Which laws and regulations govern how you may operate an ecommerce business?

If you sell to consumers located in another state or another country, your ecommerce business will be subject to the laws and regulations of those other jurisdictions. Your customers may able to sue your business in a court in a distant state or nation and, as a result, force a change in your business practices, or even shut down your business there, based on regulations or rules of law far away from where your business is located. If your ecommerce business is based in the United States, you need to understand the US Federal laws that apply to your business, the state laws and regulations that may govern, and the laws and regulations of other jurisdictions that may apply to your business when you sell to consumers outside of your home state. U.S. Federal laws governing ecommerce businesses U.S. federal law is applicable to businesses located or doing business in the U.S., and is equally applicable to web-based enterprises. In addition, U.S.-based ecommerce businesses and non-U.S. businesses selling to U.S. customers need to keep an eye on compliance with U.S. federal laws and regulations that deal specifically with issues unique to web-based business. Some examples are: the CAN-SPAM Act, requiring labeling unsolicited emails and prohibiting deceptive subject lines and false headers (www.ftc.gov/bcp/online/pubs/buspubs/canspam.htm), the Children's On-Line Privacy Protection Act, which applies to websites that are directed to children under age 13 and requires certain privacy notices, parental consents, and other precautions (see www.ftc.gov./ogc/coppa1.htm), the Gramm-Leach-Bliley Act, dealing with web-based financial services (see http://banking.senate.gov/conf), and E-sign, concerning electronic signatures (see http://www.law.upenn.edu/bll/ulc/uecicta/uetast84.htm). State laws The laws of the state in which you are operating will be applicable to your ecommerce business, just as they are applicable to brick-and-mortar businesses operating in your state. Your business will also be subject to laws and regulations of states in which your customers reside. Individual states may have adopted their own regulations specifically addressing SPAM, electronic financial services, or the collection of data from website users. In California, for example, an anti-SPAM law became effective in 2004 and may impose additional restrictions and limitations on unsolicited email from California businesses. Likewise, in 2004, California adopted a privacy law that requires all commercial websites or online services that collects personal information on California residents through a website, to conspicuously post a privacy policy on the site and to comply with such privacy policy. The privacy policy must, among other things, identify the categories of personally identifiable information collected about site visitors and the categories of third parties with whom the operator may share the information. The failure to post a policy within 30 days of being notified of noncompliance, or knowingly and willfully or negligently and materially failing to comply with the provisions of the posted policy, violates the California statute. http://www.leginfo.ca.gov/cgi-bin/waisgate? WAISdocID=0382511002+0+0+0&WAISaction=retrieve See also the discussion of privacy policies on the web site of the Office of Privacy Protection of the California Department of Consumer Affairs: http://www.privacy.ca.gov/sheets/cis6english.htm. Laws of other jurisdictions Jurisdictions outside the United States have implemented regulations specifically governing how an ecommerce business may operate. European Union The European Union adopted privacy directives in late 2002 which govern the dissemination of unsolicited emails by businesses and individuals in Europe and the transfer of personally identifiable customer data pertaining to Europeans. Certain European countries have similar laws which apply locally. Canada Canadian federal and provincial law addresses the collection, use and disclosure of personal information by organizations in the course of commercial activities. Personal information is defined as identifiable information about an individual, except for business contact information and publicly available information (business-email addresses are treated as personal information). These laws require that personal information be collected, used and disclosed with consent, and they will impact any organization doing business in Canada. Canada’s Personal Information Protection and Electronic Documents Act known as PIPEDA and the substantially similar provincial laws require organizations to appoint a privacy officer, post a privacy policy which identifies the purposes for which personal information is collected, used and disclosed, implement a consent process for personal information and establish an access and compliance mechanism. Organizations must implement safeguards to protect personal information from unauthorized use and disclosure and make sure that all service providers agree to similar protections for personal information processed on behalf of the organization. Consent is often built into the privacy policy and is typically obtained at the time personal information is collected. Consent can be opt-out in nature where personal information is being collected and used for the purposes required in order to provide a product or service. In addition, consent can usually be opt-out for purposes of secondary marketing of related products and services. Organizations should be sure to have in place an easy to implement opt-out process where individuals can quickly have their names removed from any marketing databases. Where personal information is being used for other purposes or where sensitive personal information will be disclosed to third parties, consent should be opt-in (express).