Legal checklist for launching an online business in Australia

You have the product, the domain and the marketing plan. The launch list most online founders actually work through goes like this: build the website, list the products, run the ads, and deal with legal compliance only when the first refund dispute, chargeback or customer complaint lands. That ordering is backwards, and it is one of the most expensive mistakes a small online business can make.

The law that applies to you does not care how small you are. From the day you take a payment, collect a name and email address, make a claim about what your product does, or sign up a supplier, you are inside Australian legal obligations that do not scale with revenue. The good news is that the essentials form a checklist, not a wall of compliance. This guide sets out what to register, which consumer and privacy rules bite first, the contracts worth having before you need them, and where a lawyer genuinely adds value.

Choose the structure that matches your risk

The first decision is structural, because it determines what you register and who is on the hook if things go wrong:

Sole trader: The simplest and cheapest way to start. You and the business are the same legal person, so debts, refunds, chargebacks and any legal claim against the business are yours personally. Many online founders start here, and it is a defensible choice while revenue is small.
Partnership: Two or more people carrying on a business together. There is no separate legal entity, and partners are generally liable for each other's acts in the course of the business. A written partnership agreement matters even between friends, because the default rules assume far more trust than a scaling business usually has.
Company: A separate legal entity registered with ASIC. It has its own Australian Company Number, can own the website, the brand and the customer data in its own right, and most debts and claims sit with the company rather than with you personally. It costs more to run, with registration and annual review fees and its own tax obligations, but it is the structure wholesalers, investors and serious partners usually expect.

If you incorporate, your company's internal rules come from its constitution or, if it has none, the replaceable rules in the Corporations Act 2001 (Cth). If there is more than one owner, a shareholders agreement is where you record equity, decision-making, vesting and what happens when someone leaves.

Online businesses scale quickly, and scaling tends to surface refunds, chargebacks, intellectual property disputes and marketing complaints. Deciding which structure carries those risks is much cheaper before launch than after. You can convert a sole trader business into a company later, but that means moving assets, contracts and registrations and working through the tax consequences, so the choice is worth making deliberately rather than deferring.

Register what your structure requires

Once you know the structure, the registrations follow in a short sequence:

ABN: An Australian Business Number is the identifier you need to carry on an enterprise in Australia. You use it on invoices, supplier accounts and marketplaces, and it is the gateway to GST registration. It also protects your cash flow: if you invoice other businesses without quoting an ABN, the payer is generally required to withhold the top personal tax rate (currently 47%, including the Medicare levy) from each payment over $75, excluding GST, and remit it to the ATO (ATO, withholding if an ABN is not provided).
Business name: If you are a sole trader named Alex Nguyen trading as "Harbour Candles", the name Harbour Candles is a business name and must be registered nationally with ASIC. The same applies to a company trading under anything other than its exact company name. ASIC's registration fee is indexed each year on 1 July, and the current schedule is published on its site (ASIC, register a business name). Registering a business name protects your right to trade under that name; it does not give you any trade mark rights in it, which is a separate step covered below.
Company: If you are incorporating, registration with ASIC creates the company, issues the ACN and records your registered office and officeholders. The constitution or replaceable rules then govern how the company makes decisions and who can bind it.
GST: You must register for goods and services tax once your GST turnover reaches $75,000 or more in a 12-month period (ATO, registering for GST). Penalties can apply if you fail to register when required, and the ATO can backdate your registration, meaning GST may be owing from when it should have occurred. Many online founders register voluntarily before the threshold so they can claim GST credits on start-up costs such as software, stock and equipment. The trade-off is that you must then charge 10% GST on sales and lodge activity statements, so whether voluntary registration is worth it depends on your mix of costs and sales. That is a question for an accountant, not a lawyer.

Consumer law applies from your first sale

If you sell to customers in Australia, the Australian Consumer Law (the ACL), which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), applies to you on day one. There is no size threshold and no exemption for online sellers. Four parts of the ACL matter most for an online store:

Misleading or deceptive conduct: Section 18 of the ACL prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. It covers product pages, ads, emails, influencer posts you authorise and even your returns policy. "From $49" pricing that no customer can actually achieve, unqualified outcome claims, and vague "limited time" discounts are all the kind of language that generates complaints.
Representations about rights and guarantees: Section 29(1)(m) of the ACL makes it a contravention to make a false or misleading representation about the existence, exclusion or effect of any condition, warranty, guarantee, right or remedy. This is the provision that catches "no refunds" signs and "all sales final" wording, because they misrepresent the rights a customer actually has.
Consumer guarantees: Goods must be of acceptable quality (section 54 of the ACL), fit for the purpose they are sold for, match their description, and services must be supplied with due care and skill. If a guarantee fails and the failure is major, such as the product being substantially unfit for its purpose and not easily fixable (section 260), the customer can choose a refund or a replacement. For a minor failure, you may choose to repair or replace. You cannot contract out of these guarantees, so a returns policy that contradicts them is not just unhelpful, it is itself a legal problem.
Unfair contract terms: Terms of standard form consumer and small business contracts that are unfair are void (section 23 of the ACL). Since November 2022, proposing or relying on an unfair term is itself a contravention that can attract a pecuniary penalty under section 224, rather than merely rendering the term void. For online businesses this most often bites in one-sided website and subscription terms: automatic renewals buried in fine print, unilateral variation clauses, or cancellation penalties that are out of proportion to any loss.

Handle customer data on a privacy framework

An online store collects personal information from the moment someone visits: names, email addresses, delivery addresses, payment details, IP addresses and device data. That triggers the Privacy Act 1988 (Cth), which sets out 13 Australian Privacy Principles (the APPs) covering collection, use, disclosure, storage, access and correction.

The small business exemption means businesses with an annual turnover of $3 million or less are generally exempt from the APPs (section 6D of the Privacy Act 1988 (Cth)). Three things stop most online businesses from relying on it.

First, the exemption does not apply to every small business. Businesses that trade in personal information, health service providers and a range of other categories are covered regardless of turnover. Second, even where the Act does not apply to you, your payment gateway, ad platform, email provider and marketplace will usually require you to warrant that you handle data lawfully, and some contracts bind you to privacy standards anyway. Third, customers expect transparency, and an online brand runs on trust. A store that cannot explain what it does with customer data loses both.

If you are within the APPs, or choose to comply as good practice, the minimum framework is a collection notice at the point of collection, a privacy policy that matches your actual practices (what you collect, why, how long you keep it, and who you share it with, including shipping providers, payment gateways, analytics and advertising pixels), and a process for handling access and correction requests. The policy should be reviewed whenever you add a tool or platform, because your disclosures must match what you actually do.

Email and SMS marketing has its own rules

The Spam Act 2003 (Cth) regulates commercial electronic messages, which covers email, SMS and similar messages sent with an Australian link. There is no small business exemption, so the rules apply from your first newsletter:

Consent: You must not send a commercial electronic message unless the recipient has consented (section 16 of the Spam Act 2003 (Cth)). Consent can be express or reasonably inferred from an existing relationship or conduct, but it cannot be inferred merely because an address has been published (Schedule 2, clause 4 of the Spam Act 2003 (Cth)). A purchased list, or a list imported from a previous venture, is the fastest way to breach the Act.
Identification: Each message must clearly identify who is sending it and include accurate contact details.
Unsubscribe: Every commercial message must include a functional unsubscribe facility that remains able to receive requests for at least 30 days after the message is sent (section 18 of the Spam Act 2003 (Cth)), and unsubscribe requests must be honoured promptly.

The ACMA enforces the Spam Act 2003 (Cth) and can issue infringement notices and seek civil penalties. In practice, the businesses that attract its attention are the ones buying lists, ignoring unsubscribe requests, or sending bulk messages without any consent record. Keep records of when and how each subscriber consented, use a confirmed opt-in, and make unsubscribing a one-step process.

Put the contracts in place your model needs

Legal documents are where you write down the rules of the relationship, and for an online business the short list is shorter than most founders expect:

Website terms: Content ownership, acceptable use, disclaimers and any limits on liability, how disputes are handled and which law applies.
E-commerce terms: Order acceptance and cancellation, shipping timelines, returns and refunds written to sit inside the ACL rather than against it, subscription billing and renewal rules, and chargeback and dispute steps. If you sell digital products, this is also where your licence terms live: what the customer may and may not do with the content.
Privacy policy and collection notice: As described above, matching your real practices.
Supplier and fulfilment agreements: Quality requirements and what happens when products are defective, lead times, who carries the risk of lost or damaged stock, payment terms and a dispute process. A supplier failure almost always becomes a customer refund problem, so this agreement is how you recover.
Contractor agreements: If you outsource design, development or marketing, the contract needs scope, payment, confidentiality and clear ownership of the intellectual property in what you paid for. In Australia the creator of a work generally owns the copyright in it unless the contract says otherwise, so paying a developer for a website does not automatically make you the owner. An assignment clause, or a licence that covers what you actually need, is the fix.
Co-founder agreements: If you are building with someone else, a shareholders agreement (or partnership agreement) covering equity, vesting, decision-making, exit and dispute resolution. It is the document most often written too late, once revenue has made the original informal understanding ambiguous.

Protect the brand before the marketing budget grows

A registered business name protects your right to trade under a name. It is not the same as owning the brand. A registered trade mark gives you the exclusive right to use the mark for the goods and services it covers, which is what lets you stop a copycat store or a squatter on your name.

Run the cheap checks before you spend: the business name register, domain availability and a search of IP Australia's trade mark register. Then consider filing. Through IP Australia, a standard application costs a minimum of $250 per class of goods or services and the process takes at least seven months, while the TM Headstart pre-application service, which gives you examiner feedback before you formally file, costs from $330 (IP Australia, trade mark timeframes and fees). Registration lasts ten years and is renewable.

For an online business the brand is often the main differentiator in a crowded market, so the trade mark is one of the few assets worth registering even before revenue is steady. The founder who skips this step is the one who rebrands at the worst possible moment, after the marketing budget has already made the old name valuable.

When a lawyer earns their keep

You can work through this checklist yourself, and most founders should. The judgement calls are where a lawyer adds value, and they cluster in specific places: choosing a structure that properly matches your liability and growth plans; working out whether the small business exemption actually applies to your data handling; drafting terms that preserve a genuine change-of-mind refund policy without colliding with the consumer guarantees; making sure contractor contracts assign intellectual property to you; choosing the right trade mark classes and responding to examination objections; and writing the co-founder agreement before the relationship needs it.

A commercial lawyer at Artificer Legal can take you through the checklist, draft the documents that need drafting, and tell you which parts of the framework genuinely depend on your specific business model, such as subscriptions, digital products or selling through marketplaces. That review is usually a matter of hours, not weeks, and it is far cheaper than the first dispute.

The "no refunds" sign is a liability, not a policy

The single most damaging piece of wording on an Australian online store is the sign that says "no refunds". It is usually added in good faith, to manage change-of-mind requests, but as written it misrepresents the customer's rights under the consumer guarantees, and that misrepresentation is itself a contravention of section 29(1)(m) of the ACL. You can have a genuine no-refunds-on-change-of-mind policy for most purchases. What you cannot do is represent that the statutory guarantees do not exist, and a refund dispute is the most common first legal problem an online store faces. A policy that fights the law turns a modest refund into a regulator complaint and a fine, which is the wrong direction entirely.

The version of this checklist that protects you is short: choose a structure that matches your risk, register the ABN, business name and GST when required, treat consumer law, privacy and spam rules as live obligations rather than boilerplate, put the core contracts in place before a dispute needs them, and protect the brand before it is worth copying. Most of it can be done in a weekend. The parts that cannot, the drafting and the judgement calls, are exactly what a commercial lawyer is for, and getting them done early is what lets you spend the next few years selling instead of firefighting.