- Who owes these obligations: the seller of record
- Consumer guarantees: what you must provide when goods fail
- Advertising and pricing: supplier copy does not shield you
- Customer data, privacy and marketing messages
- Product safety and supplier due diligence
- What non-compliance costs
- Brand protection: trade marks and the rights in what you sell
- A compliance checklist for a new dropshipping store
- When a lawyer helps
- Start with the refund promise
Dropshipping looks like the lightest way to run a retail business. You list products you never hold, a supplier on the other side of the world stores and ships them, and your main assets are your website, your ads and your brand. But the legal position is heavier than the logistics. Under Australian consumer law you are the seller of those goods, and nearly every obligation that attaches to a seller attaches to you, whether or not you ever touch the stock.
The obligations that matter most for a dropshipping store sit in the Australian Consumer Law, the Privacy Act, the Spam Act and the GST rules. This article sets out who is caught, what each obligation requires, what non-compliance costs, and where a lawyer earns their fee. It is not a substitute for advice on your specific setup, but it gives you the checklist to work from.
Who owes these obligations: the seller of record
In most dropshipping arrangements the customer's contract is with you. You set the price, take the payment, publish the product page and handle customer service. The supplier is your fulfilment sub-contractor, not the customer's seller. That means the consumer guarantees, the advertising rules and the refund expectations all run to you. A customer does not have to chase your supplier, and "the supplier's policy" is not a defence to a claim against you.
Most of these obligations have no size threshold. The Australian Consumer Law (the ACL), which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth) (the CCA), applies to anyone who supplies goods in trade or commerce to a consumer. A consumer includes a person who buys goods priced at $100,000 or less, goods of a kind ordinarily acquired for personal, domestic or household use, or a vehicle or trailer, provided the goods are not bought for re-supply (s 3 of the ACL). There is no turnover cut-off, so a side-of-the-desk store and a seven-figure operation face the same consumer guarantees.
Two obligations do carry dollar triggers, and these are the ones founders usually get wrong:
- GST: once your GST turnover reaches $75,000 or more in a year, you must register with the ATO, and you have 21 days from when you become required to do so.
- Privacy: the Australian Privacy Principles generally apply to businesses whose annual turnover exceeded $3 million in the previous financial year (s 6D of the Privacy Act 1988 (Cth)), and to some businesses below that figure regardless, such as private health service providers. A business under the threshold may be exempt from the Privacy Act, but the Spam Act still applies to its marketing.
Consumer guarantees: what you must provide when goods fail
Under the ACL, every supply of goods to a consumer carries automatic guarantees: the goods must be of acceptable quality, match their description, be fit for the purpose you promoted them for, and match any sample you showed. Goods are of acceptable quality when they are fit for all the purposes goods of that kind are commonly used for, acceptable in appearance and finish, free from defects, safe and durable, judged by what a reasonable consumer would regard as acceptable given the nature and price of the goods (s 54).
These guarantees are automatic. You cannot switch them off with a "no refunds" policy, a store-credit-only rule or a clause in your terms and conditions; a term that purports to exclude a guarantee is void (s 64). The only room to limit liability is for goods that are not of a kind ordinarily bought for personal or household use (s 64A), which will rarely help a consumer-facing store.
When a guarantee fails, the remedy depends on how serious the failure is. If it is a major failure, the customer chooses between a refund and a replacement (ss 259 and 260). A failure is major if, for example, the goods would not have been bought by a reasonable consumer who knew about it, they depart significantly from their description, or they are substantially unfit for their purpose and cannot easily be fixed. For a minor failure, you can choose to repair or replace the goods within a reasonable time.
Two practical points follow. First, there is no fixed "two-year warranty" in the ACL. How long a remedy stays available depends on what a reasonable consumer would expect of goods of that kind at that price, which can be longer than a manufacturer's warranty. Second, a refund policy that tells customers their rights are limited to your policy is itself a legal risk. That is exactly what got Kogan into trouble: the Federal Court found its website and order flow misrepresented consumers' refund rights, contravening ss 18 and 29 of the ACL, and imposed a $350,000 penalty (ACCC v Kogan Australia Pty Ltd [2020] FCA 1004, penalty in ACCC v Kogan Australia Pty Ltd (No 2) [2020] FCA 1751).
Advertising and pricing: supplier copy does not shield you
Most dropshipping stores sell products they have never seen, using descriptions, images and claims supplied by the manufacturer. In law that makes no difference to your exposure. Conduct that is misleading or deceptive, or likely to mislead or deceive, is prohibited (s 18 of the ACL), and making false or misleading representations about goods, their characteristics, quality or benefits is a separate prohibition (s 29).
Where dropshippers most often stumble: stock availability claims ("in stock, ships in 24 hours" when the supplier is on backorder), delivery promises ("guaranteed delivery before Christmas"), material claims copied from a supplier page ("genuine leather"), and before-and-after or performance claims for cosmetics and supplements. If the claim is wrong, you are the one exposed, not the supplier.
Pricing is the other trap. Show the total price the customer will pay, including GST and other charges, and disclose delivery fees before checkout rather than revealing them late in the process. Hidden or late-surfacing fees have been a long-standing focus of ACCC enforcement against online retailers under the misleading conduct provisions.
Customer data, privacy and marketing messages
If your annual turnover is above $3 million, the Privacy Act 1988 (Cth) applies to you. That means complying with the Australian Privacy Principles: collect only what you need, tell customers what you do with their information, keep it secure and give them access on request. If your turnover is at or below $3 million you are generally exempt, with exceptions such as health service providers. Either way, a published privacy policy is expected by payment providers, platforms and customers, and it should match what you actually do.
The cross-border point is the one most dropshippers miss. Your supplier, email platform and analytics tools may all sit outside Australia. APP 8 of the Privacy Act requires you to take reasonable steps to ensure an overseas recipient handles personal information consistently with the Australian Privacy Principles, and s 16C treats the overseas recipient's breaches as your own. In practice that means naming your overseas suppliers in your privacy policy and addressing data handling in your contract with them. If you are covered by the Privacy Act and an eligible data breach occurs, you must notify affected individuals and the Office of the Australian Information Commissioner.
Marketing messages are governed separately by the Spam Act 2003 (Cth), which applies to all commercial electronic messages with an Australian link whatever your turnover. You need consent to send email or SMS marketing, every message must clearly identify who authorised it (s 17), and each message must carry a functional unsubscribe facility that keeps working for at least 30 days (s 18). The ACMA enforces these rules and has pursued businesses over unsubscribe failures.
Product safety and supplier due diligence
The ACL regulates the safety of consumer goods through mandatory safety standards, bans and recalls (Part 3-3). If goods you sell must meet a safety standard, supplying non-compliant goods is a strict-liability offence, and contravening the safety provisions can attract civil penalties of up to $100 million for a corporation under s 224 of the ACL. The ACCC administers recalls and publishes safety warnings, and an unsafe product can end a business faster than any refund dispute.
Manufacturers can also be liable for loss or damage caused by goods with a safety defect, including personal injury and damage to other property (Part 3-5). Where you import goods, or arrange for them to be imported, you may be treated as the manufacturer for these purposes, so the "I just resell" position is weaker than it sounds. For high-risk categories, children's items, electronics and chargers, cosmetics, supplements and anything with therapeutic claims, supplier due diligence is a legal task rather than a commercial nicety: ask for certifications and test reports, confirm compliance with Australian standards, and have a plan for handling complaints and recalls.
What non-compliance costs
The figures are worth having in front of you. Under s 224 of the ACL, a corporation that contravenes the unfair practices provisions, including false representations about goods, faces a pecuniary penalty of up to the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover, and an individual faces up to $2.5 million. Kogan's $350,000 penalty shows that even an inadvertent refund-rights misrepresentation carries real cost, and the Court there warned that penalties must be high enough that non-compliance is not treated as a cheaper option than compliance.
Under the Privacy Act 1988 (Cth), a serious interference with privacy exposes a corporation to penalties up to the greater of $50 million, three times the benefit, or 30% of adjusted turnover (s 13G). For GST, penalties apply if you fail to register when required. Add chargebacks, refunds you absorb because the supplier will not cooperate, platform takedowns and reputational damage, and the compliance spend starts to look small.
Brand protection: trade marks and the rights in what you sell
If you are building a brand rather than testing random products, register the trade mark. Registration gives you the exclusive right to use the mark in Australia for the goods and services in your registered classes, lasts up to 10 years and can be renewed indefinitely. Registering a business name with ASIC does not give you exclusive rights to the name, and neither does owning a domain; only a registered trade mark does (IP Australia).
The mirror-image risk is infringement. Supplier-provided images and "replica" or lookalike products can infringe someone else's copyright or trade mark, exposing you to takedowns, platform bans and legal demands. Use images you have permission to use, avoid riding on another brand's reputation, and run a trade mark clearance search before you spend on branding.
A compliance checklist for a new dropshipping store
Work through the list in order before you take your first order:
- Structure: decide between sole trader, company and partnership before you trade. A company limits personal exposure but adds ASIC and director obligations.
- Registrations: get an ABN (and an ACN if you incorporate), register your business name if you trade under a name that is not your own, and secure your domain and social handles.
- GST: register within 21 days once your turnover reaches $75,000, and decide how shipping charges and refunds are treated.
- Consumer law: write a refund and returns policy that matches the ACL, set conservative delivery timeframes, and make sure your terms do not contract out of the guarantees.
- Advertising: verify every claim you publish, avoid "guaranteed delivery" language, and disclose the total price and fees before checkout.
- Privacy and spam: publish a privacy policy that covers your overseas suppliers, and run email and SMS marketing only with consent and a working unsubscribe.
- Product safety: vet suppliers, ask for certifications on high-risk goods, and plan for complaints and recalls.
- Supplier agreement: put in writing the quality specifications, dispatch timeframes, who pays for defects and refunds, stock availability, and handling of lost or damaged deliveries.
- Trade marks: run a clearance search early and file once you commit to a brand.
When a lawyer helps
A solicitor's job here is to convert that checklist into documents and to find the gaps specific to your model. Concretely, a lawyer will review your refund and returns policy against the ACL so it does not misrepresent consumer rights, draft or review your terms of sale and supplier agreement, check your privacy policy against APP 8 and your actual data flows, advise on business structure and director risk, and run trade mark clearance and filing. An accountant or tax adviser handles the GST, bookkeeping and tax side, and the two should work together because refund and shipping decisions affect the tax treatment.
Start with the refund promise
Every part of this article traces back to one mismatch: what you promise customers versus what your supplier actually delivers. The duty most often missed is not the privacy policy or the trade mark; it is the refund promise, because it is the one obligation you cannot outsource and cannot disclaim. This week, before you spend another dollar on ads, review the two sentences that decide most disputes: what your website says about delivery times, and what your refund policy says about faulty goods. If either overpromises, fix it, and put the corresponding obligations on your supplier in writing. Everything else can follow.