An online store looks simple from the customer's side. You see a product page, a checkout, a parcel on the doorstep. Behind that flow sits a stack of legal decisions that most owners only think about after something goes wrong: a chargeback you did not see coming, a refund dispute that turns into a regulator complaint, a supplier who misses your busiest season, or a copycat selling under a name that sounds just like yours. This guide sets out the legal foundations of an Australian ecommerce business in plain language: the setup decisions that shape your risk, the contracts worth having in writing, the way to protect your brand and content, and the compliance obligations that apply to almost every online seller.
The setup decisions that shape your legal risk
Before you worry about which policies go in your website footer, it is worth checking that the underlying structure of the business makes sense. Three decisions in particular set your legal risk: how the business is structured, what you sell and to whom, and who you depend on to deliver.
Choose a structure that matches your risk
Most ecommerce businesses start as a sole trader, a partnership or a company. As a sole trader you and your business are legally the same person, which means you can be personally liable for business debts and claims. A partnership spreads ownership between two or more people, but unless you have a written partnership agreement, disputes about money, effort and decision-making can get messy quickly. A company is a separate legal entity, which is why it is the structure most growing ecommerce brands use: the company, not you personally, generally bears the liability, though directors still carry personal obligations of their own. The right choice depends on your turnover, your risk profile and your plans to raise money or take on co-founders.
Know what you sell and who you sell to
The law treats different products differently. Selling physical goods means thinking about product safety and regulated categories such as cosmetics, supplements, food, alcohol and children's items, which carry their own rules. Digital products such as courses, templates and downloads raise questions about licensing and what happens if a download fails. Subscriptions and memberships need clear renewal, cancellation and billing terms. Services sold online, such as coaching or design work, are governed by the consumer guarantees for services rather than goods. It also matters whether you sell to consumers or to other businesses, because the Australian Consumer Law (ACL) protects consumers in ways it does not protect business buyers, even though business-to-business transactions still attract the general prohibitions on misleading conduct.
Register for GST when you cross the threshold
If your GST turnover is $75,000 or more, you must register for GST with the Australian Taxation Office, generally within 21 days of becoming required to register. GST affects how you price your products, what you claim as input tax credits and how you invoice, and it applies differently if you sell digital products to customers overseas. The ATO's registering for GST page is the place to confirm where you stand.
Map the people you depend on
Most online stores rely on third parties: suppliers and manufacturers, warehousing and fulfilment providers, web developers, platform providers, marketing contractors and possibly co-founders. Every one of those relationships is a place where expectations about quality, timing and money can diverge. Mapping them early tells you where you need a written contract and where a handshake is fine.
The contracts an online store should have in writing
Online selling is asynchronous. Hundreds or thousands of customers accept your terms without ever speaking to you, which is exactly why your contracts need to be clear, findable and consistent with the law. Your terms cannot override the consumer guarantees, but they decide everything the law leaves open: when the contract forms, when risk passes, how refunds are processed and what happens in a dispute. The contracts worth having in writing are:
- Terms of sale: Your store terms set out the rules of each transaction: payment and pricing, including how GST is handled; when an order is accepted and a contract forms (many stores make clear that acceptance happens on dispatch, not at checkout); shipping timeframes and who bears the risk if a parcel is lost; refunds, returns and exchanges that are consistent with the ACL; what happens when an order is flagged as potentially fraudulent; how disputes are handled; and any restrictions on use of your website content. If you run subscriptions, the renewal, cancellation and billing terms need to be obvious rather than buried.
- Supplier and manufacturing agreements: If your stock comes from a supplier, manufacturer or wholesaler, your margins and your reputation depend on their performance. A written supply agreement is where you lock in product specifications and quality standards, lead times, who owns tooling, designs and packaging artwork, warranties and what happens when goods are defective, pricing, minimum order quantities and payment terms, and any exclusivity you have been promised.
- Contractor agreements: Branding, web development, photography and marketing are usually outsourced, and if the relationship is not documented you can end up paying for work you do not own. A contractor agreement should assign ownership of the website, code, creative assets and content to you rather than granting a licence, set out the scope, deadlines and deliverables, protect confidential information, and explain what happens when the relationship ends, including any ongoing fees or access arrangements.
- Co-founder and investor documents: If you are building the business with someone else, or plan to bring in investors, a shareholders agreement can prevent the painful kind of dispute. It covers who owns what percentage, how decisions are made, how profits and dividends are handled, what happens if someone wants to exit, and how disputes are resolved.
For many stores, the terms of sale and a privacy policy are the minimum set. Supplier, contractor and co-founder agreements tend to follow as the business grows.
Protecting your brand, content and product designs
For an online store, the brand is often the most valuable asset. Customers buy from you because they trust your name, your visuals and your reputation, and a copycat can erode that trust faster than almost anything else.
Register the trade marks that matter
A registered trade mark gives you a legally enforceable right over your business name, logo or slogan, and it is significantly easier to stop copycats when you hold one. Registration is done through IP Australia, which runs a four-step process of application, examination, acceptance and registration, and a registered mark must be renewed every 10 years. Two practical points matter for ecommerce owners. First, search the trade mark register before you commit to a name and spend money on packaging and campaigns, because you can infringe someone else's mark without meaning to. Second, think about what you actually need to protect: many online brands register a word mark for the brand name and a separate mark for the logo.
Get ownership of your copyright sorted
Copyright protects original content such as photographs, product descriptions, website copy, graphics and videos. In Australia it arises automatically under the Copyright Act 1968 (Cth) when an original work is created, and there is no registration system: IP Australia does not administer copyright. The trap for ecommerce businesses is ownership. If a contractor created your logo, your product photos or your brand kit, the contractor may own the copyright unless the contract assigns it to you. The same applies to a developer who builds your site: without an assignment clause you can be renting your own website. If you use user-generated content or influencer content in advertising, check what rights you actually have before you reuse it.
Consider design protection for distinctive products
If your product has a distinctive visual appearance, a design right registered through IP Australia protects the overall look of a new and distinctive product, including shape, configuration, pattern and ornamentation. Design protection is not automatic the way copyright is, so it has to be filed, and the right approach depends on the facts of your product and when it was first made public. It is worth mapping your options before a product is widely sold, because public disclosure can affect what you can protect.
The compliance framework for selling online in Australia
Compliance is not one law. An online store sits at the intersection of consumer law, privacy, marketing rules and payments. The framework below covers the obligations that apply to most Australian ecommerce businesses.
Australian Consumer Law: guarantees, refunds and advertising
The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth), and it applies to online sales to Australian consumers just as it applies to in-store sales. Three parts of it matter most to online stores.
First, the consumer guarantees. When you sell goods to a consumer, the law implies guarantees that the goods are of acceptable quality, match their description and are fit for any purpose you made known. Consumers do not have to ask for these guarantees and you cannot charge extra for them. Under s 64 of the ACL, any term of a contract that tries to exclude, restrict or modify the guarantees is void. A "no refunds" policy is therefore unenforceable to the extent it contradicts the guarantees, and advertising a blanket "no refunds" policy is itself a false or misleading representation about the effect of the guarantees under s 29(1)(m) of the ACL. Where goods fail to meet a guarantee, the consumer can seek a repair, replacement or refund, with the remedy depending on whether the failure is major.
Second, misleading or deceptive conduct. Section 18 of the ACL prohibits conduct that is misleading or deceptive or likely to mislead or deceive, and it applies to everything from product descriptions and before-and-after images to testimonials and delivery promises. If you advertise two-to-three-day shipping and routinely take a week, that is not just a customer service problem; it is a legal risk.
Third, pricing. "Was/now" pricing is a recurring problem area. A representation that an item was previously sold at a higher price is false or misleading under s 29(1)(i) of the ACL if the higher price was not genuinely charged for a reasonable period before the discount. In May 2026 the Federal Court found in ACCC v Coles Supermarkets Australia Pty Ltd [2026] FCA 598 that Coles' "was/now" tickets on 245 products were misleading because the "was" prices had applied only briefly before the discounts were introduced: the court held that claimed savings must be measured against prices genuinely charged for a reasonable period beforehand, at least 12 weeks in that case. The lesson for an online store is straightforward: only show a "was" price you genuinely charged for a reasonable period, and keep the records to prove it. The ACCC's guide to advertising and selling for business is a practical summary of where the lines are.
Privacy and customer data
If you collect personal information, which online stores almost always do through checkout, accounts and analytics, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) may apply. The starting point is turnover. A business is a "small business" under s 6D of the Act if its annual turnover for the previous financial year was $3 million or less, and small businesses are generally exempt from the APPs. For a business that only started during the current financial year, the test looks at current-year turnover instead.
But the exemption has exceptions. Under s 6D(4) of the Act, a small business is still covered if it provides a health service and holds health information, if it discloses personal information to someone else for a benefit, service or advantage (in other words, it trades in personal information), if it collects personal information for a benefit, service or advantage, or if it is a contracted service provider for a Commonwealth contract. A small store that sells customer lists or runs a data side business can therefore be caught well below the $3 million mark.
Even where the Privacy Act does not apply, most online stores still need a privacy policy. Payment providers, marketplaces and app stores routinely require one, and customers expect to see what happens to their data. A plain-English privacy policy should cover what personal information you collect and why, how you store and use it, who you disclose it to (couriers, payment providers, email marketing platforms), and how customers can access or correct their information.
Email and SMS marketing under the Spam Act
Email and SMS marketing in Australia is regulated by the Spam Act 2003 (Cth). For a commercial electronic message with an Australian link, the Act requires three things: consent, accurate sender identification and a working unsubscribe. Section 16 prohibits sending unsolicited commercial messages, which means you need express or inferred consent from the recipient. Section 17 requires the message to clearly identify who authorised it and include accurate contact information that stays valid for at least 30 days. Section 18 requires a functional unsubscribe facility, presented clearly, that keeps working for at least 30 days after the message is sent.
Order confirmations and other transactional messages are still commercial electronic messages under the Act, but consent can be inferred from the customer's recent dealings with you, which is why sending a receipt to someone who just bought from you is not the conduct the Act targets. The safer assumption is that any message promoting goods or services needs the recipient's consent, express or inferred, and a working unsubscribe. Promotions need attention too: giveaways and competitions should have terms that set out eligibility, how winners are chosen and how prizes are delivered.
Payments, chargebacks and fraud
Most online stores process payments through a payment gateway or a marketplace, and those platforms have their own terms and dispute rules that sit outside your control. What your own terms can do is reduce disputes: set out when an order is accepted and when you will dispatch, explain what happens if an order is flagged as potentially fraudulent, and clarify your refund process, including what evidence you require for returns. When a chargeback does arrive, a clear written record of the transaction, the dispatch and the delivery evidence is what you need to respond.
Accessibility and transparency
An online store is a place where goods and services are provided, which means the Disability Discrimination Act 1992 (Cth) applies to it. It is unlawful to discriminate against a person with a disability in the provision of goods and services, and that extends to websites and apps. The Australian Human Rights Commission published guidelines on equal access to digital goods and services in April 2025 to help organisations meet those obligations, and the guidelines point to the Web Content Accessibility Guidelines as the technical reference point. Accessibility complaints against retailers are real: a complaint by a blind customer about Coles' online shopping site was resolved with Coles agreeing to make the site more accessible, and a 2000 decision of the Human Rights and Equal Opportunity Commission, Maguire v Sydney Organising Committee for the Olympic Games (No 3) [2000] HREOCA 49, found the Olympic Games website discriminated against a blind user. Screen-reader compatibility, keyboard navigation and readable contrast are practical starting points.
Transparency is the other side of the same coin. Prices should be clear and not misleading, delivery costs and timeframes should be disclosed before checkout, subscription terms should be obvious, and customers should be able to find out how to contact you. These are also the things customers complain about, and complaints are how regulators find you.
When your online store needs a lawyer (and how Artificer Legal can help)
The line between an online store that is compliant and one that is exposed is often a set of judgement calls that an article cannot make for you. That is where a lawyer genuinely earns the fee, on judgement calls such as:
- Whether the Privacy Act applies to you: Working out whether your turnover and your activities put you inside or outside the APPs, including the exceptions in s 6D of the Act, is a question of fact that is easy to get wrong.
- Whether your terms are enforceable: A lawyer can review your terms of sale and policies against the ACL, spot terms that are void or unfair, and draft the ones you are missing.
- Trade mark clearance and strategy: Searching the register, assessing infringement risk, and deciding what to file and in which classes is the kind of judgement call that shapes whether your brand is protectable later.
- Contracts with suppliers, developers and co-founders: These documents carry the most money and the most emotion, and the assignment and termination clauses are where the cost of getting them wrong shows up.
- Responding to a problem: If the ACCC or the OAIC comes knocking, if a competitor copies your branding, or if chargebacks and complaints are mounting, early advice is usually cheaper than the fix later.
The common trigger points are a launch or relaunch, a move from side hustle to full-time business, the first overseas supplier or dropshipping arrangement, a copycat appearing, or the first serious complaint. A commercial lawyer at Artificer Legal can review your setup, draft the contracts and policies your store actually needs, and help you work out which obligations apply to your specific business. It is usually a conversation, not a project.
Why your refund policy cannot override the consumer guarantees
The most misunderstood fact about ecommerce law in Australia is that your own terms are not the top of the hierarchy. The consumer guarantees in the ACL are implied by statute into every sale to a consumer, and s 64 makes any term that tries to exclude, restrict or modify them void. Your refund policy, your terms of sale, your checkout tick box: none of them can draft around the guarantee that goods must be of acceptable quality, match their description and do what they are supposed to do. The stores that run into real trouble are rarely the ones with no documents. They are the ones with documents that promise something the law will not let them deliver, a "was" price that never really applied, or a delivery promise they cannot meet, because the paperwork makes the problem worse rather than better.
The practical version of the framework is this. Set up the business deliberately: choose a structure that matches your risk, know what you sell and to whom, and register for GST when your turnover passes $75,000. Put the contracts in writing: terms of sale, supplier agreements, contractor agreements and co-founder documents. Protect the brand: registered trade marks through IP Australia, copyright ownership assigned to you, and design protection where it fits. And treat compliance as a checklist: consumer guarantees and honest pricing under the ACL, the Privacy Act threshold and its exceptions, consent and unsubscribe under the Spam Act, clear payment and refund processes, and a store that is accessible and transparent. When a question turns on your specific facts, that is the moment to call a lawyer rather than guess.