International E-Commerce Law: What Companies Need to Know Before Selling Worldwide

The most expensive mistake in international e-commerce often occurs before the first foreign order arrives: the company lets its website decide where it does business. It builds an online store for its home market, turns on international shipping, and accepts orders from wherever its payment processor works. Nobody has decided whether the product is legal there, who will pay import duties, whether the return policy complies with local law, or what happens if a regulator comes calling. Those questions surface only after customs holds a shipment, a marketplace suspends the account, or a consumer asserts rights the company did not know existed.

A website can reach the world, but few sellers should try to serve all of it on day one. Choose the markets first, then build the legal and operational system around those choices.

1. Choose Your Markets Before They Choose You

Each country adds potential customers and another body of consumer, privacy, tax, product, labeling, and marketing law. Those obligations do not disappear because the seller has no office there. What usually matters is whether the company directs business into the country, as shown by shipping there, quoting local currency, buying local advertising, using a country-specific domain, or tailoring the site to local consumers.

Start with a short list of countries that matter commercially. Expected sales are only part of the calculation. Margins, return costs, customs friction, chargeback rates, regulatory burdens, and the cost of protecting the brand matter too. A market that produces substantial orders can still be a bad market if each order creates an unpredictable tax or compliance problem.

The website and sales systems must enforce that decision. Block orders from countries that have not been cleared, and align payment settings, shipping options, marketplace listings, and advertising campaigns with the approved list. Geographic blocking is imperfect, but it is better than claiming not to sell into a country while regularly accepting orders from there.

2. Clear the Product and Supply Chain

The first product question is whether the company can lawfully export, import, advertise, and sell it in each target market. A product that is legal in the United States is not automatically legal in the European Union, Canada, Mexico, Australia, or Japan.

Food, supplements, cosmetics, medical devices, electronics, batteries, children’s products, chemicals, alcohol, cannabis products, and wireless devices receive obvious regulatory attention. Ordinary consumer goods still face rules governing safety, materials, warnings, testing, packaging, recycling, and labeling.

Consider a U.S. cosmetics company that sees a surge of orders from Europe. Its ingredients are lawful and its English labels satisfy U.S. requirements. That does not answer whether the product has the required EU safety assessment, notification, responsible person, ingredient labeling, language, or claims support. By the time customs or a marketplace raises the issue, the company has already spent money acquiring customers it cannot lawfully serve.

The same problem appears in less regulated categories. European Commission guidance on the General Product Safety Regulation addresses online product listings, traceability, recalls, and the identification of an EU-based responsible economic operator. A product page designed for U.S. sales can be legally incomplete in Europe even when the product itself is safe.

Product clearance should address the product’s classification, ingredients and materials, testing, certifications, warnings, instructions, local-language requirements, environmental obligations, and any required registration or local representative. It should also identify who handles safety complaints, adverse-event reports, recalls, and regulator inquiries after the sale.

Export controls and sanctions belong in this review. An automated store can complete a prohibited transaction as easily as a lawful one. The analysis can turn on the product, customer, beneficial owner, end user, end use, payment channel, or shipping route. The U.S. government’s Consolidated Screening List is useful, but a name search is not a complete compliance program. A buyer who refuses to explain the end use or asks the seller to ship through an unrelated third country presents a problem even if no exact name appears on a list.

Complete this work before translating the site or buying foreign advertising. Creating demand accomplishes nothing if the product cannot legally arrive.

3. Decide Who Is Selling, Importing, and Paying Tax

International e-commerce becomes confused quickly when the website, invoice, carrier, and tax return tell different stories about the same transaction. Identify which entity owns the inventory, operates the site, contracts with the customer, collects payment, imports the goods, and bears product liability. The existing company can often begin exporting without forming a subsidiary in every country. A local entity becomes more useful when the business keeps inventory there, hires employees, needs a local license, or reaches enough scale to justify local banking and tax infrastructure.

A marketplace or merchant of record can take over part of the burden, but the name of the service proves little. Its contract determines whether it is actually the seller, whether it collects and remits tax, who processes returns and chargebacks, and who answers a regulator. Some providers handle payment and tax while leaving product compliance and customer liability squarely with the brand.

Before launch, the seller needs clear answers to four questions:

1. Who is the seller of record?
2. Who collects and remits VAT, GST, sales tax, or similar taxes?
3. Who is the importer of record?
4. Who pays duties, brokerage charges, and import taxes?

If any answer changes from country to country, the website and transaction documents must account for that difference. Those answers need to match the checkout, invoice, shipping documents, marketplace agreement, and customer experience. If the site promises a duty-paid price but the carrier demands another $75 at the customer’s door, the problem is more than poor service. The seller’s documents and conduct contradict each other.

One client purchased products for nearly two years through a Hong Kong company that accepted payment and called a mainland Chinese factory “our production facility.” When the client changed suppliers and asked for its molds, the Hong Kong company explained that it did not own the factory or possess the molds. The factory had signed nothing and claimed the tooling. As discussed in The RedNote Contract Lesson for Companies Doing Business in China, the contract bound the company holding nothing the buyer needed. An online seller faces the same problem when the entities taking orders, importing goods, holding inventory, and controlling the supply chain do not match the names in its contracts.

The EU’s One Stop Shop and Import One Stop Shop systems simplify some VAT reporting. They do not eliminate the need to determine eligibility, register correctly, value the goods, and account for where inventory sits. Similar questions arise under other countries’ GST and marketplace-facilitator regimes.

Customs classification, valuation, origin, and admissibility also require attention. A broker can prepare the entry, but that does not necessarily transfer the seller’s or importer’s legal responsibility. We have seen delivered-duty-paid transactions in which the documents identify one importer while the logistics provider uses another or understates value. Our post on DDP shipping risks explains why an attractive all-in quote can conceal duties, false declarations, and serious exposure. Calculate landed cost before setting foreign prices. VAT, duty, brokerage, returns, payment fees, and compliance costs can turn an apparently profitable sale into a loss.

4. Protect the Brand Before Advertising It Worldwide

An international launch shows customers what the company sells. It also shows trademark squatters, counterfeiters, copyists, and opportunistic distributors what to register or imitate. Trademark rights are territorial. A U.S. registration does not confer rights in the EU, Mexico, Australia, or most other markets.

Frisby, a well-known Colombian restaurant chain, learned how incomplete foreign protection can interfere with expansion. Frisby Colombia had registered an EU logo containing its name and chicken mascot, but a Spanish company later obtained an EU registration for the FRISBY word mark. Frisby Colombia apparently missed the deadline to oppose that application. It now faces a much harder and more expensive fight as it considers entering Europe. As we explain in The Frisby Fried Chicken Trademark Dispute, filing a trademark is not enough. Companies also need to register the right versions of their marks and monitor later applications that threaten them.

Burger King encountered a similar problem when it entered Australia and found that another business already controlled the BURGER KING name there. It entered the country as Hungry Jack’s instead. Large companies can absorb the cost of building a second national brand. Most e-commerce companies cannot.

Prioritize registrations based on expected sales, manufacturing, warehousing, likely expansion, and enforcement risk. Our guide to international IP protection for startups discusses how to make those choices without pretending every business can register every right everywhere.

Manufacturing countries belong on the list even when the company makes no sales there. A party that registers the company’s trademark in the country of manufacture can disrupt production or ask customs to stop exports. Agreements with manufacturers, designers, developers, photographers, and marketing agencies should also assign the rights the company expects to own. Payment for creative work does not by itself transfer every relevant right.

Registration is only part of the job. Assign responsibility for monitoring marketplaces and trademark filings, preserving evidence, and choosing among platform takedowns, customs recordation, demand letters, and litigation. A right nobody watches or enforces has limited practical value.

5. Treat the Website as Advertising and as a Contract

The product page, cart, and checkout do most of the legal work in an online sale. They describe the product, make the claims, state the price, present the terms, and record the customer’s assent. Generic terms in the footer cannot cure a misleading product page or an unlawful checkout.

Before ordering, the customer should see who the seller is, what the product is, the total price, shipping charge, delivery estimate, payment obligations, cancellation rights, return rules, and important limitations. The precise disclosures and customer rights depend on the market.

EU consumers generally receive 14 days to cancel many distance purchases, subject to important exceptions. The United States takes a different approach, but the FTC’s Mail, Internet, or Telephone Order Merchandise Rule requires a reasonable basis for advertised shipping times and governs what the seller must do when shipment is delayed.

Businesses get into trouble when their written policies describe an idealized company rather than the one that exists. If the site says refunds issue within ten days, the operations team needs to meet that deadline. If “free returns” applies only in the continental United States, the site should say so before the customer pays. A policy copied from a larger competitor can impose promises the smaller company cannot keep.

Terms of sale should cover order acceptance, payment, delivery, risk of loss, returns, warranties, liability, governing law, and dispute resolution. The checkout should require an affirmative act after giving conspicuous notice of those terms. The seller must also retain the version accepted and the time of acceptance.

In Cruz v. Tapestry, a California court refused to enforce an online arbitration provision presented through a line of small gray text beneath the purchase button on a cluttered checkout page. The customer was not required to check a box or otherwise acknowledge the terms. As our discussion of the Tapestry online arbitration decision explains, having terms somewhere on the website does not establish that the customer agreed to them. The design of the checkout can determine whether the contract works.

Translations require legal review, especially for warranties, cancellation rights, regulated claims, and liability provisions. Declaring English the controlling language helps in some commercial relationships, but it does not erase mandatory consumer rights or local-language requirements.

Hidden fees, prechecked boxes, false countdown timers, disguised subscriptions, and cancellation procedures designed to exhaust the customer create predictable trouble. The practical question is whether a reasonable buyer understands the bargain before paying.

6. Build Privacy and Security Into the Business

We still encounter businesses that have no privacy policy. More often, the company has copied one from a competitor or generated one without examining what its website actually does. That can be worse. A policy that says the company does not share data while advertising pixels transmit customer information creates evidence against the company.

Start by mapping the data. Identify what the company collects, why it collects it, where it goes, how long it remains, who can access it, and which vendors receive it. The map should include cookies, analytics, advertising technology, payment services, fraud tools, customer support, fulfillment providers, email platforms, loyalty programs, and marketplace data.

The resulting obligations vary by jurisdiction and business model. They commonly include notice, consent, cookie controls, rights to access or delete data, targeted-advertising choices, children’s privacy, retention limits, vendor contracts, security measures, and restrictions on international data transfers. The European Commission’s GDPR guidance for businesses is a sensible starting point for companies targeting EU consumers. U.S. businesses must also account for state privacy laws and any federal rules specific to their industry or data.

The privacy policy should describe the company’s real practices in language customers can understand. It is one part of compliance, not the compliance program itself. The same is true of cybersecurity. E-commerce businesses hold names, addresses, credentials, order histories, and sometimes far more sensitive information, often through vendors whose failures become the seller’s problem.

Core safeguards include multifactor authentication, controlled access, secure backups, timely patching, vendor review, employee training, and a written incident-response plan. The plan should identify who calls the insurer and investigators, preserves evidence, evaluates notification duties, and communicates with regulators and customers.

Cyber insurance can be valuable, but policies and exclusions differ. Review coverage for vendor incidents, ransomware, business interruption, regulatory proceedings, and response costs before a breach. Companies also need to answer insurance applications accurately. A business that claims to use security controls it never implemented invites a coverage dispute when it most needs the policy.

7. Control Marketing Before It Goes Live

Marketing teams, affiliates, influencers, and local distributors can publish claims faster than lawyers can retract them, and the brand often bears the consequences. Health, performance, environmental, origin, and comparative claims need appropriate support before publication. Approval in one country does not clear the same claim everywhere. The governing standard depends on the product, wording, evidence, and market.

Influencers must disclose paid or other material relationships clearly. A good influencer agreement addresses permitted claims, required disclosures, approval rights where appropriate, recordkeeping, correction of noncompliant posts, and responsibility for content. The FTC’s guidance on endorsements, influencers, and reviews also addresses incentivized reviews, fake reviews, and practices that distort the review record.

One recurring problem is the outside vendor that promises to “fix” a company’s ratings. Before agreeing, find out whether it solicits genuine reviews neutrally or manufactures praise and suppresses criticism. The company hiring the vendor does not get immunity from the vendor’s methods.

Email and text marketing raise separate consent and opt-out issues. The U.S. CAN-SPAM Act governs commercial email. The Telephone Consumer Protection Act and related FCC rules create substantial exposure for unlawful marketing calls and texts. Other countries often require advance consent for marketing that U.S. law permits with an opt-out.

Suppression lists must work across the company’s internal systems, agencies, affiliates, and platforms. “Our marketing vendor sent it” explains what happened; it does not excuse it.

8. Make the Store Accessible

Customers using screen readers or keyboards encounter problems when images and buttons lack labels, forms are poorly structured, video lacks captions, contrast is weak, or the checkout traps keyboard users. Automated overlays do not necessarily repair the underlying code or prevent claims. Accessibility belongs in design, procurement, content creation, and testing.

The U.S. Department of Justice has published web accessibility guidance under the ADA. The European Accessibility Act covers specified products and services, including e-commerce services, subject to its scope and exemptions. A plugin installed after a demand letter is no substitute for building an accessible store.

9. Prepare for Returns, Warranties, and Recalls

After the sale, the company needs workable rules for lost packages, customs delays, refused deliveries, damaged goods, returns, refunds, warranties, and safety complaints. The policy should say who bears the cost when a customer refuses to pay import duties and where foreign returns go. Carrier terms do not necessarily match what the seller promised at checkout.

Local law can override warranty disclaimers and require repair, replacement, refunds, parts, or disclosures. Product liability can extend to the manufacturer, brand owner, importer, distributor, marketplace, and seller, depending on the country and facts.

The business must be able to connect a complaint to the relevant product, lot, supplier, and customers. Give someone authority to stop sales, notify marketplaces, report to regulators, and begin a recall. Product-liability and recall insurance should cover the actual products, countries, and channels in which the company operates.

10. Do Not Let Platforms and Payment Providers Become Single Points of Failure

Amazon, Alibaba, TikTok Shop, app stores, payment processors, and fulfillment platforms impose their own contracts and enforcement systems. They can remove listings, hold reserves, pass through refunds and fines, freeze funds, or close an account long before any court decides who is right. Platform approval does not establish that a product complies with local law, and legal compliance does not prevent suspension under private platform rules. Sellers must satisfy both systems.

Read the contracts before the business depends on the cash flow. Pay particular attention to reserves, chargebacks, data access, return obligations, indemnities, termination, and what happens to funds after suspension. Offering local currency also raises questions about conversion rates, settlement currency, refund calculations, and foreign-exchange restrictions.

Keep copies of product listings, testing reports, supplier invoices, IP registrations, customer communications, delivery evidence, and account notices outside the platform. We have seen companies lose their storefront and the records needed to appeal at the same time. No business should allow a platform to become the sole repository of its evidence.

Counterfeiters tend to be lazy. In several matters, sellers copied our clients’ product photographs for their own Amazon listings. That gave us a cleaner takedown route than arguing over whether the products themselves were impermissible copies. We removed entire listings based on copyright infringement, and the sellers often moved on rather than rebuild them. Those cases show why platform enforcement depends on provable rights and preserved evidence, not merely on the fact that a competitor behaved badly.

11. Choose Dispute Terms That Work in the Real World

Companies want one governing law, one court, and one set of terms for every sale. Consumer law rarely cooperates. A clause that works in a business-to-business contract can fail against an individual consumer. Mandatory local law can override the chosen law, and a foreign court can accept jurisdiction despite a U.S. forum clause. An arbitration provision can fail because the site did not obtain assent or because local law will not force a consumer to arbitrate abroad.

Winning is useful only if the judgment or award can be enforced. Forum selection should account for where the parties and assets are located, whether the relevant country recognizes the judgment or arbitral award, the availability of interim relief, service and translation requirements, and the likely cost of the dispute.

The company also needs different terms for different relationships. Disputes with consumers, manufacturers, distributors, warehouses, marketing agencies, and marketplaces do not belong under one clause copied into every agreement. Consumer terms must accommodate mandatory rights. Commercial contracts should be designed around the counterparties, assets, and likely points of failure.

Where to Start

Most companies do not need a fifty-country legal memorandum before their first foreign sale. Pick the countries that offer a realistic commercial return. For each, confirm that the product can be sold there, identify the seller and importer, determine the tax and customs treatment, protect the key intellectual property, and make the website reflect local consumer and privacy rules. Then test the transaction from advertisement through checkout, delivery, return, and refund.

Put one person inside the company in charge. Lawyers, tax advisers, brokers, payment companies, marketplaces, and logistics providers each see only part of the transaction. Someone must make sure those parts fit together.

Do not turn on worldwide sales and hope the legal work catches up. Decide where the company will sell, clear those markets, and block the rest until their turn comes.