Starting an online business in Australia and the legal obligations before launch

Launching an online business in Australia is one of the fastest ways to reach customers nationally, but it switches on a set of legal obligations the moment you start trading. Registration requirements, consumer protection law, privacy rules and marketing restrictions all apply to a business that sells over the internet, and most of them apply whether you are a one-person side project or a funded startup. Missing one can cost far more than the registration fee you were trying to avoid.

This guide sets out the obligations you need to meet before launch: what to register and when, the turnover thresholds that trigger GST and privacy duties, the consumer law and spam rules that govern how you deal with customers, and the penalties that apply if you get any of it wrong.

The thresholds that decide what applies to you

Most obligations attach only once you cross a defined trigger. Before you spend money on a website or a logo, work out which of these apply to you:

ABN: Any business carrying on an enterprise in Australia should hold an Australian Business Number. The ATO requires an ABN before you can register for GST, and most suppliers, banks and customers expect one for invoicing.
Business name: If you trade under any name other than your own legal name, register the business name before you start trading. A sole trader operating under their exact personal name generally does not need one.
GST: You must register for GST when your GST turnover is $75,000 or more in a 12-month period, or when you expect it to reach that level.
Privacy Act 1988 (Cth): Applies to businesses with annual turnover above $3 million, and to a specific list of smaller businesses that are caught regardless of size.
Australian Consumer Law: Applies from your very first sale of goods or services to a consumer. There is no turnover threshold and no small business exemption.
Spam Act 2003 (Cth): Applies to any commercial email or SMS sent to an Australian address, however small your list.
Fair Work system: Applies as soon as you employ anyone or engage contractors to do ongoing work.

The two figures that catch the most founders by surprise are the GST threshold, which is lower than many assume once sales start compounding, and the privacy threshold, because the small business exemption is narrower than it sounds.

Register your business name and ABN before you trade

Your first obligations are registration ones, and they should be done before you take an order, send an invoice or open a business bank account.

The ABN is free and available to anyone carrying on an enterprise in Australia. It is also a gateway obligation: as the ATO explains, you need an ABN before you can register for GST, and you will generally need it to set up supplier accounts and to issue tax invoices that customers can claim against. Apply through the Australian Business Register rather than a paid agent; the process is straightforward and the ATO will not charge you for it.

The business name obligation works differently. You only need to register a business name with ASIC if you trade under a name that is not your own legal name. A sole trader selling under "Jane Smith" does not need one; a sole trader selling under "JSmith Beauty" does, even if the domain name is already theirs. Registration is done through business.gov.au, and the name must be available and not too similar to an existing registered name. Check availability before you build a brand around it, because the business name register, the trade mark register and the domain space do not talk to each other.

Register for GST when your turnover crosses $75,000

GST registration is a threshold obligation with a deadline attached. Under the ATO's rules, you must register when your GST turnover is $75,000 or more, worked out either as your current turnover for the last 12 months or your projected turnover for the next 12 months. Non-profit organisations get a higher threshold of $150,000, and there is no threshold at all for taxi and ride-sourcing services.

The deadline is what most businesses miss. You must register within 21 days of your GST turnover exceeding the threshold, and the ATO expects you to check each month whether you have crossed it. Once registered, you charge 10 per cent GST on most sales, claim credits for GST on your business purchases, and lodge a business activity statement (BAS) each quarter (or monthly, depending on your turnover and the ATO's requirements).

Failing to register on time is not just a paperwork problem. If you should have been registered, you can be liable for the GST on sales made since the date registration was required, even if you never charged your customers GST, plus penalties and interest. Keep a running record of your turnover from month one so you know exactly when the 21-day clock starts.

Privacy and data protection duties

The Privacy Act 1988 (Cth) (the Act) protects the personal information you collect, and it applies to online businesses more often than founders expect.

The starting point is the turnover test. Under s 6D of the Privacy Act 1988 (Cth), a business is a small business exempt from the Act if its annual turnover is $3 million or less, so the Act generally applies once annual turnover exceeds $3 million. But the OAIC's small business guidance lists the exceptions that catch smaller operators regardless of turnover: you are covered if you are a health service provider, if you trade in personal information (for example, selling customer lists), if you provide services under a Commonwealth contract, if you operate a residential tenancy database or a credit reporting body, if you are an AML/CTF reporting entity, or if you are related to a business the Act covers. You can also opt in voluntarily, which some businesses do for credibility with customers and platforms.

If the Act covers you, the Australian Privacy Principles (APPs) govern how you collect, use, store and disclose personal information. In practice that means a clear privacy policy, collecting only what you need, telling people why you are collecting it and who you share it with, keeping it secure, and giving people access on request. If you are covered and you suffer an eligible data breach, s 26WL of the Act requires you to notify affected individuals (and the OAIC) as soon as practicable, so a customer database holding emails, addresses and payment details is a serious compliance responsibility, not an asset you can ignore.

The penalties are real. Under the OAIC's regulatory guidance, a serious or repeated interference with privacy under s 13G can attract a maximum penalty for a body corporate of the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and $2.5 million for an individual.

Privacy law is also changing. The Privacy and Other Legislation Amendment Act 2024 (Cth) introduced a statutory tort for serious invasions of privacy, actionable without proof of damage, and requires the OAIC to develop a Children's Online Privacy Code that will matter if your site is directed at kids. The small business exemption is also under statutory review, so treating privacy as a compliance project now rather than later is the cheaper path.

Consumer law duties under the Australian Consumer Law

The Australian Consumer Law (ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), applies to every sale you make to a consumer. There is no turnover threshold, no startup grace period and no exemption for small operators, so your obligations start with your first order.

Three parts of the ACL matter most to an online business:

Misleading or deceptive conduct: Section 18 of the ACL prohibits conduct that is misleading or deceptive or likely to mislead or deceive. For an online store that means product descriptions, pricing, reviews, shipping timeframes and marketing claims all need to be accurate, and claims about what a product can do need to be substantiated.
Consumer guarantees: Under s 54 of the ACL, goods supplied to a consumer carry an automatic guarantee of acceptable quality: they must be fit for purpose, acceptable in appearance and finish, free from defects, safe and durable. Similar guarantees cover services, delivery timeframes and repairs. The guarantees cannot be excluded, so a "no refunds" policy or a term that waives the guarantees is unenforceable against a consumer, and customers are entitled to a repair, replacement or refund where a guarantee fails.
Unfair contract terms: Terms in standard form consumer and small business contracts are void if they are unfair: for example, terms that let you change the price or suspend the service unilaterally, automatically renew subscriptions, or cap your liability for your own failures. Since the reforms that commenced in late 2023, proposing or relying on an unfair term is itself a contravention, not just a void term.

The exposure is significant. Under s 224 of the Competition and Consumer Act 2010 (Cth), the maximum pecuniary penalty for a body corporate is the greater of $100 million, three times the benefit obtained, or 30 per cent of adjusted turnover, and $2.5 million for an individual, per contravention. The ACCC actively investigates online retailers, and its enforcement is not limited to big businesses.

Email and SMS marketing duties under the Spam Act

If you email or text customers, the Spam Act 2003 (Cth) (the Act) applies to every commercial electronic message with an Australian link, however small your list. The Act imposes three obligations:

Consent: You need the recipient's consent to send commercial messages, which can be express or reasonably inferred from their conduct and existing relationship. Purchasing a list of addresses without consent, or adding people who bought once years ago, is the fastest way to breach the Act.
Sender identification: Under s 17, every message must clearly and accurately identify who authorised it and include accurate contact details that remain valid for at least 30 days.
A functional unsubscribe: Under s 18, each message must include a clear and conspicuous unsubscribe facility that actually works for at least 30 days after the message is sent, and you must honour unsubscribe requests promptly.

The ACMA enforces the Act, and it regularly issues infringement notices and takes businesses to court over email and SMS marketing. A compliant list built on real consent is also more effective marketing, so the legal and commercial incentives point the same way.

Employment and contractor duties

The Fair Work system applies the moment you have people doing work for you, whether they are employees or contractors. Employees are entitled to the National Employment Standards, minimum award rates, superannuation, leave and protections against unfair dismissal; contractors are not, which is why the employee-versus-contractor distinction is one of the highest-stakes classification questions in Australian business law.

The test for who counts as an employee changed in 2024, and the answer depends on the real substance of the working relationship, not the label in the contract. Misclassifying a worker as a contractor can lead to back-pay claims, penalty rates and regulator attention. The safe approach for an online business is to have written agreements for anyone doing ongoing work, with terms that cover pay, hours, confidentiality and ownership of intellectual property, and to get advice before you structure a relationship that sits near the line. If contractors build your website, write your content or design your products, the agreement should also assign their intellectual property to you, because without that, they own what they create.

Brand protection: trade marks

Registering a trade mark is not a legal obligation, but it is a rights decision with a timing cost. IP Australia advises that registration takes at least seven months and costs a minimum of $250 per class of goods or services, so an application filed after launch will not protect you during your first busy season.

Without registration you still have some protection: unregistered marks can be enforced through the misleading or deceptive conduct provisions of the ACL and through passing off, but those claims require you to prove reputation and customer confusion, which is slower and harder than relying on a registered mark. The practical obligation is to search the trade mark register and the domain space before you commit to a brand, and to file early if the name is important to you. A rebrand after six months of trading costs more than the application fee many times over.

The cost of non-compliance

Putting the exposure together, non-compliance is expensive in every direction:

GST: backdated GST liability from the date registration was required, even on sales where you never charged GST, plus penalties and interest from the ATO.
Privacy: up to the greater of $50 million, three times the benefit, or 30 per cent of adjusted turnover for a body corporate for a serious or repeated interference with privacy, per the OAIC.
Consumer law: up to the greater of $100 million, three times the benefit, or 30 per cent of adjusted turnover for a body corporate per contravention under s 224 of the Competition and Consumer Act 2010 (Cth), plus injunctions, compensation orders and substantiation notices from the ACCC.
Spam: infringement notices and court-imposed penalties from the ACMA for each breach of consent, identification or unsubscribe obligations.

On top of the dollar figures, each of these regulators can publish enforcement action, and a penalty notice or court case is very hard for a small brand to recover from.

Pre-launch compliance checklist

Work through this list before you take your first order:

Apply for an ABN through the Australian Business Register.
Register your business name with ASIC if you trade under anything other than your legal name.
Check your current and projected GST turnover and register within 21 days of crossing $75,000.
Confirm whether the Privacy Act covers you, including the exceptions to the small business exemption, and publish a privacy policy that matches what you actually do with data.
Publish website terms and conditions and checkout terms that reflect the consumer guarantees and do not contain unfair terms.
Set up consent-based email and SMS marketing with sender identification and a working unsubscribe.
Use written agreements with employees and contractors, with intellectual property assigned to you.
Search the trade mark register and file early if your brand name matters.
Keep monthly records of turnover, sales, expenses and customer data handling from day one.

When a lawyer should be involved

You can handle the registration steps yourself, but professional help earns its fee at specific decision points. A lawyer is worth engaging to choose your business structure (sole trader versus company affects your liability and tax from the first dollar), to draft or review your website terms, privacy policy and checkout terms against the current ACL and Privacy Act, to prepare employment and contractor agreements, to run the trade mark strategy, and to respond if a regulator contacts you or a customer complains.

What a practitioner does in each case is tailor the documents to your actual model: your refund process, your subscription terms, your data flows, your suppliers and your platforms. The value is not the template, it is knowing which clauses a court or regulator would strike down and which obligations you have missed entirely.

The obligation most founders miss: consumer law applies from your first sale

Every threshold in this article has an exception except one. GST waits until $75,000, privacy waits until $3 million, and the spam rules only bite when you send marketing. The Australian Consumer Law has no threshold at all: from your first sale, the consumer guarantees attach to your products, your product pages must not mislead, and your checkout terms must not contain unfair terms. That is the duty most online businesses discover only after a complaint, a chargeback dispute or an ACCC inquiry.

This week, do two things. Run the threshold self-assessment: project your next 12 months of turnover, and list every exception that might apply to your privacy obligations. Then read your own checkout flow as a customer would, from product page to confirmation email, and ask whether any term shifts risk unfairly to the buyer. If a term would not survive a complaint, rewrite it before launch, and have a lawyer review the final set. That review costs less than one month of penalties if you get it wrong.