International ecommerce compliance: a country-by-country regulatory matrix

An ecommerce store that sells to customers in five countries operates under five overlapping regulatory frameworks. Accessibility requirements, privacy laws, payment security standards and AI regulations apply based on where your customers are located, where your business is based and sometimes both.

This guide maps the regulatory requirements for the five largest ecommerce markets: the United States, the European Union, the United Kingdom, Canada and Australia. For each market, we cover the key regulations, what they require and how enforcement works.

How to determine which regulations apply to you

Before the market-by-market breakdown, the key principle: most privacy regulations apply based on where your customers are, not where your business is registered. Accessibility regulations apply where you do business and often where you have physical presence or customers. PCI DSS applies globally to any merchant accepting card payments.

• GDPR applies if you have EU customers or EU personal data. It does not matter where your company is registered. If a customer in France buys from your US-registered store, GDPR applies to that transaction.
• CCPA applies if you meet the thresholds and have California customers. Revenue over $25M, or processing data of 100,000+ California consumers, or deriving 50%+ of revenue from selling California consumer data.
• ADA applies to US businesses with a physical presence or US customers. Courts are divided on whether ADA applies to foreign businesses with no US presence but US customers. If you have a US entity, domain or payment processing, ADA exposure is real.
• PCI DSS applies to any merchant accepting Visa, Mastercard, Amex or Discover. Global scope, no exceptions.

United States

Accessibility: ADA Title III

The Americans with Disabilities Act does not explicitly reference websites, but federal courts have consistently ruled that ecommerce sites constitute "places of public accommodation" under Title III. The standard courts reference is WCAG 2.1 Level AA, which was formalized as the DOJ's reference standard in 2024.

Enforcement is primarily through private litigation. 3,117 federal ADA web accessibility complaints were filed in 2025, up 27% year-over-year. Ecommerce stores are the most targeted sector. Settlements typically range from $5,000 to $25,000; fully litigated cases can reach $100,000+.

State accessibility laws add complexity. California's Unruh Civil Rights Act applies to websites and allows for $4,000 statutory damages per violation per visit. This is separate from ADA and can be brought in state court without the procedural requirements of federal ADA litigation.

Privacy: patchwork of state laws

The US has no federal consumer privacy law. Instead, 19 states have enacted comprehensive privacy laws as of 2026. The most significant for ecommerce:

• California (CCPA/CPRA): the strongest. Right to know, right to delete, right to opt-out of sale, right to correct, right to limit sensitive data use. Enforcement by the California Privacy Protection Agency. Fines up to $7,500 per intentional violation.
• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA). Similar frameworks to CCPA with variations in thresholds, rights and enforcement mechanisms. If you are CCPA-compliant, you are mostly compliant with these laws, but each has specific differences.
• Washington (My Health MY Data Act). Specifically covers health data. Relevant for ecommerce stores selling health or wellness products that infer health information from purchases.

The practical approach: achieve CCPA/CPRA compliance as your baseline. Review the specific requirements of each state where you have significant customer concentration. Honor Global Privacy Control (GPC) signals, which are legally required by CCPA and increasingly required by other state laws.

PCI DSS: global but US-headquartered

PCI DSS is a card network standard, not a government regulation, but it is enforced through contractual obligations with your acquiring bank. Requirements 6.4.3 and 11.6.1, which became mandatory in March 2025, are particularly important for ecommerce stores. See our full guide on PCI DSS 4.0 for ecommerce.

FTC regulations

The FTC Act's Section 5 prohibition on "unfair or deceptive acts or practices" applies broadly to ecommerce. Recent FTC actions relevant to ecommerce: fake reviews and testimonials, undisclosed AI-generated content, negative option subscription practices (making it hard to cancel) and dark patterns in checkout flows. FTC civil penalties can reach $50,120 per violation.

European Union

Accessibility: European Accessibility Act (EAA)

The EAA became enforceable in June 2025. It requires ecommerce services provided to EU consumers to meet EN 301 549, the European accessibility standard that incorporates WCAG 2.1 Level AA.

The EAA applies to "microenterprises" (fewer than 10 employees AND less than €2M revenue) with an exemption. Mid-market stores are not microenterprises. They must comply.

Enforcement is through national market surveillance authorities. Germany's BMAS, France's ARCOM and the Netherlands' Rijksoverheid have signaled active enforcement. Penalties vary by member state but can reach 4% of annual revenue in the most serious cases. Member states may also allow private enforcement.

Privacy: GDPR

GDPR is the most comprehensive privacy regulation affecting global ecommerce. Key requirements for stores with EU customers:

• Lawful basis for processing. You must have a lawful basis (consent, legitimate interest, contract performance or legal obligation) for each type of data processing. For marketing, consent is typically required.
• Cookie consent. Non-essential cookies require explicit opt-in consent before they are set. No pre-ticked boxes. Rejecting must be as easy as accepting. Consent records must be maintained.
• Data subject rights. Access, rectification, erasure, portability, restriction and objection. 30-day response time for access requests.
• Data transfers. Personal data cannot be transferred outside the EU/EEA without adequate safeguards (Standard Contractual Clauses, Binding Corporate Rules or adequacy decision). US transfers rely on the EU-US Data Privacy Framework since 2023. See our guide on cross-border data transfers for ecommerce for implementation details.
• Record of Processing Activities (ROPA). Organisations with 250+ employees must maintain a ROPA. Smaller organisations processing risk data or processing regularly must also maintain one.

GDPR fines: up to €20M or 4% of global annual turnover for the most serious violations. EU regulators issued €2.1B in GDPR fines in 2025.

AI Act

The EU AI Act is phased in between 2024 and 2027. Limited-risk transparency obligations (chatbot labels, AI content labels) apply from August 2026. High-risk system obligations apply from August 2027. Penalties reach €35M or 7% of global turnover for the most serious violations.

Digital Services Act (DSA)

The DSA applies to online marketplaces and platforms. For most single-brand ecommerce stores, the DSA is less relevant. But stores that host third-party sellers or operate as marketplaces have significant DSA obligations: trader verification, product safety monitoring and transparency reports for recommender systems.

United Kingdom

Accessibility: Equality Act 2010

The UK Equality Act requires businesses to make "reasonable adjustments" to ensure disabled people are not placed at a substantial disadvantage. For ecommerce, this means WCAG 2.1 AA compliance is the practical standard, consistent with the UK Government's Web Content Accessibility Guidelines adopted for public sector sites.

Enforcement in the UK is through the Equality and Human Rights Commission (EHRC) and through private discrimination claims. UK courts have been less active on web accessibility than US courts, but EHRC has power to conduct investigations and issue compliance notices.

Privacy: UK GDPR and PECR

After Brexit, the UK retained GDPR in domestic law as UK GDPR. It is substantively identical to EU GDPR for ecommerce purposes, with the ICO (Information Commissioner's Office) as the enforcement authority. The ICO can issue fines up to £17.5M or 4% of global annual turnover.

PECR (Privacy and Electronic Communications Regulations) governs cookies and electronic marketing. The cookie consent requirement under PECR mirrors the EU ePrivacy Directive: explicit consent required for non-essential cookies.

The UK adequacy decision from the EU means EU-UK data transfers are currently unrestricted. This may change if UK data protection law diverges from EU GDPR.

Online Safety Act

The Online Safety Act 2023 applies primarily to user-to-user services and search engines. Most ecommerce stores are not in scope. Exceptions: stores that host user reviews with no moderation, or stores with significant marketplace functionality where third-party sellers post content.

Canada

Accessibility: AODA and ACA

Canada has two relevant accessibility frameworks:

• AODA (Accessibility for Ontarians with Disabilities Act). Applies to organizations doing business in Ontario. The IASR (Integrated Accessibility Standards Regulation) requires websites to meet WCAG 2.0 Level AA for organizations with 50+ employees (the threshold for compliance obligations increased). Enforcement is through the Accessibility Directorate of Ontario.
• ACA (Accessibility Canada Act). Federal accessibility law. Applies to federally regulated sectors (banks, airlines, telecommunications) rather than ecommerce stores directly. But the ACA created the Accessible Canada Directorate, which issues guidance that influences accessibility expectations broadly.

For ecommerce, AODA is the primary legal obligation for stores with Ontario customers and 50+ employees. WCAG 2.0 AA (not 2.1 AA) is the AODA standard, though 2.1 AA is best practice.

Privacy: PIPEDA and Quebec Law 25

PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal private sector privacy law. It applies to organizations that collect, use or disclose personal information in the course of commercial activity. Key requirements: consent, access rights, accuracy and safeguards.

Quebec's Law 25 (Bill 64) is significantly more stringent than PIPEDA and mirrors GDPR in several respects. It requires: privacy impact assessments for high-risk processing, explicit consent for sensitive data, breach notification obligations, right to data portability and right to erasure. Law 25 applies to any organization that processes Quebec residents' personal data.

Fines under Law 25 can reach CAD $25M or 4% of worldwide turnover. The Commission d'accès à l'information is the enforcement authority.

Canada's Anti-Spam Legislation (CASL)

CASL governs commercial electronic messages sent to Canadian recipients. It requires express consent for marketing emails (implied consent has limited scope), identification of the sender and an easy unsubscribe mechanism. Fines can reach CAD $10M per violation. CASL is more stringent than CAN-SPAM (US) and requires positive opt-in rather than opt-out.

Australia

Accessibility: Disability Discrimination Act (DDA)

The DDA prohibits discrimination against people with disabilities. The Australian Human Rights Commission's guidance references WCAG 2.1 AA as the standard for website accessibility. Enforcement is through complaints to the Human Rights Commission, which can lead to conciliation, then to the Federal Court.

Australian web accessibility litigation has been less frequent than US ADA litigation, but the legal framework is in place. The 2000 Maguire v SOCOG case (Sydney Olympics website) established that website accessibility is covered by the DDA. Australian businesses should treat WCAG 2.1 AA compliance as the practical standard.

Privacy: Privacy Act 1988 and the 2024 reforms

The Australian Privacy Act was significantly amended through the Privacy and Other Legislation Amendment Act 2024. Key changes relevant to ecommerce:

• New right to erasure. Consumers can request deletion of their personal data. Previously, Australian privacy law did not include a right to erasure.
• Expanded consent requirements. The reforms strengthen consent requirements for sensitive information collection.
• Statutory tort for serious invasions of privacy. A new civil cause of action for serious invasions of privacy. This creates direct private litigation risk.
• Increased penalties. Maximum penalty increased to AUD $50M or three times the benefit obtained, or 30% of adjusted turnover, whichever is greatest.

The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act.

Minimum viable compliance for international stores

For a store selling to all five markets, the minimum viable compliance program:

• WCAG 2.1 AA accessibility. This satisfies accessibility requirements across all five markets (AODA requires 2.0 AA, but 2.1 AA is backward compatible). One accessibility standard covers all markets.
• GDPR-level privacy compliance. GDPR is the most stringent framework. A GDPR-compliant privacy program satisfies UK GDPR, Quebec Law 25, and exceeds the requirements of PIPEDA, CCPA and the Australian Privacy Act for most processing activities. GDPR compliance is a reasonable global baseline.
• CCPA-specific additions. GDPR compliance does not fully cover CCPA. Specifically: honoring Global Privacy Control signals, providing a "Do Not Sell My Personal Information" link if applicable and meeting CCPA's opt-out (not opt-in) consent model for California.
• CASL-compliant email marketing. Express opt-in for Canadian recipients. If you have a Canadian audience, CASL compliance requires a separate consent track from your US email list.
• PCI DSS compliance. Global. One program covers all markets.

Prioritization framework: which markets and regulations first

For a store newly approaching international compliance, prioritization by risk-adjusted impact:

• Priority 1: ADA accessibility (US) and GDPR privacy (EU). Highest litigation/enforcement risk. Largest potential fines. Most active enforcement environments. If you have US and EU customers, these two are your immediate priority.
• Priority 2: PCI DSS 4.0. Mandatory for any card-accepting store globally. Requirements 6.4.3 and 11.6.1 are already mandatory. No exemptions.
• Priority 3: CCPA (California) and UK GDPR. CCPA is increasingly enforced and the CPPA is active. UK GDPR mirrors EU GDPR but has separate enforcement. If you have significant California or UK customers, these move to priority 2.
• Priority 4: EAA (EU accessibility), AODA (Canada), Quebec Law 25. Active and enforced, but narrower scope than ADA and GDPR.
• Priority 5: Australian Privacy Act, DDA, CASL. Real obligations, but enforcement frequency and penalty severity are currently lower than the markets above. Do not ignore these, but address them after higher-priority compliance is in place.

The order of priority will shift based on your specific revenue mix. A store with 40% of revenue from Australia should treat Australian compliance as priority 2, not priority 5. For brands running multiple storefronts across regions, our guide on multi-store compliance management covers how to coordinate compliance across properties.

Key differences that catch stores off guard

The most common compliance failures in international ecommerce stores:

• US opt-out consent on EU traffic. A store that implements a CCPA-style opt-out banner for all users is violating GDPR for EU users. EU users need opt-in consent, not opt-out. This requires geolocation-based consent management that shows different consent UIs to EU and US users.
• CASL compliance assumed from CAN-SPAM compliance. US stores compliant with CAN-SPAM (which allows opt-out) are not CASL-compliant. Canadian recipients require express opt-in consent before the first commercial message.
• UK assumed covered by EU GDPR program. Post-Brexit, UK GDPR is separate from EU GDPR. Your EU DPA with a service provider does not automatically cover UK data processing. UK data transfers require UK-specific Standard Contractual Clauses or the UK's International Data Transfer Agreement.
• Accessibility compliance assumed global from ADA work. ADA compliance protects you from US litigation. It does not satisfy EAA requirements for EU customers or AODA requirements for Canadian customers. The technical standard is the same (WCAG 2.1 AA), but the enforcement mechanism and documentation requirements differ.

Frequently asked questions

Which regulations apply if I sell to customers in multiple countries?

Most privacy regulations apply based on where your customers are located, not where your business is registered. GDPR applies if you have EU customers. CCPA applies if you meet thresholds with California customers. PCI DSS applies globally to any card-accepting merchant.

What is the minimum viable compliance for international ecommerce?

WCAG 2.1 AA accessibility covers all major markets. GDPR-level privacy compliance satisfies most frameworks. Add CCPA-specific opt-out mechanisms for California, CASL express opt-in for Canada and PCI DSS for global card acceptance.

Does ADA compliance cover EU accessibility requirements?

The technical standard is the same (WCAG 2.1 AA), but enforcement mechanisms and documentation requirements differ. ADA compliance protects you from US litigation but does not satisfy EAA requirements for EU customers.