TL;DR: Running an e-commerce business in the US means complying with a genuinely layered set of federal and state requirements most founders underestimate until something goes wrong, FTC advertising and shipping rules, a patchwork of state sales tax nexus obligations since Wayfair, CAN-SPAM for every marketing email, ADA website accessibility, and state-specific privacy laws that keep expanding. This guide covers every document a US e-commerce business actually needs, organized by what it protects, and when each one becomes legally required, not just advisable.
Quick overview: This is a US-specific checklist. For the SaaS-specific version of this kind of document stack, our complete guide to legal documents every SaaS startup needs in the USA covers that separately.
Customer-facing documents every e-commerce site needs
Terms of Service. Governs the rules for using your site, limits your liability, and sets the legal relationship with every buyer. Our terms and conditions drafting service covers this, drafted specifically for e-commerce platforms rather than generated from a generic template.
Privacy Policy. Legally required in California under the CCPA, and increasingly required across a growing list of states with their own comprehensive privacy statutes, not just for businesses with EU visitors under GDPR. A privacy policy that doesn’t reflect what your site actually does with customer data is itself a liability, the FTC has authority to act against companies whose real data practices differ from what their stated policy claims.
Cookie and Tracking Disclosure. Where your site uses cookies, analytics, or advertising technologies, disclosure and, in some circumstances, consent is required. This is typically drafted alongside your Terms of Service and Privacy Policy as a consistent set, since a contradiction between the three is a genuine legal weakness a plaintiff’s lawyer will look for specifically.
Return and Refund Policy. The FTC requires clear disclosure of your refund terms before the transaction completes, and several states go further. Connecticut, for example, specifically mandates that merchants offering a warranty clearly state its availability before purchase. An ambiguous or hidden return policy is a common, entirely avoidable source of chargebacks and disputes.
Shipping Policy. Governed by the FTC’s Mail or Telephone Order Rule: you must ship within the timeframe you state, or within 30 days if no timeframe is given. If you can’t meet that window, you’re required to notify the buyer, offer cancellation and a prompt refund, or ship within an agreed extension. Your shipping policy should reflect this obligation explicitly, not just describe delivery estimates loosely.
Compliance documentation most e-commerce founders discover too late
ADA website accessibility documentation. This is one of the fastest-growing legal risk areas for US e-commerce specifically. Courts have consistently held that Title III of the Americans with Disabilities Act applies to commercial websites, and accessibility lawsuits against online stores are filed in the thousands annually, with settlements commonly ranging from $5,000 to $25,000 plus remediation costs. The widely accepted compliance standard is WCAG 2.1, Level AA. Documented accessibility review and remediation is genuinely cheaper as a proactive step than as a defense after a demand letter arrives.
Sales tax nexus compliance framework. Since the Supreme Court’s 2018 decision in South Dakota v. Wayfair, Inc., 585 U.S. 162, physical presence is no longer required for a state to tax your sales, economic activity alone can create nexus. The commonly cited threshold is $100,000 in sales or 200 separate transactions into a state within a year, though exact thresholds vary by state and continue to change. What most guides miss entirely: crossing economic nexus in a state can also trigger a separate “doing business” obligation, requiring you to formally register, or foreign qualify, your LLC or corporation there, layering corporate compliance on top of sales tax collection. If you sell through a marketplace like Amazon or Etsy, the marketplace generally collects and remits on your behalf under marketplace facilitator laws, but if you also sell through your own storefront, that obligation falls on you directly.
CAN-SPAM compliance documentation. This applies to every commercial email you send, promotional campaigns, newsletters, abandoned-cart reminders, and win-back sequences, not just obvious marketing blasts. It doesn’t require opt-in consent the way GDPR does, but it does require immediate, working opt-out compliance, and penalties can reach over $53,000 per email in egregious cases. A common, genuinely easy mistake: a customer unsubscribes from your general marketing list, but your transactional emails route through a separate system that keeps sending, which is itself a violation.
COPPA compliance documentation, if your site targets or knowingly collects data from children under 13. This requires verifiable parental consent, a detailed privacy policy addressing children’s data specifically, and defined data handling practices distinct from your general policy.
FTC Endorsement Guide compliance for influencer and affiliate marketing. Any paid partnership, sponsorship, or affiliate relationship needs clear, conspicuous disclosure, #ad or #sponsored isn’t optional styling, it’s a specific FTC requirement, and your influencer and affiliate agreements should contractually require it.
Vendor and payment infrastructure agreements
PCI-DSS compliant payment processing. Don’t handle card data directly, route payments through a certified third-party processor, and confirm this contractually with your provider rather than assuming compliance.
Supplier and fulfillment agreements. Covering delivery timelines, quality standards, and liability if a supplier fails to deliver, directly relevant given your own FTC shipping obligations depend on your supplier actually performing.
Product-specific regulatory documentation. If you sell supplements, cosmetics, or children’s products, FDA or Consumer Product Safety Commission rules apply on top of everything above, and this needs to be addressed in your sourcing and labeling documentation specifically, not folded into general terms.
Standard business documents that still apply
Business formation documents. Most US e-commerce businesses operate as an LLC for liability protection. Our LLC formation guide covers the registration process, including the registered agent requirement every state formation needs.
Trademark registration. Protecting your brand name and logo matters more in e-commerce specifically, since marketplace platforms increasingly require or reward registered trademark status for brand protection tools. Our complete guide to registering a trademark in the US covers the process.
Founders’ Agreement, IP Assignment, and NDAs, if you have co-founders or are building proprietary technology, product designs, or branding. Our free Founders’ Agreement template, complete IP assignment guide, and NDA template cover these foundational documents.
When each document actually becomes required
- Before launch: Terms of Service, Privacy Policy, Return and Shipping Policy, ADA accessibility review.
- Before your first marketing email: CAN-SPAM compliant unsubscribe infrastructure.
- Once you cross a state’s economic nexus threshold: sales tax registration and collection in that state, and a check on whether foreign qualification is also triggered.
- Before running any influencer or affiliate campaign: disclosure-compliant partnership agreements.
- If you sell to or knowingly collect data from children: COPPA-specific documentation, before collection begins, not after.
Frequently asked questions
Does a small e-commerce store really need to worry about ADA website accessibility?
Yes. Courts have consistently applied Title III of the ADA to commercial websites, and lawsuits are filed against businesses of every size, not just large retailers. Settlements commonly range from $5,000 to $25,000 plus remediation costs, and proactive compliance to the WCAG 2.1 Level AA standard is significantly cheaper than responding to a demand letter after the fact.
Do I need to collect sales tax in every state I ship to?
Only in states where you’ve crossed that state’s economic nexus threshold, commonly cited as $100,000 in sales or 200 transactions annually, though exact figures vary by state. If you sell exclusively through a marketplace like Amazon, the marketplace typically handles this under marketplace facilitator laws, but sales through your own storefront remain your direct obligation.
Does CAN-SPAM apply to abandoned cart emails and other automated e-commerce emails?
Yes. CAN-SPAM applies to all commercial email, not just obvious marketing campaigns, including abandoned-cart reminders and win-back sequences. It requires a working, immediate opt-out mechanism, and a common violation is transactional emails continuing to send after a customer unsubscribes from general marketing.
What happens if my sales cross a state’s economic nexus threshold?
Beyond registering to collect and remit sales tax in that state, crossing nexus can also trigger a separate “doing business” requirement, meaning your LLC or corporation may need to formally register, or foreign qualify, in that state, layering corporate compliance obligations on top of the sales tax registration.
Do I need a separate policy for children’s data if I sell children’s products?
If your site targets or knowingly collects data from children under 13, COPPA requires verifiable parental consent, a specific privacy policy addressing children’s data, and defined data handling practices distinct from your general privacy policy.
This article is general information, not legal advice. Federal and state e-commerce compliance requirements change frequently. For advice on your specific business, speak to a qualified lawyer.
Authored and reviewed by Prakhar Rai, Advocate, founder of My Legal Pal. Connect on LinkedIn.
Running a compliant e-commerce business in the US means keeping pace with FTC rules, state-by-state sales tax obligations, and website accessibility standards that keep evolving. Our team drafts and reviews the complete e-commerce legal document stack for US-based and international sellers. Speak to our contract lawyer about your specific e-commerce business, or get your contract reviewed before you sign anything.
