Before starting to sell online, it is essential to have a clear understanding of eCommerce regulation in Italy, in order to avoid future legal issues and to launch the business with the assurance that all activities are carried out lawfully and in compliance with the Italian legal framework governing online commerce.
In recent years, eCommerce regulation has become increasingly complex and detailed. Failure to properly address its requirements may expose businesses to inspections, administrative warnings or financial penalties after the launch of the online store.
In the Italian legal system, eCommerce regulation does not stem from a single, comprehensive statute. Instead, it is based on a set of different legal provisions covering various areas, ranging from commercial law and distance selling rules to more recent legislation on data protection, return and refund policies, and the cross-border sale of goods and services.
Commencement of Business Activity and Commercial Law Requirements
Before operating an eCommerce business, it is mandatory to open a VAT number (Partita IVA) and to register the business with the Companies Register (Registro delle Imprese) held by the competent local Chamber of Commerce.
During the registration process, the business structure must be identified, whether as a sole trader or as a company, such as a general partnership (SNC), a limited liability company (SRL) or a simplified limited liability company (SRLS).
Once the business has been correctly established from a corporate perspective, compliance is also required with Legislative Decree No. 114 of 31 March 1998. Although this decree does not expressly regulate eCommerce, it governs distance selling activities, which also apply to online sales.
Under this legislation, the business must submit a Certified Notice of Commencement of Activity (Segnalazione Certificata di Inizio Attività – SCIA) to the municipality where the registered office or operational headquarters of the eCommerce business is located.
From an administrative standpoint, these are the preliminary steps required for an online store to lawfully commence sales activities.
eCommerce Regulation: Obligations under the E-Commerce Directive
The primary legal reference for electronic commerce is Legislative Decree No. 70 of 9 April 2003, implementing Directive 2000/31/EC of the European Union, commonly referred to as the E-Commerce Directive.
This legislation regulates information society services and defines the legal framework applicable to electronic sales activities.
The decree is particularly relevant as it establishes a number of mandatory information obligations for online sellers, including:
- clear identification of the trader or company operating the business;
- contact details, such as the registered office address, telephone number, and email address;
- the obligation to send the customer an order confirmation email containing details of the purchased goods or services and the total price paid.
These obligations must be taken into account from the design phase of the eCommerce platform, as they directly affect the structure and content of the website.
Consumer Protection: Rules under the Consumer Code
Online sales are also subject to the Italian Consumer Code, enacted by Legislative Decree No. 206 of 6 September 2005.
This legislation governs the consumer’s right of withdrawal and return policies. In particular, it strengthens consumer protection by granting the right to withdraw from a distance contract within 14 days, except in cases expressly excluded by law.
In addition to withdrawal rights, the Consumer Code regulates the legal guarantee of conformity, imposing further obligations on the seller, including:
- the obligation to deliver goods that conform to the contract of sale;
- a two-year guarantee for any lack of conformity existing at the time of delivery;
- the consumer’s right to request repair or replacement of the goods, free of charge, in the event of defects.
A proper understanding of this framework is essential when drafting return, refund and complaint policies for an eCommerce website.
Electronic Payments and Transaction Security
When launching an eCommerce business, compliance with regulations governing electronic payments and transaction security is also required.
In this context, reference must be made to Directive (EU) 2015/2366 on payment services (PSD2), as implemented in Italian law, which significantly affects the execution of electronic payment transactions.
One of the most important requirements introduced by PSD2 is the obligation to adopt strong customer authentication(SCA). This measure aims to reduce the risk of fraud and unauthorised use of payment instruments by requiring verification based on at least two independent authentication factors.
Although the technical implementation of security measures is usually handled by payment service providers such as banks or payment gateways, the online seller remains responsible for ensuring that these systems are properly integrated into the website and that the payment process is clear and transparent for users.
Personal Data Protection and Cookie Compliance
One of the most significant regulatory frameworks affecting eCommerce activities is the General Data Protection Regulation (EU) 2016/679 (GDPR).
The GDPR imposes numerous obligations on eCommerce operators concerning the collection and processing of customers’ personal data, including data used for advertising and marketing purposes.
Specifically, an eCommerce operator must provide a clear and compliant Privacy Policy and Cookie Policy, informing users about how their personal data is collected, used, stored and tracked, particularly through cookies and similar technologies.
Beyond the informational documents, the business must also implement effective internal procedures for managing personal data such as customer identification details, shipping and billing addresses, contact information and payment-related data, ensuring adequate security measures are in place.
The GDPR requires that personal data be processed lawfully, transparently and for specific and legitimate purposes, while avoiding excessive data collection and adopting appropriate technical and organisational safeguards.
Users must be properly informed and, where required, must provide free, specific, informed and unambiguous consent to data processing activities, whether limited to order fulfilment or extended to marketing purposes.
Failure to comply with GDPR obligations may result in significant administrative fines, which can reach up to €10 million or 2% of the worldwide annual turnover, depending on the infringement.
Product Safety Obligations
In addition to data protection requirements, eCommerce operators must comply with EU product safety legislation.
Regulation (EU) 2023/988 has introduced enhanced consumer protections and stricter obligations for economic operators. Under this regulation, products placed on the market must comply with all applicable legal requirements and meet safety standards.
The obligation extends beyond preliminary checks and includes the duty to provide clear product information ensuring traceability throughout the supply chain.
If unsafe or non-compliant products are identified, sellers are required to take prompt corrective measures, including product withdrawal, recall, suspension of sales and appropriate communication with consumers.
Digital Accessibility
One of the most recent regulatory developments affecting eCommerce stems from Directive (EU) 2019/882, known as the European Accessibility Act, which aims to ensure that digital products and services are accessible to persons with disabilities or cognitive impairments.
The directive applies to eCommerce services where the business does not qualify as a micro-enterprise, defined as having fewer than 10 employees and an annual turnover not exceeding €2 million, with regard to the services offered.
For other economic operators, exemptions or limitations may apply where compliance would impose a disproportionate burden, assessed on a case-by-case basis.
In practice, even at the initial stage of creating an online store, adopting accessibility-compliant design principles is advisable. An accessible website not only mitigates future legal risks but also broadens the potential customer base by removing technological barriers to online purchasing.
Taxation of Cross-Border Online Sales
If an eCommerce business intends to sell goods not only in Italy but also abroad, applicable tax regulations must be carefully considered.
Reference must be made to Presidential Decree No. 633/1972, which governs VAT territoriality rules and distinguishes between domestic, intra-Community and extra-EU transactions.
In the case of intra-Community distance sales, where goods are shipped from one EU Member State to consumers in another Member State, VAT is payable in the country of destination once the annual threshold of €10,000 in cross-border sales is exceeded.To simplify VAT compliance within the EU, the One Stop Shop (OSS) scheme has been introduced, allowing businesses to declare and pay VAT due in other Member States through a single VAT return filed in Italy. This mechanism is particularly beneficial for eCommerce operators active in multiple European markets.
