Running an online store involves more than listing products and processing payments. You also need to follow the e-commerce laws that govern how you advertise, sell, and handle customer information, and those rules depend on where your business operates and where your customers live. In 2026, the short answer is this: online businesses must comply with a growing patchwork of state privacy laws, federal rules on fake reviews and hidden fees, the CAN-SPAM Act, intellectual property law, a newly amended COPPA Rule, and state auto-renewal laws, and they must publish accurate website policies that match how they actually operate.
This guide focuses on what is new or changed for 2026. For a broader overview of the foundational rules, see our posts on e-commerce laws businesses must comply with and our e-commerce compliance checklist.
Data Protection and Privacy Laws
When customers place orders, they share their names, email addresses, delivery addresses, and payment details. Your business needs to keep that information secure and be clear about what it does with it.
California: CCPA Thresholds and New CPPA Regulations
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, California residents have rights to know, delete, and correct their personal information and to opt out of the sale or sharing of it. The CCPA applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above $26,625,000 (the inflation-adjusted figure effective January 1, 2025), buying, selling, or sharing the personal information of 100,000 or more California consumers or households, or earning 50 percent or more of annual revenue from selling or sharing personal information (Cal. Civ. Code § 1798.140(d)).
New regulations from the California Privacy Protection Agency took effect January 1, 2026. They phase in three obligations for covered businesses:
- Risk assessments. Required for certain higher-risk processing beginning January 1, 2026, with attestations and summaries due to the agency by April 1, 2028.
- Cybersecurity audits. Certifications are due April 1, 2028, 2029, or 2030, depending on the business’s annual revenue.
- Automated decisionmaking technology. Businesses that use automated tools to make significant decisions about consumers must comply beginning January 1, 2027.
Other State Privacy Laws
Roughly 20 states now have comprehensive consumer privacy laws in effect, and more have been enacted with later effective dates. Indiana, Kentucky, and Rhode Island all took effect January 1, 2026. Most apply based on how many state residents’ data you process, and thresholds differ, so map where your customers are and which laws reach you.
If you offer goods or services to customers in the European Union, the EU General Data Protection Regulation (GDPR) may also apply, even if your business is based elsewhere. Our privacy law team can help you sort out which regimes apply.
Consumer Protection and Advertising
Customers should know what they are buying and what they will pay. Section 5 of the FTC Act prohibits deceptive claims, misleading discounts, and inaccurate product descriptions, and if you advertise that a product has specific features, you need evidence to back up those claims. Several newer rules sharpen those obligations:
- Fake reviews. The FTC’s Consumer Reviews and Testimonials Rule (16 C.F.R. Part 465), effective October 21, 2024, bans fake or AI-generated reviews, buying positive or negative reviews, undisclosed insider reviews, and suppressing negative reviews. Knowing violations can bring civil penalties, and the FTC sent warning letters under the rule in December 2025.
- Hidden fees. The FTC’s Rule on Unfair or Deceptive Fees (16 C.F.R. Part 464), effective May 12, 2025, requires total price disclosure, but only for live-event tickets and short-term lodging. Outside those industries, drip pricing can still be challenged as deceptive, and California’s law against drip pricing (Cal. Civ. Code § 1770(a)(29)) applies to most businesses selling to California consumers.
- Subscriptions and auto-renewals. The FTC’s “click-to-cancel” amendments to its Negative Option Rule were vacated by the Eighth Circuit on July 8, 2025, before most of the rule took effect. The federal Restore Online Shoppers’ Confidence Act still requires clear disclosure, express consent, and a simple cancellation method, and California’s amended Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600 to 17606), which took effect July 1, 2025, requires online cancellation for subscriptions consumers can sign up for online.
Make sure your prices, shipping charges, product details, and refund terms are clear before checkout. For more on deceptive design, see our post on fake sales timers and dark patterns.
Email Marketing Rules
If you use email to promote your products, the federal CAN-SPAM Act sets rules for what those messages must include (15 U.S.C. § 7704).
- Header information and subject lines must be accurate and not misleading.
- Every marketing email must include a valid physical postal address and a clear way to opt out.
- You must honor opt-out requests within 10 business days,.
- Each separate email that violates the law can bring a civil penalty of up to $53,088. The FTC announced in September 2026 that it will keep its 2025 penalty levels in place for 2026.
Even if another company handles your campaigns, you remain responsible. The FTC states that you cannot contract away your legal responsibility to comply, and both the company whose product is promoted and the company that sends the message can be held liable. Our post on CAN-SPAM compliance covers the details.
Intellectual Property Rights
Your website may contain valuable intellectual property, including your business name, logo, product photos, and written content. You must respect others’ trademarks, copyrights, and patents. Do not copy another seller’s photos, designs, or branding without permission. Consider registering your brand with a trademark application so you can enforce it against copycats and on marketplaces.
Your business should also have the rights to use content created by employees, contractors, and suppliers. Work by an independent contractor generally belongs to the contractor unless a written agreement assigns it to you. A newer issue for 2026 is AI-generated content: the U.S. Copyright Office takes the position that material generated by AI without sufficient human creative control is not protected by copyright, so product descriptions or images produced entirely by AI tools may be difficult to protect against copying.
Children’s Privacy and COPPA
The Children’s Online Privacy Protection Act (COPPA) applies to websites and online services directed to children under 13, and to general audience services that have actual knowledge they collect personal information from children under 13. Covered businesses must post a children’s privacy notice and obtain verifiable parental consent before collecting a child’s personal information.
The FTC’s amended COPPA Rule was published April 22, 2025, took effect June 23, 2025, and required compliance by April 22, 2026. It is now fully enforceable. Key changes include:
- Separate verifiable parental consent before disclosing a child’s personal information to third parties, such as for targeted advertising.
- A written information security program for children’s personal information.
- A written data retention policy, published in your privacy notice, and limits on keeping children’s data longer than necessary.
- An expanded definition of personal information that now includes biometric identifiers.
Our COPPA compliance FAQ explains the rule in more depth.
Website Policies and Disclosures
Your website should explain the terms of the sale. Terms and conditions can cover orders, cancellations, and disputes. A return and refund policy should clearly state whether returns are accepted, applicable deadlines, exclusions, and how refunds work. Your privacy policy should explain what customer information you collect, how you use it, and how customers can exercise their rights under the state laws that apply to you.
Many businesses make the mistake of relying on generic policies downloaded from online templates. Those policies may not reflect how your business operates or the 2026 changes above. Tailor your policies, keep them easy to find, review them at least once a year, and make sure your actual practices match what your policies promise. California has specific rules about how refund policies must be disclosed; see our post on California e-commerce refund policy disclosure. For more on the rules that commonly trip up online sellers, read e-commerce laws you cannot afford to ignore.
Frequently Asked Questions
What e-commerce laws changed in 2026?
Key 2026 changes include new California privacy regulations on risk assessments, cybersecurity audits, and automated decisionmaking that took effect January 1, 2026; new comprehensive privacy laws in Indiana, Kentucky, and Rhode Island effective January 1, 2026; and the April 22, 2026 compliance deadline for the FTC’s amended COPPA Rule.
Does the FTC click-to-cancel rule apply to my subscription business?
No. The Eighth Circuit vacated the FTC’s click-to-cancel rule on July 8, 2025. However, the federal Restore Online Shoppers’ Confidence Act and state auto-renewal laws, including California’s amended law effective July 1, 2025, still require clear disclosures, consent, and easy cancellation.
Does the CCPA apply to my small online store?
It applies only if you do business in California and meet a threshold: more than $26,625,000 in annual gross revenue, buying, selling, or sharing personal information of 100,000 or more California consumers or households, or earning at least half your revenue from selling or sharing personal information. Other states have their own thresholds.
Am I responsible for CAN-SPAM violations if an agency sends my emails?
Yes. The FTC states that you cannot contract away your responsibility to comply. Each violating email can bring a penalty of up to $53,088.
Contact the E-Commerce and Compliance Attorneys at Revision Legal
For help reviewing your website policies, marketing practices, and privacy compliance, contact the experienced e-commerce attorneys at Revision Legal. You can contact us online or call (855) 473-8474.
This post is general information and is not legal advice.
