TL;DR: New online sellers need a registered business structure, an EIN, sales tax or VAT collection setup, required website pages and policies, and a PCI-compliant payment process. Getting these foundations in place before your first sale protects your personal assets and keeps you on the right side of regulators.
Online seller legal and tax requirements are the first real challenge every founder faces once the excitement of picking products wears off. Ecommerce compliance covers registrations, permits, tax obligations, website disclosures, and payment security standards you must address before and after your first sale. This guide walks through each requirement in plain language so you can move fast without creating problems that take months to fix.
Online Seller Legal Foundation: Choosing the Right Business Structure
Most new online sellers should form an LLC before their first sale. State filing fees vary by jurisdiction, and an LLC creates a legal wall between your personal finances and business obligations, without heavy annual paperwork.
Starting as a sole proprietor is the fastest path. No formal registration is required in most states, business income flows directly onto your personal tax return, and you can get an EIN (Employer Identification Number) from the IRS in minutes. The tradeoff is unlimited personal liability: your home, savings, and other personal assets are exposed if a customer sues or a supplier dispute turns legal.
An LLC (Limited Liability Company) combines solid liability protection with pass-through taxation and low administrative burden. A corporation offers additional formal protections but brings heavier annual requirements and is rarely the right first move for a solo seller.
| Feature | Sole Proprietor | LLC | S-Corp |
|---|---|---|---|
| Personal liability | Unlimited | Limited | Limited |
| Tax filing | Schedule C | Pass-through | Separate return |
| Setup cost | Minimal | Varies by state | Higher |
| Best for | Testing an idea | Most small sellers | Growing businesses |
Online Seller Legal Registration: EIN, Licenses, and Permits
Getting an EIN, a general business license, and any product-specific permits are the three registration steps most new online sellers must complete. The EIN unlocks a business bank account and enables wholesale supplier relationships; the business license makes you legal in your locality; and permits keep specific product categories out of regulatory jeopardy.
An EIN is free and takes under ten minutes to obtain at IRS.gov. You need one even as a sole proprietor if you plan to hire help, open a dedicated business bank account, or work with wholesale suppliers who require a tax ID on file. It’s also the identifier you use when applying for state sales tax permits.
Most sellers need a general business license from their city or county, and those in regulated product categories face additional requirements. Food, dietary supplements, medical devices, alcohol, tobacco, and animal products each carry licensing rules at the state or federal level. The U.S. Consumer Product Safety Commission provides guidance for online sellers at cpsc.gov covering safety standards and recall obligations by product category. UK sellers must register with HMRC as a sole trader, partnership, or limited company, with notification required by 5 October following the first trading year.
Online Seller Legal Obligation: Sales Tax, VAT, and Nexus Rules
US online sellers owe sales tax in any state where they’ve established nexus. Since South Dakota v. Wayfair (2018), most states enforce economic nexus against remote sellers who have never physically entered the state, so you need to track thresholds before you open a warehouse.
Nexus comes in two forms. Physical nexus means you have a warehouse, employee, or office in a state. Economic nexus means you crossed that state’s revenue or transaction threshold. Most states set their economic nexus threshold at $100,000 in annual sales or 200 transactions in a calendar year, though a small number of states use different revenue cutoffs or omit the transaction count component entirely, so verify each state’s current rules as your sales grow. Once nexus is established, you must register for a sales tax permit, collect the correct rate on applicable orders, and file returns on schedule in that state.
Worth Knowing: Marketplace facilitator laws in most U.S. states require platforms like Amazon, Etsy, and Walmart Marketplace to collect and remit sales tax on your behalf for orders placed through those platforms. That coverage does not extend to your own website. Track nexus separately for your direct store, because orders placed there are always your responsibility.
For UK sellers, VAT registration is mandatory once taxable turnover crosses £90,000 in any rolling 12-month period, according to HMRC guidance. EU sellers and non-EU businesses shipping into the EU face their own VAT registration rules; the EU One Stop Shop (OSS) scheme simplifies multi-country filings for those who qualify. Under European Commission OSS VAT rules, EU-based sellers must charge the destination country’s VAT rate on cross-border B2C sales once annual intra-EU cross-border sales exceed EUR 10,000; below that threshold, domestic rates apply. Non-EU sellers shipping low-value goods under EUR 150 to EU buyers can use the Import One Stop Shop (IOSS) to collect VAT at checkout rather than at the border, per European Commission guidance. If you’re uncertain whether you’ve crossed a threshold, a consultation with an accountant who works with ecommerce businesses is worth the fee.
Online Seller Legal Must-Haves: Website Pages Every Store Needs
An ecommerce store must publish a privacy policy, terms and conditions of sale, a returns and refunds policy, and clear contact information before accepting its first order. These pages are the legal foundation of your store and protect you in disputes, chargebacks, and regulatory reviews.
A privacy policy is not optional if you collect any personal data, which includes email addresses, shipping details, and browsing behavior tracked by pixels. Under GDPR in the UK and EU, and under the California Consumer Privacy Act (CCPA) and similar U.S. state laws, you must disclose what data you collect, why you collect it, and how customers can request deletion. A cookie consent banner is required in the UK and EU if your site uses any non-essential cookies, including most analytics and advertising pixels. Use a consent management platform to log consent records, because you may be asked to produce them in a dispute or audit.
Terms and conditions define the contract between you and your buyer: payment terms, shipping timelines, return windows, dispute resolution, and liability limits. Your business name, registered address, and a working contact method must appear prominently in the footer and on a dedicated contact page. UK and EU law requires your VAT number on the site if you’re VAT-registered. Free policy generators produce workable first drafts, but have a lawyer review them before launch if you sell internationally or carry regulated products.
Pro tip from Ronen Abudi, e-commerce and GEO specialist (ronenabudi.com): Add a checkbox at checkout requiring buyers to confirm they have read your terms and conditions. That timestamp is your record of acceptance, which matters when contesting a chargeback or responding to a data complaint filed with a regulator.
Online Seller Legal Compliance: Payments, PCI, and Marketplace Rules
Payment Card Industry Data Security Standard (PCI DSS) compliance is required for any business that accepts card payments. Most small sellers meet it by routing transactions through a third-party processor that handles card data on its own certified infrastructure. Your processor will supply a PCI self-assessment questionnaire (SAQ) that documents your compliance level and identifies any controls you’re responsible for maintaining.
High-volume marketplace sellers face the INFORM Consumers Act, a U.S. federal law in effect since June 2023. According to FTC guidance, covered marketplaces must collect, verify, and disclose the identity of sellers completing 200 or more discrete sales totaling $5,000 or more on a single platform in a 12-month period. If you hit those thresholds on Amazon, Walmart, eBay, or similar platforms, expect identity verification requests and public disclosure of your business name and contact details. Knowing your full online seller legal compliance picture, from business registration and tax collection to website policies, payment security, and marketplace rules, lets you scale without surprises.
Online Seller Legal Quick Takeaways
- Register your business as an LLC or sole proprietor before your first sale and get a free EIN from IRS.gov, even if you have no employees yet.
- Track economic nexus thresholds state by state, because marketplace facilitator coverage does not extend to orders placed through your own website.
- Publish a privacy policy, terms and conditions, and a returns policy before opening your store, and add a cookie consent tool if you use analytics or ad pixels.
- Use a PCI-compliant payment processor and complete their annual self-assessment questionnaire to stay current on card payment compliance.
Online Seller Legal FAQ: 5 Common Questions Answered
- Do I need a business license to sell products online?
- Most online sellers need at least a general business license from their local city or county, plus any product-specific permits for regulated categories such as food, dietary supplements, or medical devices. Requirements vary by location and product type, so check with your municipality and your state’s business licensing office before you begin selling.
- What is economic nexus and how does it affect my sales tax obligations?
- Economic nexus is a legal connection to a state based on your sales volume or transaction count rather than a physical presence there. Most states set their threshold at $100,000 in annual sales or 200 transactions in a year. Once you cross a state’s threshold, you must register for a sales tax permit and collect and remit tax on applicable orders shipped there.
- What must a privacy policy for an ecommerce store include?
- An ecommerce privacy policy must identify who collects data, what data is collected, why it is collected, how it is used, who it is shared with, and how customers can request access or deletion. Sites serving UK or EU customers must meet GDPR standards, and sites with California customers must also address rights under the California Consumer Privacy Act (CCPA).
- What is the INFORM Consumers Act and does it apply to my marketplace sales?
- The INFORM Consumers Act is a U.S. federal law that requires covered online marketplaces to collect, verify, and publicly disclose identifying information about high-volume third-party sellers. It applies to sellers completing 200 or more discrete sales totaling $5,000 or more on a single covered platform in a 12-month period. If you meet those thresholds, your business name and contact details will be disclosed to buyers on that platform.
- When does a UK online seller need to register for VAT?
- A UK online seller must register for VAT when taxable turnover exceeds £90,000 in any rolling 12-month period, according to HMRC. Voluntary registration is also possible before reaching that threshold, for example to reclaim VAT on business purchases. Once registered, you must charge VAT on taxable sales and submit regular VAT returns to HMRC.
