What is an eCommerce website, and what privacy concerns apply?

Starting an eCommerce business is an exciting but often overwhelming process. From refining your business model to building your first website, there are many moving parts needed to kickstart your online business. One of the less riveting but crucial things you’ll need to check is which privacy laws you will need to comply with, which is largely based on how and where your business will be operated.

In this article, we’ll cover the different types of eCommerce business models and key considerations to include in your privacy policy.

What is eCommerce?

Electronic commerce (or “eCommerce”) refers to the buying and selling of products and services through the Internet. Some of the most common eCommerce business models are:

• Business-to-business (B2B): Where businesses sell goods and services to other business, such as wholesale companies.
• Business-to-consumer (B2C): Where businesses sell products and services to consumers, such as Amazon and Macy’s.
• Consumer-to-consumer (C2C): Where consumers sell directly to other consumers, such as on eBay and Depop.
• Consumer-to-business (C2B): Where consumers sell products and services to businesses, such as on freelancing platforms like Upwork.

The speed, savings, and increased access to multiple markets afforded by an eCommerce strategy has inspired many entrepreneurs to open their own online stores.

However, eCommerce is not without its own drawbacks. Hacking attempts, fraud, and malware are constant threats to your online business, and as you’ll be collecting and managing your customers’ personal data on a daily basis, you will need to ensure you comply with strict data privacy laws such as the General Data Protection Regulation (GDPR).

Privacy considerations for eCommerce websites

If you run an eCommerce business, there are a number of key privacy considerations to keep in mind when setting up your website.

1. Age restrictions

In some regions, the collection of personal information from minors via online services is heavily regulated.

For example, the Children’s Online Privacy Protection Act (COPPA) prohibits organisations from collecting or using the personal information of a child aged under 13 without their parents’ consent. If your business collects the information of a child based in the US, you will need to comply with COPPA and explain in your privacy policy what types of information is being collected; how it is collected, used, or shared with any third parties; and explain how parents can give consent on behalf of their child.

For more information about how to comply with COPPA, you can read the Federal Trade Commission’s detailed compliance guide.

2. Payment Card Industry Data Security Standards (PCI-DSS) compliance

The PCI-DSS is a set of global security guidelines that merchants (such as your eCommerce business) should comply with to keep all online transactions as secure as possible.

Most popular payment processing platforms like Stripe and PayPal are compliant with PCI-DSS. If you choose to use one of these third-party platforms, this must be disclosed in your privacy policy along with any other information specified in their Terms of Service.

3. Cookies and third-party data sharing

Most eCommerce platforms use cookies to remember user preferences, run retargeting campaigns, and support features such as shopping carts. Your website may also use analytics and other third-party tools and plugins, which rely on the collection and sharing of user data.

Under laws like the GDPR, you’ll need to disclose the types of cookies used on your website; which third parties you share data with; and the types of data being collected in your privacy policy.

To learn more, check out our earlier blog post about the privacy risks associated with third-party services.

4. Email marketing regulations

Email marketing is an essential tool for many eCommerce businesses. Emails are often used to send out deals and discounts, generate repeat business, and manage customer orders and queries. But while it’s a great channel for communication, it can border on unwanted spam for some people.

If your business collects emails for marketing purposes, you will need to disclose this in your privacy policy; give people the option to opt-out of your emails; and, depending on where you’re based, get explicit consent prior to sending someone an email. Check out our earlier blog post about how laws like CAN-SPAM and the GDPR could impact your email marketing.

5. Overall website security

As the eCommerce space becomes increasingly saturated, one of the key ways your business can stand out to your customers and survive in the long-term is by maintaining high standards of data privacy protection and security. Putting basic website security measures in place such as an SSL certificate, firewalls, password protection policy, and regularly updating plugins and other software are key to protecting your business from any cyberattacks.

By 2040, it’s estimated that 95% of purchases will be conducted via eCommerce; having a clear and easy to read privacy policy will give your customers peace of mind when choosing to shop and do business with you.

Does your eCommerce website have a privacy policy?

Kickstart your online business with a Privacy Policy and Terms of Service. Generate your eCommerce Privacy Policy now.