E-Commerce Legal Requirements for Small Businesses: What Your Checkout Page, Refund Policy, and Auto-Renewal Terms Need to Say

 Written by Aisha McKinney, Esq., Principal Attorney & Co-Founder at Zova

Quick Answer: Every online seller needs five legal elements in place: (1) an FTC-compliant refund and return policy; (2) clear auto-renewal disclosures before billing information is obtained; (3) checkout page disclosures at the point of purchase; (4) a cancellation mechanism at least as easy as enrollment; and (5) sales tax compliance in states where the seller has reached economic nexus thresholds. Missing any of these is a specific enforcement exposure under the FTC Act, ROSCA, state automatic renewal laws, and state sales tax regulations.

If you sell products, subscriptions, or digital downloads online, you have legal compliance obligations that brick-and-mortar retailers don’t. Most online sellers don’t know what those obligations are — which is why most online sellers have at least two of the five required legal elements wrong. This post covers each requirement, what it needs to say, and what happens when it’s missing.

What Legal Documents Does an Online Store Need?

An online store needs five categories of legal compliance infrastructure: a compliant refund and return policy, auto-renewal and subscription disclosures, checkout page disclosures, a compliant cancellation mechanism, and sales tax compliance. The primary legal frameworks governing these requirements in 2026 are FTC Act Section 5 (prohibiting unfair or deceptive acts or practices), the Restore Online Shoppers’ Confidence Act (ROSCA, governing negative option marketing online), state automatic renewal laws (currently enacted in approximately thirty states), and the Supreme Court’s 2018 Wayfair decision (establishing economic nexus for sales tax).

Requirement 1: FTC-Compliant Refund and Return Policy

Under the FTC’s Mail, Internet, or Telephone Order Merchandise Rule (the Mail Order Rule), online sellers are required to ship orders within the time stated or, if no time is stated, within 30 days. When a seller cannot ship on time, the seller must notify the customer and offer a full refund. The FTC’s regulations also require that sellers honor their stated refund policies.

A compliant refund policy should specify what is eligible for return or refund (all products, specific categories, digital vs. physical), the time window for returns (most states require a minimum window for certain product categories), the return process and who pays return shipping, the refund method and timeline, and any conditions that void the right to return. Vague language like ‘all sales final’ or ‘we don’t accept returns’ without specifics does not prevent chargebacks — it simply means the chargeback dispute will be decided by the card network without the seller’s position being adequately represented.

Requirement 2: Auto-Renewal and Subscription Disclosures

Under ROSCA, any online seller using a negative option feature — meaning any arrangement where the consumer’s silence or inaction results in a recurring charge — must clearly and conspicuously disclose all material terms of the transaction before obtaining the consumer’s billing information, obtain the consumer’s express informed consent before making any recurring charge, and provide a simple mechanism for the consumer to stop recurring charges.

The FTC’s $35 million settlement with Shutterstock in May 2026 illustrates how these requirements apply in practice. According to the FTC’s complaint (FTC.gov, May 14, 2026), Shutterstock marketed certain products as ‘Best for a one-time project’ with ‘no commitment’ while hiding that those products automatically renewed. The settlement required clear disclosure before billing information is obtained, express informed consent, and a simple cancellation mechanism. Shutterstock did not admit or deny wrongdoing.

Beyond ROSCA, approximately thirty states have enacted automatic renewal laws with specific language requirements. California’s Automatic Renewal Law (Cal. Bus. & Prof. Code § 17600 et seq.) requires that auto-renewal terms be presented clearly and conspicuously before the subscription or purchasing agreement is fulfilled and in visual proximity to the request for consent. The California law also requires a mechanism for consumers to cancel online if the initial subscription was made online. Civil penalties for willful violations of the California ARL can reach $2,500 per violation.

Requirement 3: Checkout Page Disclosures

The FTC’s ‘clear and conspicuous’ standard requires that material disclosures be presented in a way that is actually noticeable and understandable to the average consumer. For checkout pages, this means disclosures must be visible without scrolling (or must be clearly signaled as requiring a scroll), in sufficient contrast to be readable, in close proximity to the purchase button, and displayed before the payment information is entered. A disclosure buried in a general terms of service or privacy policy that the consumer linked to from a checkbox does not meet this standard for material subscription terms.

Specifically, the checkout page should display the total cost of the transaction (including all applicable fees, taxes, and shipping), the terms of any subscription or auto-renewal before the payment field, a clear description of what is being purchased, and any material limitations or conditions such as non-refundable deposits, cancellation fees, or geographic restrictions.

Requirement 4: Cancellation Mechanism

ROSCA requires that online sellers provide a simple mechanism for consumers to stop recurring charges. The FTC has interpreted this requirement to mean that cancellation must be at least as easy as enrollment. If a consumer can enroll in a subscription by clicking a button on a website, they must be able to cancel through a similarly accessible mechanism. Requiring a phone call to cancel a subscription that was purchased online is not compliant. Requiring a cancellation form that initiates a retention script before processing the cancellation is a risk.

The FTC’s enforcement actions in 2025 and 2026 have specifically targeted cancellation friction as a standalone violation, independent of disclosure issues. The agency’s settlements with Amazon Prime, Adobe, Cleo AI ($17 million, 2025), and Shutterstock ($35 million, 2026) all include cancellation friction as an enforcement basis.

Requirement 5: Sales Tax Compliance

Following the Supreme Court’s 2018 decision in South Dakota v. Wayfair, online sellers are required to collect and remit sales tax in states where they meet economic nexus thresholds. The most common threshold is $100,000 in sales or 200 separate transactions in a state per calendar year, though thresholds vary. As of 2026, all states with a general sales tax have enacted economic nexus provisions following Wayfair.

Sales tax liability begins from the date economic nexus is first established — not from the date the seller learns about the requirement. An online seller who reached the $100,000 threshold in California three years ago and has not been collecting California sales tax has accrued three years of back liability, plus interest and penalties. This liability cannot be erased by demonstrating that the seller didn’t know the rule applied to them.

Frequently Asked Questions About E-Commerce Legal Requirements

What legal documents does an online store need?

An online store minimally needs a refund and return policy that is specific and honored, auto-renewal and subscription disclosures that appear at checkout before billing information is obtained, checkout page disclosures showing total cost and material terms, a compliant cancellation mechanism, and documented sales tax compliance for states where economic nexus thresholds have been met. Additionally, an online store needs a privacy policy (required if collecting any personal information, which includes email addresses and payment information) and terms of service. Each of these documents has specific legal requirements — copying them from another website or using a free template generator creates compliance risk.

Do I need to disclose auto-renewal terms at checkout?

Yes. Under ROSCA and state automatic renewal laws, auto-renewal terms must be clearly and conspicuously disclosed before the consumer’s billing information is obtained — not in a general terms of service or footer, not after the payment field. The FTC’s enforcement standard requires that material subscription terms be visible in close proximity to the purchase button. California’s Automatic Renewal Law additionally requires that auto-renewal terms appear in visual proximity to the request for consent.

What happens if I don’t have a refund policy for my online store?

Operating without a clear refund policy exposes an online seller to three risks: FTC enforcement for deceptive trade practices if the seller’s conduct doesn’t meet consumer expectations, chargeback disputes that the seller is likely to lose because they have no stated policy to point to, and state consumer protection claims in states with mandatory disclosure requirements. The FTC’s Mail Order Rule also requires sellers to notify customers when orders cannot be shipped within the promised timeframe and to offer refunds in those situations.

Do online sellers need to collect sales tax?

Yes, in states where you have reached the economic nexus threshold — typically $100,000 in sales or 200 transactions per year in that state. Since South Dakota v. Wayfair (2018), physical presence in a state is not required to trigger sales tax collection obligations. If you have reached the nexus threshold in a state and are not collecting sales tax, you are accruing liability from the date nexus was first established.

Is my terms of service enough to cover my e-commerce legal requirements?

No. A general terms of service is not sufficient to satisfy the FTC’s clear and conspicuous disclosure standard for subscription terms, auto-renewal language, or material transaction conditions. Those disclosures must appear at the point of sale — at the checkout page, before billing information is entered, in close proximity to the purchase button. Disclosures that require the consumer to click a link to a terms of service page and then find the relevant provision within that document do not meet the standard for material terms.

If you’re selling online and your legal foundation consists of documents you copied from another website, generated with a free tool, or haven’t reviewed since you launched — the Legal Gap Consultation at Zova Law is the right starting point. In 30 minutes, I’ll surface exactly what your current e-commerce legal infrastructure is missing, what the enforcement risk of each gap is, and what compliant documents would need to say for your specific business and selling model. Book at legalgap.zovalaw.com.