E-commerce: the numbers, the rules, the AI picture.

• FTC Rule on Consumer Reviews and Testimonials (16 CFR Part 465)

  In effect since October 21, 2024, the rule bans writing or selling fake reviews and testimonials, buying or offering incentives conditioned on a particular sentiment, undisclosed insider reviews, company-controlled sites posing as independent review sites, review suppression through intimidation or unfounded legal threats, and buying fake social media indicators. Courts can impose civil penalties for knowing violations.

  What it means: Never write, buy or edit reviews. You can ask every customer for a review, but you cannot reward only positive ones or filter who gets the request by expected sentiment. Disclose employee and family reviews, do not threaten reviewers and do not hide honest negatives. Check your review app does not suppress low ratings.

  [9] ftc.gov

• FTC Endorsement Guides (16 CFR Part 255)

  Endorsements must reflect the honest opinion of the endorser. Material connections, such as payment, free products or affiliate commissions, must be disclosed clearly and conspicuously, near the claim and not buried in a hashtag cluster or a hyperlink. Advertisers are responsible for monitoring the influencers and agencies they use.

  What it means: Give every influencer and affiliate written rules and a required disclosure wording. Free products count as a connection. Review posts before they go live, keep a record and do not let creators make claims you could not make yourself.

  [10] ftc.gov

• FTC Made in USA Labeling Rule (16 CFR Part 323)

  An unqualified Made in USA claim requires that final assembly or processing occurs in the US, all significant processing occurs in the US and all or virtually all components are made and sourced in the US. Marketers need competent and reliable evidence. Qualified claims, such as the percentage of US content, must also be truthful. The 2021 rule lets the FTC seek civil penalties for false labels, including in online catalogs.

  What it means: Audit every product page, ad and marketplace listing that says Made in USA, American-made or Crafted in the USA. Use qualified wording such as Made in USA with imported components when you cannot meet the standard, and keep your supplier evidence on file.

  [11] ftc.gov

• FTC Mail, Internet or Telephone Order Merchandise Rule (16 CFR Part 435)

  Before advertising a shipping time, a seller must have a reasonable basis for expecting to ship on time. If you state no time, you must ship within 30 days. If you cannot ship on time, you must promptly offer the buyer the choice to consent to a delay or cancel for a refund, and refunds are generally due within seven working days, to the original form of payment. You must keep records.

  What it means: Do not promise fast shipping you cannot meet, especially in a sale or holiday peak. Build delay notices into your order emails, offer a clear cancel option and refund to the original payment method, not store credit, when the rule requires it.

  [12] ftc.gov

• FTC Rule on Unfair or Deceptive Fees (16 CFR Part 464) and the UK DMCC Act drip pricing ban

  In the US, the FTC rule took effect on May 12, 2025 but covers only live-event tickets and short-term lodging, so it does not apply to ordinary product stores. Hidden fees remain a deception risk under the FTC Act, though. In the UK, the CMA says it is prohibited to show a headline price and then add mandatory charges, and invitations to purchase must state the total price including mandatory fees, taxes and charges from 6 April 2025.

  What it means: For a US store, show shipping, handling and any mandatory fee before the final step as good practice and a conversion lever. For UK customers, put mandatory delivery or service charges into the displayed price or total, and do not use mandatory add-on fees after the shopper has committed.

  [13] ftc.gov

• Subscriptions and recurring billing: ROSCA and the FTC Negative Option Rule

  The Restore Online Shoppers' Confidence Act requires disclosure of material terms and express informed consent before charging in certain online transactions. The FTC finalized a Click-to-Cancel rule in October 2024, but its Negative Option Rule page now shows a February 2026 revision to conform to federal court decisions and a March 2026 advance notice on cancellation. Do not rely on the Click-to-Cancel text as current law.

  What it means: Even where the rule is unsettled, make the trial, price, renewal date and cancellation path obvious, take explicit consent at checkout and let customers cancel the way they signed up. Have counsel review any subscription offer, auto-ship, free trial or membership.

  [14] ftc.gov

• CAN-SPAM, Gmail and Yahoo bulk sender rules, UK PECR and Canada CASL

  CAN-SPAM applies to commercial email, including B2B: accurate headers and subject lines, a clear ad disclosure, a valid postal address, an opt-out honored within 10 business days, and penalties of up to $53,088 per email. Google adds that bulk senders of more than 5,000 messages a day to Gmail need SPF, DKIM and DMARC, one-click unsubscribe and a spam rate below 0.30%. UK PECR requires prior consent for non-essential cookies and tracking, and Canada's CASL generally bars commercial electronic messages, including texts, without consent, with penalties up to $10 million for businesses.

  What it means: Use double opt-in or clear checkbox consent for email and SMS, keep a consent log and honor unsubscribes immediately. Authenticate your sending domain. For UK and EU visitors, load marketing pixels only after consent, and never use pre-ticked boxes. For Canadian customers, get express consent before marketing texts.

  [15] ftc.gov

• Privacy: CCPA/CPRA and other state laws, UK/EU GDPR and PECR

  California applies to for-profit businesses that exceed $25 million in annual revenue, buy, sell or share the data of 100,000 or more residents or households, or earn 50% of revenue from selling or sharing personal data. Covered businesses must give notice at collection, honor opt-outs of sale or sharing (including a Global Privacy Control signal), and answer requests within 45 days. Many other US states have their own laws with different thresholds, and UK and EU visitors trigger GDPR and cookie consent rules.

  What it means: A $2 million store may fall under a state law through resident counts or data sharing, even if California does not apply. Publish an accurate privacy policy, honor opt-outs, review what your ad pixels share and use a consent banner for UK and EU traffic. Have counsel confirm which state laws apply to you.

  [16] oag.ca.gov

General information, not legal advice. Consumer, privacy, tax and accessibility rules change and differ by state and country. Confirm the current rules with the FTC, your state attorney general, the CMA and the ICO, or a lawyer, before you rely on any of this.