Moving sales, bookings, or even just enquiries to the web does not change what your business is — but it does change the legal surface area you have to manage. A physical shopfront's obligations are mostly bounded by what happens between the door and the till. An online shopfront collects data the moment a visitor lands on it, accepts contracts at a click, sends marketing into people's inboxes and phones, and presents claims about your goods or services to a national audience. Each of those activities is regulated, often by a different body and a different statute.
This article sets out the legal obligations that practically attach to running a business online in Australia. It is written for owners and operators, not lawyers. The aim is to give you a clear map of the regime so you can see what you already comply with, what you probably do not, and where the cost of getting it wrong is genuinely material. The areas it covers are:
- Privacy and the handling of customer personal information
- Consumer law: the guarantees and the prohibition on misleading conduct
- Email and SMS marketing under the Spam Act
- Electronic contracts and website terms
- Payment, data security, and the role of insurance
Privacy and the handling of personal information
The Commonwealth statute that governs how organisations handle personal information is the Privacy Act 1988 (Cth). It contains the thirteen Australian Privacy Principles (APPs), which set out the rules for collecting, using, storing, disclosing, and giving people access to their information.
A small business with an annual turnover of $3 million or less is generally not covered by the Act. The threshold and the exceptions to it are set out by the OAIC. The exceptions are narrower than most people realise. If your business trades in personal information, provides health services and holds health information, is contracted to provide services to the Commonwealth, is a credit reporting body, or is a residential tenancy database operator, the Act applies to you regardless of turnover.
Two practical points follow. First, the $3 million figure is calculated on annual turnover, not profit, and once you cross it you are covered for the whole financial year. If your online business is growing quickly, the day the Act starts applying to you is not the day you notice you have crossed it. Second, the small business exemption does not displace the rest of the regime. Spam, consumer law, and contract law apply to you whether or not the Privacy Act does.
When the Act applies, the document people see first is your privacy policy. APP 1 requires an organisation to have a clearly expressed and up-to-date policy describing what information it collects, how, why, who it goes to, and how a person can access or correct it. APP 5 requires you to notify a person, at or before the point of collection, of the matters the principle lists. A boilerplate policy copied from another website almost always fails on both counts.
Australian Consumer Law
The Australian Consumer Law (ACL) sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth). It applies to almost every business that supplies goods or services to consumers, and it cannot be contracted out of. The two parts most often relevant to an online business are the consumer guarantees and the prohibition on misleading or deceptive conduct.
The consumer guarantees include the implied promises that goods are of acceptable quality, match their description, are fit for any purpose the seller has been told about, and that services are provided with due care and skill within a reasonable time. A "no refunds" sign in a physical shop has never displaced these. A "no refunds" line in your online terms does not either. Where a major failure occurs, the consumer chooses the remedy — refund, replacement, or in the case of services, cancellation and compensation.
The prohibition on misleading or deceptive conduct is set out in section 18 of the ACL. It is broad. It catches both statements that are literally untrue and statements that, while technically accurate, create a false overall impression. For an online business, it covers the wording on your product pages, the implied claims in your photography, the use of testimonials, "was/now" pricing, "free" offers that are not free, comparisons with competitors, and representations about delivery times, stock levels, and origin. Liability does not require an intention to mislead.
A related provision, the prohibition on false or misleading representations in section 29, applies specifically to claims about the standard, quality, sponsorship, approval, or origin of goods and services. The ACCC has used both provisions against online retailers; the penalties for corporations are substantial.
Email and SMS marketing under the Spam Act
The Spam Act 2003 (Cth) regulates commercial electronic messages — email, SMS, MMS, and instant messages — sent to or from Australia. The ACMA enforces it. The Act sets three rules: every commercial electronic message must be sent with consent, must clearly identify the sender, and must contain a working unsubscribe facility.
Consent can be express or, in narrower circumstances, inferred from an existing business relationship. The burden of proving consent sits with the sender. Buying a list, scraping addresses from a website, or assuming consent from a one-off transaction five years ago will not meet the standard.
Identification requires the message to contain accurate sender information — the legal name of the business, and contact details that remain valid for at least 30 days after the message is sent. The unsubscribe facility must be presented clearly, must not require the recipient to log in or supply unrelated information, and an unsubscribe request must be honoured within five business days.
These rules apply whether you send the message yourself or use a third-party platform on your behalf. The business that authorised the message is the one on the hook.
Electronic contracts and website terms
When a customer clicks "I agree" or "Place order" on your website, they are entering into a contract. The legal framework that makes that contract enforceable is supplied partly by the Electronic Transactions Act 1999 (Cth), partly by mirror state legislation, and partly by the common law of offer, acceptance, and consideration that has always applied to commercial dealings.
The practical implication is that the terms presented at the point of click are the terms of the contract — provided the customer had a real opportunity to read them and to indicate agreement. A buried hyperlink to a 40-page document, or terms that change after the order is placed, are weaker than terms presented immediately above an "agree" button at the point of purchase.
Two documents do most of the work on a transactional site. The website terms of use govern how visitors interact with the site itself: acceptable use, intellectual property, disclaimers, governing law. The terms of sale (or terms of service, for a services business) govern the substance of what is being bought: price, delivery, returns and refunds, warranties beyond the consumer guarantees, liability limits, and the process for disputes. The two are often combined; they do not have to be.
Where your business sells to other businesses, the unfair contract terms regime in the ACL now applies to standard-form small business contracts. A term is unfair if it would cause a significant imbalance, is not reasonably necessary to protect the legitimate interests of the party advantaged, and would cause detriment if relied on. From late 2023 the regime carries civil penalties — not just the prospect of a term being voided.
A worked example
Consider an Australian skincare business that operated through a Sydney shopfront and a Saturday market stall, and that decides to launch a website with online ordering and an email newsletter.
The site goes live. From day one the business is collecting customer names, addresses, email addresses, and order history. Turnover is well under $3 million, so the Privacy Act does not yet apply by default. The owner publishes a privacy policy anyway, because the email service provider's terms require one and because customers are starting to ask where their data goes.
The product pages describe the range as "Australian-made" and "100% natural". One product is finished in Australia from ingredients imported from overseas. The "Australian-made" claim is a representation about origin and is caught by sections 18 and 29 of the ACL. The business reviews the labelling rules, changes the page to "made in Australia from local and imported ingredients" for that product, and keeps the original wording only on the lines it can substantiate.
The newsletter launches with a list compiled from past in-store purchases. None of those customers gave express consent to receive marketing. The business sends the first edition anyway. A handful of recipients complain to the ACMA. The Spam Act applies; consent cannot be inferred from a one-off retail purchase years earlier. The business pauses sending, runs a re-permission campaign with a clear opt-in, and rebuilds the list. The cost of the pause is small. The cost of an ACMA infringement notice would not have been.
Six months in, turnover crosses $3 million. The privacy policy that was nice-to-have becomes mandatory, and so does APP 5 notice at the point of collection. The owner books a privacy review before the next quarter closes.
Where Artificer Legal helps
Most of the obligations above are manageable in-house once the regime is understood. The points where outside help genuinely shortens the path are predictable. An Artificer Legal practitioner working with an online business would typically:
- Audit the site against the APPs and draft a privacy policy and APP 5 collection notice that match how the business actually handles data, not a template
- Draft the website terms of use and the terms of sale or service, calibrated to the goods or services being sold and to the contract law position on incorporation of terms
- Review marketing copy, product claims, comparison advertising, and pricing representations against sections 18 and 29 of the ACL, and advise on substantiation
- Set up the consent, identification, and unsubscribe processes required by the Spam Act, and review the records the business is keeping to prove consent
- Advise on the unfair contract terms regime where the business sells on standard form to other small businesses
- Respond to a regulator notice — from the OAIC, the ACCC, or the ACMA — and to customer complaints that have the potential to escalate
The work is usually front-loaded: the policies, terms, and processes are set up once, then maintained as the business changes.
In summary
The single thing most often missed is that taking a business online does not add one new legal regime — it touches several at once, each with its own regulator. Privacy, consumer law, spam, and contract law all apply from the day the site goes live, and the small business exemption that exists for privacy does not exist for any of the others.
In short: collect only the personal information you need and tell people what you do with it; make sure every claim on the site is one you can substantiate; only send marketing to people who have consented and make it easy for them to stop; present your terms clearly at the point of agreement and make sure they reflect the consumer guarantees you cannot contract out of. Get those four right and the regulatory exposure of an online business is manageable. Get them wrong and the exposure compounds, because the same conduct can breach more than one statute at a time.