E-Commerce Compliance Checklist

1. Register for Sales Tax Where You Have Nexus

Since the Supreme Court's 2018 decision in South Dakota v. Wayfair, a state can require an online seller to collect and remit sales tax once the seller crosses that state's economic nexus threshold, commonly around $100,000 in annual sales into the state, though some states set a different dollar figure or add a separate transaction-count test. This applies even if your business has no warehouse, office or employee in that state. Track your sales by state, register with each state's tax agency once you cross its threshold, and collect and remit tax on taxable sales there going forward. See our guide on how to register for sales tax for the registration steps.

2. Post a Privacy Policy That Matches What You Actually Do

If your site collects personal information, including through analytics, checkout forms or email signups, post a privacy policy describing what you collect and how you use it. Several state privacy laws, along with California's, now require specific disclosures and, in some cases, a way for visitors to opt out of having their data sold or used for targeted advertising. See our guide on privacy policy requirements for business websites for what to include.

3. Post Terms and Conditions

Terms and conditions set the rules for using your site and buying from your store, including your return and refund policy, limitation of liability, and how disputes are resolved. See our guide on terms and conditions for e-commerce websites for what a complete set typically covers.

4. Follow CAN-SPAM for Marketing Emails

Every commercial email you send, regardless of your business's size, needs to comply with the CAN-SPAM Act: accurate "From" and subject line information that isn't deceptive, clear identification that the message is an advertisement, your business's valid physical postal address, and a working opt-out mechanism that you honor within 10 business days, per the FTC. These rules apply to every commercial email, not just bulk newsletters, and penalties can apply per email that violates the rule.

5. Meet FTC Shipping and Delay Disclosure Rules

The FTC's Mail, Internet, or Telephone Order Merchandise Rule requires you to ship an order within the time you stated on your site, or within 30 days if you didn't state a shipping time. If a shipment will be delayed beyond that, you must notify the customer and give them the choice to consent to the delay or cancel for a full refund. This rule applies to essentially any online retailer taking orders for shipment, not just large sellers.

6. Handle Subscriptions and Auto-Renewals Carefully

If your store sells a subscription, membership or any product that auto-renews or recurs, the Restore Online Shoppers' Confidence Act requires clearly disclosing the recurring charge and its amount before you bill the customer, obtaining their express agreement to the charge, and providing a simple way to cancel. The FTC has continued to bring enforcement actions over difficult-to-cancel subscriptions under this law and its broader authority over unfair and deceptive practices, even as a newer, more detailed "click to cancel" rule has moved through litigation and remains unsettled; check ftc.gov for its current status before assuming a specific new requirement applies.

7. Consider Website Accessibility

Several federal court decisions have applied the Americans with Disabilities Act to commercial websites, and the Department of Justice has issued guidance encouraging businesses to make their websites accessible to people with disabilities, generally by following the Web Content Accessibility Guidelines. There's no single federal regulation spelling out specific technical standards for private commercial websites the way there is for state and local government sites, so this remains an evolving area; building accessibility in from the start is simpler than retrofitting a site after a complaint.

8. Know Your State's Data Breach Notification Law

Every state has its own law requiring you to notify affected customers, and in many cases a state agency, if their personal information is exposed in a data breach, with deadlines and specific content requirements that vary by state. If you store customer payment or personal data, know which state's law applies based on where your affected customers live, not just where your business is based.

9. Keep Your Business Itself in Good Standing

None of the e-commerce-specific rules above replace the basic compliance an online business still owes its state: a registered agent, annual report filings, and current business licenses. LLC Register's $99-a-year registered agent service includes LLC formation in year one and annual report filing, so that baseline stays current while you manage the e-commerce-specific requirements above.

Payment Card Security Is an Industry Standard, Not a Federal Law

If you accept credit or debit cards, your payment processor will require you to meet the Payment Card Industry Data Security Standard, a set of security requirements created by the card networks rather than a government regulation. Meeting it is effectively mandatory to keep processing cards, even though it isn't a federal or state statute; talk to your payment processor about what level applies to your sales volume.

Rules Change Faster in This Area Than in Most Other Compliance Topics

Sales tax economic nexus thresholds, state privacy laws, and federal rules around subscriptions and online advertising have all changed multiple times in recent years, and more states add their own privacy or consumer-protection laws regularly. Treat this checklist as a starting framework and check each item against current state and federal guidance before relying on it for a specific launch.

Bigger Online Sellers Face More, Not Fewer, Overlapping Rules

As your sales grow across more states, the number of state tax registrations, data breach laws, and state-specific privacy or marketing rules that could apply to you grows with it. A seller doing meaningful volume in many states benefits from tracking compliance by state systematically rather than reacting state by state as thresholds are crossed.

This Is Not Legal Advice

Which specific rules apply to your store depends on what you sell, where your customers are, what data you collect, and how your checkout and subscription flows work. Talk to a business attorney about your specific site and a tax professional about your specific sales tax exposure before you assume this checklist covers everything your business needs.