Journey

Start selling online - retail compliance

A learning path for retailers adding an online sales channel. Covers the additional compliance obligations for distance selling, including cooling-off periods, website legal requirements, online data protection, accessibility, subscription rules, and handling complaints from online customers.

Retail & Consumer Goods Running a Business Updated 15 September 2026

6 milestones references 5 guides

What you will learn

Moving your retail business online brings new compliance obligations. This learning path covers:

The 14-day cooling-off period for distance sales
Legal information your website must display
Online data protection and marketing consent
Website accessibility under the Equality Act 2010
Subscription and auto-renewal rules
Online complaint handling and ADR obligations

This journey assumes you understand your general retail obligations under the Consumer Rights Act 2015.

Understand distance selling rules

When customers buy online or by phone, the Consumer Contracts Regulations 2013 give them additional rights beyond the Consumer Rights Act. The biggest difference from in-store selling is the 14-day cooling-off period - customers can return goods without giving a reason, even if they are not faulty.

The 14-day cooling-off period

Online customers can cancel within 14 days of receiving goods, then have a further 14 days to return them. This applies even if the goods are perfectly fine. Certain items are exempt, including perishables, sealed hygiene products, and personalised goods.

Cooling-off period

14 days from delivery

Extended period

12 months if cancellation rights not provided

Refund deadline

14 days from receiving returned goods

Return shipping

Customer pays unless seller offers free returns

Restocking fees

ILLEGAL - cannot charge

Deduction for use

Only if customer handled goods beyond checking

Digital content

Cancellation lost if download begins with consent

Distance selling and e-commerce

Comprehensive guidance on Consumer Contracts Regulations 2013 - cooling-off periods, pre-contract information requirements, delivery rules, and exceptions that apply to online and phone sales
Get your website legally compliant

Your website must display specific legal information before a customer places an order. The Electronic Commerce Regulations 2002 require your business name, address, email, and VAT number. The Consumer Contracts Regulations 2013 add pre-contract information including total price, delivery costs, and cancellation rights.

Pre-contract information for online sales

Before a customer commits to purchase, you must clearly display all mandatory information. This includes the total price, delivery charges, cancellation rights, and your complaint handling process. Failure to provide this information can extend the cooling-off period to up to 12 months.

Business identity

Trading name and legal name

Geographic address

Physical address (not just PO Box)

Contact details

Phone number and email address

Total price

Including VAT and all taxes

Delivery costs

Before checkout

Payment methods

Accepted payment types

Delivery timeframe

Estimated delivery date

Cancellation rights

14-day cooling-off period (or exemptions)

Complaint handling

How to complain

Contract duration

For subscriptions

Website legal requirements

What your e-commerce site must display - company details, pricing rules, terms and conditions, and the pre-contract information that must be provided before checkout

Take note

Unfair terms risk: Your website terms and conditions are subject to the unfair terms provisions of the Consumer Rights Act 2015. Terms that create a significant imbalance to the detriment of the consumer may be unenforceable. Have your T&Cs reviewed before launch.
Protect online customer data
Online selling means collecting more personal data than in-store - email addresses, delivery addresses, payment details, and browsing behaviour. UK GDPR applies with particular force to e-commerce. You also need to comply with PECR for email or SMS marketing.
Marketing consent under PECR

You cannot send marketing emails or texts without consent unless the 'soft opt-in' applies. Soft opt-in allows marketing to existing customers about similar products, but only if you gave them a simple way to opt out when collecting their details and in every subsequent message.
The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules for electronic marketing. Non-compliance is a common cause of ICO enforcement action, with fines now aligned with UK GDPR levels following the Data (Use and Access) Act 2025.

Email marketing (B2C)

Consent required unless soft opt-in applies

SMS/text marketing

Same rules as email - consent required unless soft opt-in applies

Email to corporate subscribers

Consent not required for companies, LLPs, or government bodies

Live telephone calls

Must screen against TPS/CTPS; cannot call if person has objected

Automated calls (robocalls)

Prior consent always required - no exceptions

TPS screening frequency

At least every 28 days

Legislation

Privacy and Electronic Communications Regulations 2003

Soft opt-in exception (4 conditions)

You can email existing customers without consent if ALL four conditions are met:

Contact details obtained during a sale or negotiations for a sale

Marketing is for YOUR similar products or services only

Opt-out opportunity given when details were collected

Easy opt-out provided in every subsequent message

Soft opt-in does NOT apply to: third-party marketing lists, details obtained outside sale context, or dissimilar products/services.

Electronic mail definition

Email, SMS, video messages, picture messages, voicemails, in-app messages, and direct messages over social media

Individual subscribers

Includes sole traders and ordinary partnerships (2-20 partners)

Corporate subscribers

Limited companies, LLPs, Scottish partnerships, government bodies

B2B email marketing

Consent rules do not apply to corporate subscribers - but respect objections

Telephone marketing requirements

Live calls: You can make live marketing calls without consent if the number is not on TPS/CTPS and the person has not objected to your calls. You must display caller ID and provide contact details if asked.

TPS/CTPS screening: Before making any marketing calls, screen your call list against both the Telephone Preference Service (TPS) and Corporate TPS (CTPS) registers. Screening must be done at least every 28 days.

Automated calls: Always require prior consent. General marketing consent is not sufficient - you need specific consent for automated calls.

Claims management cold calls

Banned without prior consent (since September 2018)

Pension cold calls

Banned except for FCA-authorised firms with existing relationship (since January 2019)

Fax marketing to individuals

Consent required; must screen against FPS

Fax marketing to businesses

No consent required but must screen against FPS and respect objections

Required information in marketing communications

Sender identity must not be disguised or concealed

Valid contact address for opt-out requests must be provided

Simple and effective unsubscribe mechanism in every message
Data protection for retail businesses

How UK GDPR applies to retail - collecting customer data, processing payments securely, handling marketing consent, and your obligations as a data controller
Cookie consent on your website

Your website must inform visitors about cookies and obtain consent for non-essential cookies before they are set. Analytics, advertising, and personalisation cookies all require consent. Only strictly necessary cookies (basket, login) are exempt.
The Privacy and Electronic Communications Regulations 2003 (PECR) require consent before setting non-essential cookies.

Consent requirements:

Clear and comprehensive information about cookies

Genuine choice - no "cookie walls" forcing acceptance

Easy to withdraw consent

No pre-ticked boxes

Exempt cookies:

Strictly necessary for the service (e.g., shopping cart)

Enabling user-requested functionality

Analytics cookies, advertising cookies, and social media cookies require consent.
Make your online store accessible

The Equality Act 2010 requires reasonable adjustments for disabled customers. For online retail, this means your website must be accessible to people using screen readers, keyboard navigation, and assistive technologies. WCAG 2.2 Level AA is the recognised standard.

Website accessibility requirements

Your website should meet WCAG 2.2 Level AA as a minimum. This covers text alternatives for images, keyboard navigation, sufficient colour contrast, and clear form labels. Accessibility audits can identify gaps before they become complaints or legal challenges.

Your website must be accessible to disabled users under the Equality Act 2010.

Standard

Web Content Accessibility Guidelines (WCAG) 2.2 level AA — the accepted benchmark for the anticipatory reasonable-adjustments duty, not a statutory standard for private businesses

Images

Provide alternative text

Navigation

Ensure keyboard navigation works

Visual contrast

Use sufficient colour contrast

Documentation

Publish an accessibility statement (good practice — a statutory requirement only for public-sector bodies)

Equality and accessibility for retail

Your obligations under the Equality Act 2010 for online retail, including website accessibility standards, reasonable adjustments, and how to audit your site for compliance
Prepare for subscription rules
If you offer subscription boxes, auto-renewing memberships, or recurring deliveries, the DMCC Act 2024 will require clear subscription terms, renewal reminders, and a cancellation process as simple as signing up once its subscription provisions commence.
Subscription contract requirements

When the subscription provisions commence, the DMCC Act 2024 will require businesses to send renewal reminders, provide easy online cancellation, and honour a cooling-off right on relevant renewals (post-trial conversions and 12-month-plus commitments). These rules will apply to subscription boxes, recurring orders, auto-renewing memberships, and digital services.
Provide clear pre-contract subscription information

Before the customer commits, clearly state the subscription terms including price, billing frequency, minimum commitment period, and what happens at the end of any initial term.

Plan renewal reminders before renewals and price increases

When the rules commence you will need to notify customers before their subscription renews or before any price increase takes effect, giving sufficient notice for the customer to cancel if they wish.

Design a simple cancellation mechanism

Under the incoming rules cancellation must be as easy as signing up. If customers can subscribe online, they will need to be able to cancel online through a straightforward process — not phone calls or complex steps that make cancellation harder than sign-up.

Prepare for the renewal cooling-off right

When the rules commence, customers will have a cooling-off right on 'relevant renewals' — broadly the first renewal after a free or discounted trial, and renewals committing them to 12 months or more — not on every routine monthly renewal.

Review all recurring payment contracts for compliance

These rules apply to subscription boxes, recurring orders, auto-renewing memberships, digital services, and magazine subscriptions. Audit all recurring payment contracts against these requirements.

The Digital Markets, Competition and Consumers Act 2024 (Part 4, Chapter 2) introduces new rules for subscription contracts. These provisions are not yet in force — the government has indicated commencement in Spring 2027, following implementing regulations and with a transition period for existing contracts. Businesses operating subscription models should prepare now so they can comply when the provisions commence.
Subscription and auto-renewal compliance

DMCC Act 2024 subscription rules - pre-contract information, renewal reminders, easy cancellation requirements, and how to audit your recurring payment contracts

Guv’s take

Coming into force: The DMCC Act 2024 subscription provisions are not yet in force — the government has indicated commencement in Spring 2027, following implementing regulations and with a transition period. If you already operate a subscription model, prepare now so you are ready when the rules take effect.
Handle online complaints and disputes
Online traders have specific ADR obligations beyond in-store complaint handling. You must inform customers about a certified ADR provider, whether or not you use ADR yourself. For unresolved complaints, you must signpost consumers to your ADR provider.
ADR obligations for online traders

All online traders must inform customers about ADR. If you commit to using ADR, you must use a certified provider. Even if you do not commit to ADR, you must still tell customers about a relevant certified provider when a complaint cannot be resolved.
Establish an internal complaints procedure

Set up a clear, accessible process for customers to raise complaints. CMA expects all businesses to have an internal complaints process before escalation to external bodies.

Identify an accredited ADR provider

Find an ADR provider accredited under the DMCC Act 2024 regime that is relevant to your sector. From 6 April 2026 the DMCC Act's accreditation framework replaced the ADR Regulations 2015 — consumer ADR providers must be accredited (or exempt) under the new regime.

Signpost consumers to ADR when a complaint is unresolved

When you cannot resolve a complaint through your internal procedure, tell the consumer about an accredited ADR provider they can use and whether you are willing or required to take part, following the ADR information requirements in force from 6 April 2026. Using ADR remains voluntary for most retailers unless a scheme or sector rule requires it.

Respond to complaints within a reasonable timeframe

Acknowledge complaints promptly and aim to resolve within 8 weeks. If unresolved, direct the customer to your ADR provider. The DMCC Act 2024 strengthens CMA expectations around complaints handling.
Handle customer complaints and disputes

Your obligations around complaint handling, the accredited ADR provider requirements in force from April 2026, and how to set up an effective complaints process for online sales

Guv’s take

You have completed this learning path. You now understand the additional compliance obligations for selling online. Remember that these requirements apply alongside your existing in-store obligations, not instead of them.

Related journeys

VAT compliance for retailers

If you are VAT-registered, understand the specific VAT rules for retail including pricing, retail schemes, and Making Tax Digital

Run a retail business

Comprehensive ongoing compliance for established retailers - trading standards, consumer rights, premises, and staff obligations

Start selling online - retail compliance

What you will learn

Understand distance selling rules

Get your website legally compliant

Protect online customer data

Make your online store accessible

Prepare for subscription rules

Handle online complaints and disputes

Related journeys

Related journeys

Start a retail business - compliance essentials

Respond to a Trading Standards investigation

Run a retail business

Start a retail business