Ecommerce platforms UK regulations: a store-journey rule map

There is no single ecommerce-platform licence for an ordinary England merchant. Whether you sell through Shopify, WooCommerce or BigCommerce, ecommerce platforms UK regulations depend on who sells, what is supplied, how the interface influences a consumer, where goods move, who receives money and which personal data is used. Build a rule map for the real journey, then assign each legal boundary to a named owner.

What to take away

Record role, activity and authority

Start with the legal entities for merchant, platform, marketplace, payment provider and fulfiller. Beside every journey step, name the acting party, customer-facing wording, evidence source and correction owner. Do not infer responsibility from labels such as hosted, marketplace or merchant of record.

For current consumer practice, the CMA's unfair-commercial-practices guidance says the Digital Markets, Competition and Consumers Act 2024 provisions apply to practices from 6 April 2025. They can reach promotion, supply and post-contract activity, including platform conduct. The Consumer Rights Act 2015 gives consumers a minimum of 30 days to reject goods that fail to conform to the contract, and all products must be of satisfactory quality, fit for purpose and as described. Each platform's template must surface these rights at checkout.

GOV.UK's online and distance-selling guide sets out pre-order information, cancellation and confirmation requirements under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. Consumers have a 14-day cancellation window from receipt of goods or agreement of a service contract. Check the supply type before applying a general rule. Goods, services, digital content and certain excluded contracts follow different routes on Shopify, WooCommerce and BigCommerce. Regulation 28 lists the main exclusions from the cancellation right, including goods made to the consumer's specifications or clearly personalised, and goods liable to deteriorate or expire rapidly. The right also ends for sealed goods unsuitable for return for health protection or hygiene reasons once they are unsealed after delivery, and for sealed audio, video or software once unsealed. If you sell any of these, the checkout and confirmation email on your platform must say so before the order is placed.

The rule map at a glance

On Shopify and BigCommerce, the vendor's hosted checkout fixes much of the checkout and payment rows, so your evidence is a record of how you configured it. On self-hosted WooCommerce, your theme, plugins and payment gateway choices sit inside those rows, so more of the evidence is yours to produce.

What Shopify, WooCommerce and BigCommerce leave to the merchant

The law applies to the merchant whichever platform it uses. What differs is how much of each duty the platform's design settles.

Neither model removes a duty. Hosted platforms reduce how much you must build, and WooCommerce increases how much you must prove.

Beyond England

Most of these rules apply across the UK. Three differences matter for a store selling nationally. Northern Ireland applies EU product-safety rules to goods under the Windsor Framework, so check OPSS guidance for goods sold there. The Equality Act 2010 applies in Great Britain, while Northern Ireland has its own disability discrimination law. Trading Standards enforcement is run by local councils in Great Britain, while in Northern Ireland the Department for the Economy's Trading Standards Service leads, so a complaint can reach a different team.

Give each risk its own gate

Price and checkout: Record the first invitation to purchase, mandatory charges, taxes, delivery costs, optional extras and final payable amount. The Price Marking Order 2004 requires the selling price and, where applicable, the unit price to be displayed. The CMA's additional-charges guidance, published in November 2025, says optional payments require express consumer choice rather than default opt-in. Test ordinary, discount, return and cancellation states across each platform's checkout template, and see the disclosure policy for the wording of price blocks and optional extras.

Products: OPSS product-safety guidance describes responsibilities for businesses that make, import, distribute or sell consumer products, while noting different application in Great Britain and Northern Ireland. Product marking, age-restricted goods and recall duties sit under the General Product Safety Regulations 2005. A safety adviser must identify product-specific rules and evidence; software cannot approve a listing.

Payments: The Payment Services Regulations 2017 govern how customer money moves. The FCA warns on its payment-services perimeter page that a marketplace or intermediary may be providing payment services if it receives customer money before passing it to a seller. Check the FCA Register for the provider's authorisation status, and compare how the payment gateways route funds. Exclusions may exist. Trace accounts, settlement and refunds, then assign a named owner to confirm the regulatory position.

VAT: HMRC's online sales VAT collection says treatment can depend on direct or marketplace sale, goods location and transaction. Registration turns on taxable turnover over a rolling 12 months and on expected turnover in the next 30 days, so the platform's sales reports should let you see both. Keep those facts, invoice data and reversals for the tax adviser. Do not use HMRC's tax definition as a universal commercial label.

Data and privacy: The UK GDPR and Data Protection Act 2018 govern personal data processing across every platform. The Privacy and Electronic Communications Regulations 2003 (PECR) set cookie-consent and marketing rules enforced by the Information Commissioner's Office (ICO). Each platform's app ecosystem must be checked against these duties before launch.

Access and security: The Government's service-provider disability guide addresses Great Britain duties under the Equality Act 2010, including anticipatory barriers. For the practical tests, see the accessibility checks. Separately, NCSC online-service guidance covers access, logging, dependencies and incidents. Accessibility and security approvals cannot substitute for each other.

Keep future measures out of the current column

The CMA's updated fair-contract guidance says some subscription-contract rules under the 2024 Act were expected to commence in spring 2027. On 6 September 2026, treat that as a future implementation point, not a rule already operating. Assign an owner to recheck commencement and related regulations before offering auto-renewal.

Release decision

Where gates apply, require named consumer, safety, payment, tax and privacy reviewers. Add named accessibility and security reviewers. The market entry checklist shows how to record a go, hold or stop decision.

Evidence pack: record the applicable rule, jurisdiction, status date, legal entity and journey state, then the source, reviewer and result (pass, hold or stop). A successful platform demo, supplier assurance statement or disclaimer is no legal conclusion. Hold publication if an exception, territory or commencement date is unresolved.

Before you act

Common questions

When do the Digital Markets, Competition and Consumers Act 2024 provisions apply?

The CMA's unfair-commercial-practices guidance says the provisions apply to practices from 6 April 2025. They can reach promotion, supply and post-contract activity, including platform conduct. The guidance is not itself law, and the actual trader and practice still require legal analysis.

What does the CMA say about optional payments at checkout?

The CMA's additional-charges guidance, published 18 November 2025, says optional payments require express consumer choice rather than default opt-in. The Price Marking Order 2004 requires the selling price to be displayed. Merchants should record the first invitation to purchase, mandatory charges, taxes, delivery costs, optional extras and the final payable amount, then test ordinary, discount, return and cancellation states.

What should the evidence pack contain before release?

It should contain applicable rule, jurisdiction, status date, legal entity, journey state, source, reviewer and pass, hold or stop result. Named consumer, safety, payment, tax, privacy, accessibility and security reviewers are required where their gates apply. A platform demonstration or supplier assurance statement is not a legal conclusion.