Retail is increasingly moving online with a new set of challenges and rules to follow.
Office for National Statistics (ONS) data published in Retail sales, Great Britain: February 2025 bulletin, says that internet sales comprised 26.5% of all retail sales in the UK. And as online market expands, businesses are drawn to what they perceive as the lower cost of selling online.
But when selling online, business owners face similar risks to their ‘bricks and mortar’ counterparts as well as additional unique considerations.
Consumer protection
Consumer protection legislation, including the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights Act 2015, provides specific protections for consumers making use of online retailers.
These include the following:
- Consumers’ right to cancel: With some exceptions, consumers who have purchased goods online are provided with a cooling-off period of 14 days after delivery of these goods during which they can change their mind about the product, return it and still receive a full refund. This is in addition to the consumer’s right to reject defective or faulty goods. This means that online retailers need to manage their finances so that they are, in fact, able to refund a consumer where they exercise their rights in terms of this cooling-off period
- Description: A business must clearly set out the information listed in schedule two of the regulations in advance of a consumer purchasing a product online. The required information is extensive, and it’s there to make sure that the consumer knows exactly what they are buying, from whom, and what rights they have once they have bought the product. Examples of this information include a description of the product, the purchase price, and any additional delivery costs; the identity of the seller; the consumer’s cancellation rights; customer service details; and the retailer’s complaint procedures
- Remedies available: Just like their competitors who operate from physical premises, if the product is defective or faulty, not fit for purpose or damaged, consumers are entitled to cancel the sale within 30 days of receiving the goods and claim a refund (known as the short-term right to reject). Alternatively, within those 30 days, a consumer may require the retailer to repair or replace the product. Once the consumer receives the repaired or replaced item, they again have a statutory right to reject the goods, subject to different timelines (known as the final right to reject)
Where businesses do not comply with consumer legislation, they could, at best, face angry customers and reputational damage and, at worst, investigation and possible measures imposed by the regulator.
From a practical perspective, online retailers need to understand that they can’t just wash their hands of a sale once the money is in the bank, and it is this failure to make financial plans that sees many online retailers flounder.
Product safety
A retailer has a responsibility to its customers to ensure that the products it sells are safe and fit for purpose. The law places, amongst other things, the following obligations on retailers:
- Under the Consumer Protection Act 1987, businesses can be held liable for damage caused by a defective product. Consumers do not have to prove fault for strict liability to arise. Instead, they have to prove that the product was defective and that such a defect had caused damage
- Furthermore, the courts have held that businesses owe a duty of care to consumers to ensure that the products sold are safe and will not cause any harm. Liability arises when a business fails to meet the standard of care expected and such failure causes harm
A business found liable to have failed to comply with its product safety obligations could face compensation claims, in certain cases, legal costs and serious harm to its reputation.
Sales platforms and compliance obligations
When using existing online marketplace platforms to sell products, businesses must comply with the terms and conditions of that platform. These terms and conditions may change – often with very little notice – which may result in unforeseen costs or delays. What’s more, using an established platform doesn’t absolve businesses from being subject to data protection legislation. Depending on the structure of the selling arrangement, these retailers are almost certainly data controllers and/or data processors. Data protection legislation requires businesses to maintain a privacy policy, ensure the secure storage and processing of any data and provide and comply with data subject rights. Any failure to comply will result in, at the very least, fines and legal action by the Information Commissioner’s Office. The penalties for non-compliance are both civil and criminal – an extremely significant risk to businesses, their directors and management personnel.
New legislation
But beyond the legislation outlined above, the digital marketing landscape has and is undergoing significant changes in 2025, with new legislation impacting how businesses collect, process, and use personal data.
Key developments include the introduction of the Data (Use and Access) Act 2025 (DUA) and amendments to the Privacy and Electronic Communications Regulations (PECR). These changes aim to balance innovation with privacy, but they also introduce new compliance requirements for online businesses.
Data (Use and Access) Act
DUA, introduced in late 2024, makes targeted reforms to the data protection framework. While it retains the core principles of the UK GDPR, it introduces several notable changes, including:
- Recognised Legitimate Interests: The Act amends Article 6 of the GDPR to permit data controllers to rely on “recognised legitimate interests” for processing personal data without conducting a legitimate interest assessment. These include processing for direct marketing, intra-group data sharing for administrative purposes, and ensuring network and information security
- Expanded Special Category Data: The Secretary of State is empowered to introduce new types of special category data through secondary legislation, potentially including children’s data
- Enhanced Data Subject Rights: Privacy notices must now inform individuals of their right to lodge complaints, and there are provisions for more types of special category data
Privacy and Electronic Communications Regulations (PECR) Amendments
PECR has been amended to align its enforcement powers with those under GDPR. This means that breaches related to electronic marketing and cookie usage can now attract fines of up to £17.5m or 4% of global turnover, whichever is higher.
Increased Scrutiny on Online Tracking
Recently, the Information Commissioner’s Office (ICO) has intensified its focus on online tracking practices by extending its audit of cookie compliance to the UK’s top 1000 websites, emphasising the need for transparent and user-friendly consent mechanisms.
Summary
Retail can be an exciting and rewarding industry. There is so much room for innovation and ways to create happy customers who become walking advertisements for products. But like all aspects of business, careful consideration of any new legislation is important.