Australian e-commerce law: the obligations of selling online

There is no single "e-commerce licence" you apply for before launching an online store in Australia. What exists instead is a bundle of laws that attach the moment you publish a storefront and start taking orders. The Australian Consumer Law (the ACL) governs how you advertise, price and honour guarantees. The Privacy Act 1988 (Cth) governs how you collect and handle customer data. The Spam Act 2003 (Cth) governs how you run email and SMS marketing. And the tax system adds its own registration obligations once your sales grow.

Different regulators enforce each piece. The Australian Competition and Consumer Commission (the ACCC) enforces the ACL, the Office of the Australian Information Commissioner (the OAIC) oversees privacy, and the Australian Communications and Media Authority (the ACMA) polices marketing messages. This guide sets out the obligations that apply to a typical online store, who each one applies to, the thresholds that bring you within scope, and what happens if you get it wrong.

Who the obligations apply to

The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth), and it applies to anyone who supplies goods or services in trade or commerce to a consumer, which the law defines as an individual acquiring goods or services for personal, domestic or household use. If you sell to consumers online, the ACL applies to you from your first sale, whatever your size or turnover.

The other regimes kick in at different points:

Privacy: The Australian Privacy Principles (the APPs) in the Privacy Act 1988 (Cth) apply to businesses with an annual turnover above $3 million, plus some businesses below that threshold. The small business exemption in s 6D of the Act does not apply to certain operators regardless of turnover, such as health service providers and businesses that trade in personal information.
Marketing: The Spam Act 2003 (Cth) applies to any commercial electronic message with an Australian link, meaning messages sent to or from Australia. It covers email, SMS and MMS sent to promote your goods or services.
GST: You must register for GST once your GST turnover reaches $75,000 or more, and you must register within 21 days of that happening. Below the threshold you can still register voluntarily.
Fair terms: The unfair contract terms rules in the ACL protect consumers and also small businesses, defined for this purpose as businesses with fewer than 100 employees or a turnover under $10 million.

If you hire staff, the Fair Work system adds further obligations around minimum pay, leave and superannuation that depend on which award covers your workers. For most small operators, the consumer law, privacy, marketing and tax obligations above are the priority.

Truthful advertising and pricing

Section 18 of the ACL prohibits misleading or deceptive conduct in trade or commerce, and s 29 separately prohibits false or misleading representations about goods or services. That covers the practical claims on your site: product descriptions, performance claims, stock levels, "was/now" pricing and testimonials all need to be accurate and capable of being substantiated. A claim such as "limited stock" or "50% off RRP" is a representation about your business and your products, and it needs to be true.

Pricing has its own rule. Under s 48 of the ACL, if you advertise any part of the price of goods or services, you must also display the single price as one prominent figure, meaning the total price including GST and any unavoidable fees or charges. Delivery charges can be stated separately, but they must be disclosed clearly rather than added as a surprise at checkout. Adding mandatory fees late in the process, sometimes called drip pricing, is the kind of conduct the ACCC has targeted in enforcement action. Optional extras such as express post or gift wrapping should be opt-in, not preselected.

Consumer guarantees and refunds

Every sale to a consumer carries automatic guarantees under Part 3-2 of the ACL that you cannot contract out of. Under s 54, goods must be of acceptable quality: fit for the purposes for which goods of that kind are commonly used, acceptable in appearance and finish, free from defects, safe and durable, taking into account the price and anything said about the goods.

When goods fail a guarantee, the remedy depends on how serious the failure is. A major failure, defined in s 260, includes goods that a reasonable consumer fully acquainted with the problem would not have bought, or goods that cannot easily be remedied. For a major failure, the customer can generally choose a refund or a replacement. For a minor failure, the supplier can choose to repair, replace or refund. You must provide the remedy within a reasonable time and at no cost to the consumer.

A blanket "no refunds" statement is therefore a problem. It conflicts with the guarantees, and the ACCC can treat it as a false representation about the consumer's rights. Your refunds page should instead explain that the ACL guarantees apply, what the customer should do if goods are faulty, and how you will handle repair, replacement or refund. Any voluntary warranty you offer, such as a 12-month manufacturer warranty, operates in addition to the statutory guarantees, not instead of them.

Fair terms in your standard form contracts

Your website terms, subscription agreements and any other take-it-or-leave-it documents are standard form contracts, and the unfair contract terms rules in Part 2-3 of the ACL apply to them. Under s 23, a term is void if it is unfair, meaning it causes a significant imbalance in the parties' rights and is not reasonably necessary to protect your legitimate interests. One-sided terms such as the right to vary prices or cancel without notice, or to change the terms without telling the customer, are the classic examples.

Two things matter for online businesses. First, since November 2023, proposing or relying on an unfair term is itself a contravention that can attract a pecuniary penalty, not just a void term. Second, the rules protect small businesses as well as consumers, so your B2B terms with a customer who has fewer than 100 employees or a turnover under $10 million are in scope. Terms that define the main subject matter of the contract or set the upfront price are excluded under s 26, which is why the price and the product itself can be set freely while the surrounding fine print cannot.

If you run subscriptions or auto-renewing services, make the price, billing cycle, renewal date and cancellation method conspicuous before purchase. Regulators and courts look at whether critical terms were buried in fine print when assessing whether they were fair and whether customers genuinely agreed to them.

Privacy and data handling

Almost every online store collects personal information: names, email addresses, delivery addresses, phone numbers, payment references and analytics identifiers. If your turnover exceeds $3 million, or you fall within one of the exceptions to the small business exemption, the APPs bind you directly. They require a clearly expressed privacy policy (APP 1), limits on what you collect and how you use it (APPs 3 and 6), secure storage (APP 11) and a process for individuals to access and correct their information (APPs 12 and 13).

The notifiable data breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) applies more widely. If personal information is lost, or accessed or disclosed without authorisation, and a reasonable person would conclude this is likely to result in serious harm, you must notify the OAIC and affected individuals as soon as practicable. A stolen customer database, a misconfigured payment portal or a lost laptop containing customer records can each trigger this obligation, and failing to notify is itself an interference with privacy.

Direct marketing has its own rule: APP 7 allows it only where the customer would reasonably expect it, or has consented, and every marketing message must offer a simple way to opt out.

The Spam Act 2003 (Cth) sets a three-part test for commercial email, SMS and MMS. Under s 16, you cannot send unsolicited messages without consent, which can be express or reasonably inferred from the relationship and the customer's conduct. Under s 17, each message must identify you and include accurate contact details. Under s 18, each message must include a functional unsubscribe facility that works, and you must honour unsubscribe requests promptly.

Consent is the part most businesses get wrong. It cannot be bought or transferred, so a purchased list of addresses does not satisfy the Act. Pre-ticked boxes at checkout are risky: consent should be a clear, separate opt-in, and you should keep records of when and how each contact consented. The ACMA enforces the Act and has secured court-imposed penalties and infringement notices against major Australian businesses for non-compliance.

Brand protection

Your brand name, logo, product photography and written content are assets worth protecting. A trade mark registered with IP Australia gives you the exclusive right to use the mark for the goods and services you register, and it makes enforcement against copycats straightforward. A quick search before you commit to a store name can avoid a rebrand later. Equally, only use images, fonts and product descriptions you own or are licensed to use. Supplier-provided imagery usually needs written permission before you publish it.

Consequences of getting it wrong

The enforcement teeth behind these obligations are substantial. Under s 224 of the ACL, a body corporate that contravenes a penalty provision, such as the false representation rules, the single price rule, the unconscionable conduct provisions or the unfair terms provisions, can face a maximum penalty of the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover. Individuals face up to $2.5 million. Misleading or deceptive conduct under s 18 does not carry a pecuniary penalty directly, but the ACCC can seek court orders including injunctions, damages, corrective notices and redress for affected consumers.

Under s 13G of the Privacy Act 1988 (Cth), a body corporate that seriously interferes with an individual's privacy can face a maximum penalty of the greater of $50 million, three times the benefit, or 30% of adjusted turnover, with individuals capped at $2.5 million. The OAIC can also make determinations ordering compensation. Under the Spam Act 2003 (Cth), the ACMA can issue infringement notices and pursue court-imposed penalties, which it has done against large retailers and banks.

Beyond dollar figures, enforcement action brings regulator inquiries, remediation programs, corrective advertising and reputational damage that can be far more costly for a small business than the penalty itself.

A compliance checklist

Work through these items before you launch, and revisit them whenever your store changes:

Pricing: display a single prominent price including GST and mandatory fees, disclose delivery costs before checkout, and keep optional extras opt-in.
Refunds: publish a refunds page that explains the ACL guarantees, never a blanket "no refunds" statement, and train staff on major versus minor failures.
Terms: review your standard form terms for one-sided clauses, and make subscription prices, renewals and cancellation steps obvious.
Privacy: prepare a privacy policy that matches what you actually collect and share, and write a notifiable data breach response plan.
Marketing: collect genuine opt-ins, keep consent records, and test your unsubscribe links in every email and SMS.
Tax: register for GST when turnover reaches $75,000, and check your obligations when you start selling to customers overseas.
Brand: clear IP rights in your store name, logo and content, and confirm you are licensed to use any third-party imagery.

Where a lawyer helps

A commercial lawyer can draft or review your website terms, privacy policy, refunds page and subscription terms against the ACL and the APPs, and can advise on the small business exemption and whether you need to comply with the full privacy framework. If you receive an ACCC, OAIC or ACMA inquiry, or you discover a data breach, early legal advice on notification obligations and your response can materially reduce exposure. Lawyers also handle the contracts that come with growth: supplier and fulfilment agreements, dropshipping arrangements, influencer agreements and contractor terms, where liability allocation and IP ownership clauses need to be in writing.

The obligations most online stores miss

The pattern the regulators see most often is not deliberate misconduct. It is a store that displays prices without the single figure, uses pre-ticked marketing boxes, publishes a privacy policy that does not match its actual data practices, and answers refund requests with "no refunds" because nobody has told the support team about the consumer guarantees. Those four gaps are inexpensive to fix and are exactly the claims the ACCC, the OAIC and the ACMA act on.

If you take one action this week, audit your checkout: confirm the single price is shown before payment, marketing consent is a separate opt-in, and your refunds and privacy pages exist and say what you actually do. If your turnover is close to $3 million, plan for the privacy obligations that arrive with the threshold, because that is the point where the small business exemption quietly drops away.