Setting up an online store has never been easier. A few hours on a platform such as Shopify, WooCommerce or Takealot’s marketplace and you can be taking orders. The legal side is less visible, but it matters just as much. South African law gives online shoppers specific rights, and requires online sellers to publish specific information, before a single order is placed.
Regulators are paying closer attention. In 2025 the National Consumer Commission and the Consumer Goods and Services Ombud issued an explanatory note on e-commerce platforms and e-vouchers, and in March 2026 they published a paper on consumer protection in e-commerce that proposes tightening the rules further. Separately, regulations under the Consumer Protection Act took effect on 15 April 2026 that require direct marketers to register with the National Consumer Commission and to clean their marketing lists against a national opt-out registry every month.
This article sets out the main legal requirements for South African online stores and a practical checklist for getting your website in order.
The laws that apply
Three statutes do most of the work:
- the Electronic Communications and Transactions Act 25 of 2002 (ECTA), which contains specific consumer protections for electronic transactions;
- the Consumer Protection Act 68 of 2008 (CPA), which applies to most sales to consumers, online or offline; and
- the Protection of Personal Information Act 4 of 2013 (POPIA), which governs how you collect and use customer data.
Where ECTA and the CPA both apply and cannot be read together, the CPA provides that the provision giving the consumer greater protection prevails.
What your website must disclose
Section 43(1) of ECTA requires a supplier selling goods or services online to make a long list of information available to consumers on its website. The main items are:
- your full name and legal status, and your registration number if you are a company;
- your physical address, telephone number, website address and email address;
- the physical address where you will accept service of legal documents;
- any self-regulatory or accreditation bodies you belong to, and any code of conduct you subscribe to;
- a sufficient description of the main characteristics of the goods or services;
- the full price, including transport costs, taxes and any other fees;
- the manner of payment, and your terms of agreement, including any guarantees;
- when the goods will be dispatched or delivered, or the services performed;
- your return, exchange and refund policy;
- any alternative dispute resolution code you subscribe to;
- your security procedures and privacy policy; and
- the consumer’s cooling-off rights under section 44.
The consumer must also be given an opportunity to review the entire transaction, correct any mistakes and withdraw before finally placing the order. Your payment system must be sufficiently secure, and you are liable for damage the consumer suffers because it is not. If you do not comply with these requirements, the consumer may cancel the transaction within 14 days of receiving the goods or services.
Cooling-off, delivery and refunds
Cooling-off. Under section 44 of ECTA, a consumer may cancel an online purchase of goods within seven days of receiving them, and of services within seven days of concluding the agreement, without giving a reason and without penalty. The only charge you may impose is the direct cost of returning the goods. Refunds must be made within 30 days of cancellation. Some transactions are excluded, such as goods made to the consumer’s specification, perishable goods, newspapers and certain accommodation, transport and leisure services.
Delivery. Unless the parties agree otherwise, section 46 requires you to perform within 30 days of receiving the order. If you cannot, the consumer may cancel on seven days’ written notice. If goods are unavailable, you must tell the consumer promptly and refund any payment within 30 days.
Defective goods. The CPA gives consumers a right to safe, good-quality goods. Under section 56, a consumer may return defective goods within six months of delivery and choose a repair, replacement or refund. The CPA also gives consumers the right to inspect goods on delivery and to reject goods that do not match what was ordered.
Pricing, marketing and promotions
The CPA prohibits misleading marketing and bait marketing, where a product is advertised at a price but is not reasonably available at that price. Negative option marketing, where a consumer is treated as agreeing unless they decline, is not allowed. Promotional competitions, loyalty programmes and gift vouchers have their own rules. For example, vouchers must generally be valid for at least three years.
Customer data and direct marketing
An online store collects names, addresses, phone numbers and payment details, so POPIA applies from the first sale. You need a privacy policy that explains what you collect and why, appropriate security safeguards and a process for dealing with breaches and requests. Your business also needs a registered information officer.
Marketing emails and messages are tightly regulated. Under section 69 of POPIA, you may send electronic direct marketing to non-customers only with their prior consent. Existing customers may be marketed similar products if you obtained their details in the context of a sale and gave them an opportunity to opt out, both at collection and in every message. The CPA regulations that took effect in April 2026 add a further layer for direct marketers: registration with the National Consumer Commission and monthly cleansing of marketing databases against the national opt-out registry.
Platforms and marketplaces
If you sell through a third-party marketplace, the platform’s terms will govern much of the relationship, but they do not remove your obligations to consumers. The regulators’ 2025 explanatory note takes the view that platforms also carry responsibility for ensuring that their sellers comply. Expect marketplaces to ask sellers for more information and stricter compliance as a result.
A practical checklist for your online store
- Publish your full business details, including your legal name, registration number and physical address, on your website.
- Show all-inclusive prices, with delivery charges clearly disclosed before checkout.
- Draft clear website terms and conditions, including delivery times, guarantees and dispute resolution.
- Publish a returns and refunds policy that reflects ECTA’s cooling-off right and the CPA’s six-month defective goods right.
- Build an order review step into your checkout so that customers can correct errors before paying.
- Use a secure, reputable payment gateway.
- Publish a POPIA-compliant privacy policy and register your information officer.
- Audit your marketing lists and consent records, and check whether you must register as a direct marketer.
- Review your terms at least once a year, and whenever the law changes.
How O’Reilly Law can help
We advise online retailers, marketplaces and e-commerce start-ups on ECTA, CPA and POPIA compliance. We draft website terms and conditions, returns and refunds policies, privacy policies and marketplace seller agreements, review checkout flows and marketing practices, and assist with consumer complaints and regulator enquiries.
Contact us to review your online store’s terms and compliance.
Related reading: Information officers under POPIA and PAIA · Software as a service (SaaS): key legal considerations
This article is general information and not legal advice. Correct as at October 2026.