- default settings;
- data minimisation;
- profiling;
- nudge techniques; and
- parental controls.
Advertising Considerations
If you advertise on your platform, you must ensure your systems comply with applicable advertising laws. You should also consider any specific statutory advertising restrictions and best practices that apply online and impact your operations.
International Considerations
If you operate internationally or you make your service available to users in the European Union, you may also need to comply with additional EU law obligations, including the Digital Services Act. These obligations can apply based on where your users are located. If you fall within the scope of these rules, then you may need to seek advice from local lawyers in the EU to properly understand your duties.
Continue reading this article below the formCall 0808 196 8584 for urgent assistance.
Otherwise, complete this form, and we will contact you on the same business day.
Using Social Media Platforms as a Business
Using social media for marketing, brand promotion, or community engagement carries legal risks, even if you do not run the platform you use.
If you allow user comments or user-generated social media content on your pages, remember to monitor and manage that content to mitigate risks such as:
- defamation;
- harassment;
- copyright infringement; and
- data protection breaches.
Your business should provide your employees with clear guidance on using social media for work by establishing a written social media policy.
Taking Legal Advice on Your Business Duties
Your compliance duties depend on how your platform or business operates and your social media activities. Various factors determine which rules apply and your risk profile, such as:
- your audience;
- data use; and
- business model.
Several areas of law may apply when operating or using social media platforms. You should seek legal advice on your specific duties. A regulatory lawyer can help you assess risk, review key documentation, conduct required assessments, and align your business processes with legal requirements.
Website Information and Cookie Requirements
The Electronic Commerce (EC Directive) Regulations 2002 require you to publish your business name, address and email address on the site. A company must also give its registered number and registered office. Where you charge VAT, display your VAT number. You must also acknowledge each order without undue delay, usually by automatic email. The regulations apply to any business selling online to UK customers, including a sole trader.
PECR governs cookies and similar tracking technologies, not only marketing emails. Set non-essential cookies only after the visitor gives consent. Load analytics and advertising tags after that consent, not when the banner first appears. Give visitors a way to withdraw consent as easily as they gave it. Strictly necessary cookies, for example the basket function, do not need consent.
The ICO enforces the cookie rules alongside the direct marketing rules. Check that your banner lets a visitor reject all non-essential cookies in a single click. Your website terms and conditions should also match what the site actually does. An annual review of the banner, the policies and the site footer keeps all three aligned.
“Most e-commerce businesses get the privacy policy right and then trip over the cookie banner, because the analytics tag fires before anyone clicks anything. Marketing consent and cookie consent sit in the same regulations, so a business that treats them as separate jobs usually has a gap in one of them. Fix the tag loading order first, because it is the cheapest problem on the list to solve.”
Key Takeaways
If you run a social media platform, you need to manage a range of legal issues and risks. This can include online safety laws, data protection rules and the need to apply higher protective standards if children might use your service. If you use social media for business, you must follow a range of advertising, consumer, and privacy laws and have clear internal policies to reduce risk.
By understanding your legal duties and implementing the right safeguards, you will be in a better place to reduce possible regulatory risks and protect your reputation.
LegalVision provides ongoing legal support for businesses through our fixed-fee legal membership. Our experienced contract lawyers help businesses manage contracts, employment law, disputes, intellectual property, and more, with unlimited access to specialist lawyers for a fixed monthly fee. To learn more about LegalVision’s legal membership, call 0808 196 8584 or visit our membership page.
Frequently Asked Questions
What are the main data protection requirements for UK e-commerce businesses?
Establish a lawful basis for every collection of customer data, publish a privacy policy, and put security measures in place. Give customers access to their data on request. Report a personal data breach to the ICO within 72 hours.
How long do UK e-commerce businesses have to process refunds?
Refund within 14 days of receiving the returned goods where a customer cancels during the cooling-off period. Where a customer rejects faulty goods under the Consumer Rights Act 2015, refund without undue delay.
Do online customers have the right to change their mind?
Yes. The Consumer Contracts Regulations 2013 give distance buyers a 14 day cooling-off period, and they do not need a reason. Personalised, perishable and custom-made items fall outside that right.
Can the CMA fine my business directly for breaking consumer law?
Yes. Since 6 April 2025, the Competition and Markets Authority can investigate and fine a business without going to court. Fines reach £300,000 or 10 per cent of global annual turnover.
We appreciate your feedback! Request your free consultation now.
