Compliance & Regulatory

Why This Section Exists

Most DTC founders come from marketing or product backgrounds. Compliance is the thing you assume you'll figure out later. Then later arrives as a cease-and-desist letter, a marketplace listing suspension, or a recall notice.

Get it right upfront and it typically costs $2K-$20K depending on category (testing and certification - IP protection like trademarks and patents is extra, covered below). Get it wrong and it's $50K-$500K+ in recalls, fines, legal fees, and brand damage, usually arriving at the worst possible moment. This section won't make you a regulatory expert. It will tell you what to ask about, what you can't ignore, and when to pay for help. Practical guidance, not legal advice. This section is the product-and-market-facing half of the legal picture: what you can sell, label, claim and say, how you protect your IP, and the consumer-protection and data-privacy rules around it. The corporate and structural half - entity, equity, founder agreements, contracts and governance - is Section 30: Legal & Corporate Foundations.

What's required depends heavily on your category. An accessories brand has minimal regulatory burden. A supplements brand operates in one of the most regulated consumer product spaces. Know where your category sits and invest accordingly. And if you're early stage, accept that you'll never dot every i and cross every t. Don't do everything compliance could possibly demand, and don't let it stop you from shipping either.

Start with the category table below: find your product and see what actually applies to you. The acronym reference lives at the end of this section - use it when you need it.

Product Compliance by Category

Claims & Advertising Compliance

What you say about your product matters legally, not just commercially. Every claim you make in ads, on your website, in emails, or through influencers is subject to advertising standards and consumer law.

The difference between puffery and claims:

• Puffery (generally fine): "We make the best coffee." "You'll love how this feels." Subjective opinions that no reasonable consumer would take as literal fact.
• Claims (must be substantiated): "Clinically proven to reduce wrinkles by 40%." "Dermatologist recommended." "Organic." These are specific, measurable, or verifiable statements that require evidence.

Common traps that get brands in trouble:

• "All natural" - Has no legal definition in most jurisdictions. If your product contains any synthetic ingredients, this claim is defensible grounds for a complaint.
• "Chemical free" - Everything is a chemical. This claim is scientifically meaningless and increasingly flagged by regulators.
• "Clinically tested" - Doesn't mean "clinically proven." Tested could mean one test with five people that showed no results. Regulators are increasingly scrutinising this distinction.
• "Dermatologist approved/recommended" - How many? Under what conditions? One paid dermatologist doesn't constitute a recommendation.

Social media and influencer claims follow the same rules. If an influencer makes a health claim about your supplement, you're potentially liable. Brief your creators clearly on what they can and can't say. See Section 20: PR & Earned Media for disclosure requirements in seeding and gifted product.

Competitor comparisons are allowed in most jurisdictions if they're truthful, substantiated, and not misleading. But "our product is better than [Competitor]" without evidence is a lawsuit waiting to happen. Stick to objective, verifiable claims.

Influencers, Reviews & User-Generated Content

The claims rules above don't stop at your own ads. The moment someone else talks about your product on your behalf - a creator you pay, a customer you incentivise, a review you publish - you're on the hook for what they say. Regulators have got sharper here, and the penalties are no longer theoretical.

Disclosure is non-negotiable. If there's a material connection between you and the person endorsing your product (payment, free product, an affiliate commission, an employment relationship), it has to be disclosed clearly: legible, in the same place as the endorsement, on every platform it appears. A buried #ad on the third line of a caption doesn't cut it. Same with affiliate links - if a click earns you money, say so.

Four things to get right, and they're cheap to get right:

See Section 20: PR & Earned Media for the disclosure mechanics in gifting and seeding - the same rules apply to ads run through a creator's handle.

Subscriptions & Auto-Renewal

If you run subscriptions, free trials, or any auto-renewing charge, you are in one of the most actively enforced corners of consumer law. The headlines move around, but the underlying obligations barely shift, and founders get caught by reading the headline and missing the substance.

The obligations to get right:

• Consent before the first charge: express, informed agreement to the recurring terms - what they will be charged, how often, and when - before any money moves. Pre-ticked boxes and buried terms don't count.
• Clear, ongoing disclosure: the renewal price and cadence stated plainly at sign-up and again in renewal reminders.
• Cancellation no harder than sign-up: if they signed up in two clicks online, they can cancel in two clicks online - not a phone call during business hours.

Email and SMS consent for those subscribers is a related but separate obligation (CAN-SPAM, TCPA, and local equivalents) - see Section 12: Email & SMS for the channel mechanics.

Data Privacy & Cookie Consent

Your entire DTC machine runs on data: pixels, email and SMS lists, customer profiles. All of it is regulated, and a non-compliant data layer is both a live fine risk and a red flag in diligence. The rules differ by region but the obligations rhyme.

The practical obligations are short and worth doing properly:

Website Accessibility (ADA / WCAG)

Your storefront is increasingly treated as a public accommodation in law, which makes an inaccessible site two problems at once: it shuts out real customers (around one in five people has a disability), and it is a live legal risk. Web-accessibility complaints are now one of the highest-volume areas of consumer litigation - thousands of ADA suits and far more demand letters land on online retailers every year, DTC stores very much included, and most settle quietly rather than in a headline.

The obligations differ by region but, as with privacy, they rhyme:

WCAG 2.1 Level AA is the de facto target everywhere. The baseline is unglamorous and mostly one-time work baked into the theme:

Test it properly, because scanners only see part of the picture. An automated pass (axe, WAVE or Lighthouse) catches maybe a third of issues; a keyboard-only run-through and a real screen-reader pass (VoiceOver or NVDA) catch the structural ones that actually get you sued.

As with everything here, this is awareness, not legal advice. Your exposure depends on where your customers are and how big you are, so confirm the current rules for your markets and get proper advice if an accessibility claim lands on you.

Labelling Requirements

Labelling requirements vary by product category and market. What must appear on the label, in what format, and in what language differs between AU, US, EU, and UK.

Universal basics (almost every market requires):

• Product name and description
• Ingredients or materials list
• Net weight/volume
• Country of origin (rules differ by jurisdiction)
• Manufacturer or importer name and address
• Batch/lot number (critical for traceability)
• Any required warnings or certifications

Market-specific requirements:

• EU/UK: Language requirements vary by market. CE marking applies to relevant product categories. UK conformity rules have shifted repeatedly, so check the current UK position for your product before printing artwork.
• US: FTC Made in USA rules. FDA-specific requirements for food, supplements, and cosmetics.
• AU: Country-of-origin and consumer law requirements under ACL, plus TGA requirements where the product is a therapeutic good.

Cross-reference: Section 24: International Expansion for market-specific compliance considerations when entering new regions.

International Conformity: EU GPSR & UKCA

Selling into the EU and UK is no longer just a labelling exercise. Both now require a named, locally established party who is accountable for the product's safety. "We ship from Australia" or "we're a US brand" is not an answer a marketplace will accept.

What the two regimes demand:

The practical move is a per-market conformity matrix before you enter a region: one row per market, columns for who your Responsible Person is, which mark applies, where the technical file lives, and whether you're Safety-Gate registered. Naming the Responsible Person is the longest-lead item, so start it early. If a cell is blank, you're not ready to sell there yet.

This is one of the heaviest parts of entering Europe. Treat it as part of the market-entry plan, not an afterthought. See Section 24: International Expansion for sequencing market entry.

Intellectual Property Foundations

Section 5: Product covers IP in the context of product development. Here's the operational summary:

Trademark: File in every market you sell into. AU, US, EU, UK as a minimum for most DTC brands. Budget $1K-$3K per jurisdiction. File before you launch if possible - someone else registering your brand name in a market you haven't filed in is expensive to resolve.

Design registration: Protects the visual appearance of your product. Cheaper than patents, faster to obtain, and often more useful for DTC products where the design is distinctive. Budget $500-$1,500 per design per jurisdiction.

Patents: Expensive ($10K-$50K+), slow (2-4 years), and only worth pursuing if your product has a genuinely novel functional innovation. Not all DTC brands need patents. Focus on trademarks and design registrations first.

Marketplace brand protection. Once you're selling well, someone will copy you, and marketplaces are where it shows up first: counterfeits, listing hijackers piggybacking on your product page, unauthorised sellers. This is where trademark strength earns its keep, because the takedown tools are built around it. On Amazon, enrol in Brand Registry (which needs a registered trademark), then layer on Project Zero for self-service takedowns and Transparency for unit-level serialisation that proves authenticity. Amazon now seizes 15M+ counterfeits a year and stops around 99% of suspected infringements before brands even have to report them, but you still need a monitored takedown workflow across every marketplace you sell on, plus a clean chain of authenticity for your retail and wholesale channels.

This is the day-to-day reason the patent story above lands the way it does: brand and trademark enforcement is cheaper, faster, and higher-ROI than patent litigation for almost every DTC brand.

Product Safety & Recalls

If you sell a consumer product, a recall is always possible. The question isn't whether you can imagine one happening, it's whether you're prepared if it does.

None of these should scare you off shipping. They're the reason the founder's principle at the top holds: getting it right early is a fraction of the cost of getting it wrong late. Know which of these touches your category, and watch those.

What triggers a recall:

• Product causes injury or poses a safety risk
• Non-compliance with a mandatory standard discovered
• Contamination (food, beauty, supplements)
• Labelling error that creates a safety issue (e.g., missing allergen declaration)

Preparation (before you need it):

• Batch/lot traceability: Every unit should be traceable to a production batch. This lets you recall the affected batch without recalling everything. If you can't trace by batch, a recall means recalling all stock - exponentially more expensive.
• Product liability insurance: Non-negotiable once you're selling to the public. Budget $1K-$5K/year for most DTC product categories. More for higher-risk categories (electronics, children's products, supplements).
• Recall protocol documented: Who's responsible, who contacts the regulator, what goes on the website, how affected customers are reached, how product is returned or destroyed. See Section 20: PR & Earned Media for the communications framework.

Compliance as a Business Asset

Everything above reads like cost and admin while you're building. At exit it flips, and becomes one of the things a buyer pays for, or punishes you on. A serious acquirer diligences every claim you've ever made, every recall, every regulatory file, every IP registration. If it's organised and dated, diligence is fast and your reps and warranties are clean. If it's scattered across inboxes and a founder's memory, the buyer prices the uncertainty in, or holds back part of the consideration against it.

The asset is a single, audit-ready compliance register. Build it as you go, not the week before a sale.

Fraud, Chargebacks & Payment Risk

Fraud is a cost of doing business in DTC. You won't eliminate it, but you can manage it to a level where it doesn't meaningfully impact your margin or your relationship with payment processors.

What actually happens:

• A stolen credit card is used to buy product on your site
• You fulfil the order and ship the product
• The real cardholder disputes the charge with their bank
• The bank issues a chargeback - taking the money back from you
• You lose the product, the revenue, and get hit with a chargeback fee ($15-$25 per incident)

At low volumes, this is annoying. At scale, it's a margin problem. And if your chargeback rate starts climbing toward the 0.9-1% range, Shopify Payments or your processor is likely to get uncomfortable. Sustained levels above that can threaten your processing relationship. That's an existential risk, not just a cost.

Chargeback rate benchmarks:

What Shopify gives you by default: Shopify's built-in fraud analysis flags orders as low, medium, or high risk based on signals like Address Verification System (AVS) mismatch, IP location vs billing address, and order velocity. For many brands under $5M, this plus basic manual review of flagged orders is adequate.

When to add dedicated fraud tooling: If you're seeing chargebacks above 0.5%, processing over $5M annually, or selling high-AOV products that attract professional fraudsters (electronics, luxury goods), consider a dedicated fraud prevention tool. NoFraud, Signifyd, or Riskified sit between your checkout and payment processor, scoring every transaction in real time and guaranteeing approved orders against chargebacks.

Common fraud patterns in DTC:

• Card testing: Small orders ($1-$5) to test stolen card numbers before making large purchases elsewhere. Watch for sudden spikes in low-value orders.
• Friendly fraud: A real customer makes a legitimate purchase, then disputes the charge claiming they didn't receive it or didn't authorise it. Clear shipping confirmation with tracking and signature on delivery reduces this.
• Promo abuse: Customers creating multiple accounts to stack discounts or exploit new-customer offers. Tighten your promo code logic and flag repeated shipping addresses.
• Refund fraud: Claiming a product was defective or never arrived when it was. Return reason coding (see Section 8: Quality & Returns) helps identify patterns.

Dispute management: When you do get a chargeback, respond promptly with evidence. Shipping confirmation, delivery tracking, AVS match, customer communication history. Shopify has a built-in dispute response flow. Good evidence materially improves your odds. Not responding means you lose by default.

Card-Network Monitoring & Dispute Deflection

Your processor's comfort level isn't the only threshold that matters. The card networks run their own monitoring programmes, and breaching them puts your ability to take payments at risk regardless of what Shopify thinks. The network average is still low, so you've got real headroom if you stay disciplined.

Visa's VAMP programme is the one to watch. It combines fraud and dispute activity into a single ratio (fraud reports plus disputes, over total sales). The threshold dropped to 2.2% from June 2025, tightening to 1.5% in some regions from 1 April 2026. Mastercard runs equivalent monitoring; your acquirer can tell you the current thresholds and whether you're near them. The shift that matters: under VAMP, disputes count toward the ratio, not just confirmed fraud. So deflecting disputes matters as much as blocking fraud.

Three tools work together:

The trap on the other side is over-blocking. Tighten the filters too hard and you reject good customers.

Regulatory Acronym Reference

Different markets, different bodies. The acronyms used in this section refer to:

Section 9 Checklist