eCommerce & Marketplaces Compliance in Australia

Australia's market is open to online retailers and marketplaces, domestic and foreign, without sector licensing. Regulation arrives through overlapping Commonwealth and state laws: the Australian Consumer Law enforced by the Australian Competition and Consumer Commission (ACCC), the Online Safety Act enforced by the eSafety Commissioner, the Privacy Act enforced by the Office of the Australian Information Commissioner (OAIC), product rules such as liquor licensing and vaping controls, and AUSTRAC rules for high-value precious goods paid in cash or crypto.

The main obstacle for a new entrant is mapping which of these regimes its catalogue and features trigger, and then designing age and identity checks that satisfy one regulator without breaching another's data-minimisation rules.

1. Who regulates this sector

Liquor rules differ by state and territory.

2. Licensing and authorisation

Operating an online store or a general goods marketplace requires no sector-specific licence or registration in Australia. Authorisation attaches to particular products, payment types and services:

Liquor

Liquor is licensed by each state and territory. In New South Wales, licensees selling online or by phone or mail must display their licence number, obtain the buyer's date of birth and give delivery instructions to hand the liquor to an adult (Liquor Act 2007 s 114); same-day delivery has a stricter regime (sections 4 and 5).

Vapes

Since 1 July 2024, under the Therapeutic Goods and Other Legislation Amendment (Vaping Reforms) Act 2024, vapes may be supplied only through a pharmacy. Non-pharmacy retailers may not sell any vapes, and advertising vaping goods without TGA authorisation is prohibited. From 24 July 2026 nicotine pouches can no longer be imported for personal use.

Precious goods for cash or crypto

A business selling precious metals, stones or products for A$10,000 or more in physical currency or virtual assets provides a designated service and must enrol with AUSTRAC (section 3).

Payments and credit

Holding customer funds or offering credit falls under separate financial services licensing.

3. AML, KYC and customer due diligence

Selling goods online is not a designated service under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act, Compilation No. 63, 1 October 2026), so most online retailers have no customer due diligence (CDD) duty, with one exception.

Dealers in precious metals, stones and products

Item 2 of table 2 in section 6 covers buying or selling precious metals, precious stones or precious products (including jewellery containing them) in the course of a business, where the purchase involves physical currency or virtual assets totalling A$10,000 or more, in one transaction or in transactions that are linked or appear to be linked. AUSTRAC opened enrolment on 31 March 2026 and obligations apply from 1 July 2026. Sales paid only by card or bank transfer are not covered, so for online sellers the practical trigger is crypto-asset checkout, or cash on collection, for high-value items.

A dealer in scope must:

• enrol with AUSTRAC, maintain an ML/TF risk assessment and AML/CTF policies (sections 26C to 26F);
• before the sale, establish on reasonable grounds the customer's identity, any beneficial owner (25% or more ownership, or control), any person acting on the customer's behalf, and whether any of them is a politically exposed person or designated for targeted financial sanctions, and verify KYC information "using reliable and independent data", with delivery channel as a mandatory risk factor (section 28);
• report suspicious matters within 3 business days, or 24 hours for terrorism financing (section 41);
• report physical currency transactions of A$10,000 or more within 10 business days (section 43);
• keep records for 7 years (Part 10).

AUSTRAC's guidance (16 and 29 October 2026) adds that a dealer which ordinarily accepts such payments must report suspected structuring even if it refuses the payment, and recommends a policy refusing cash and virtual assets or capping them below A$10,000, with controls to detect linked payments such as lay-by.

Sanctions

Sanctions apply to every business, not only reporting entities. Dealing with a person or entity on DFAT's Consolidated List (last updated 23 July 2026) is a serious criminal offence, with up to 10 years' imprisonment for individuals; marketplaces paying sellers should screen them.

4. Identity verification and onboarding

Australian law sets no customer identification programme for online shoppers or sellers; checks are triggered by age-restricted products, AML designated services and the operator's own fraud controls.

Buyers: age assurance

For same-day alcohol delivery in New South Wales, section 114HA of the Liquor Act 2007 requires the provider to verify a first-time purchaser is 18 or over when the order is placed, either through an accredited identity service provider (at minimum Identity Proofing Level 1 Plus under the Trusted Digital Identity Framework, checked against the date of birth attribute, Liquor Regulation 2018 cl 107DA) or through the alternative process in clause 107I: the buyer gives name and date of birth and the provider either authenticates an evidence of age document with an AI system run by an accredited or provisionally accepted provider, or takes the buyer's statement that the document will be produced at delivery. Repeat orders need authentication with credentials or the same statement (cl 107DC, 107I). At the door the recipient produces an evidence of age document or, if reasonably believed to be over 18, a signed declaration (cl 107E); Liquor & Gaming NSW requires ID from anyone who appears under 25. For age-restricted social media, eSafety's regulatory guidance (September 2025) says self-declaration on its own is not reasonable, cites liveness detection for facial methods as a circumvention control, and does not expect providers to keep personal information as a record of each age check.

Sellers: business verification

No statute requires a goods marketplace to verify its sellers. Where a marketplace chooses to, the public Australian Business Register (ABN Lookup) shows a business's legal name, entity type, ABN and GST registration status, and the state and postcode of its main business address, but not its owners, directors or full address.

Government verification services and Digital ID

Businesses can check Australian identity documents against issuing records through the Document Verification Service, accessed through an approved gateway service provider; the Identity Verification Services Act 2023 (s 9(2)) requires the individual's express consent, and IDMatch advises against using a check as the sole basis for a decision. The ACCC accredits Digital ID providers; the Australian Government Digital ID System opens to the private sector from December 2026, and using a Digital ID is voluntary.

5. Digital channels: what's different

Bottom line: online sale of age-restricted goods adds checks that a shop counter does not need (age verification before payment, a second check at the door and no unattended delivery), while AML, sanctions and privacy rules apply the same way in both channels.

Two checks for delivered alcohol

New South Wales requires verification when a same-day order is placed and again at hand-over, limits delivery to 9am to midnight (11pm on Sunday), requires approved training for delivery staff, keeps refusals on record for 12 months and requires online self-exclusion. Victoria takes a similar approach: first-time online buyers confirm they are 18 or over, ID is checked at delivery, same-day orders cannot be left unattended, deliveries stop at 11pm and failed deliveries are reported each year (Liquor Control Victoria, updated 10 September 2026).

No compelled government ID on social platforms

Section 63DB of the Online Safety Act 2021 prohibits an age-restricted social media platform from collecting government-issued identification material, or using an accredited service under the Digital ID Act 2024, for the minimum age obligation unless it also offers a reasonable alternative. eSafety applies this even where another method gives a result the user disputes.

Pending changes

The Scams Prevention Framework applies to designated social media, search and instant messaging services, not to stand-alone goods marketplaces, and only where the provider has A$1 billion or more in revenue and the service averages 200,000 or more monthly active Australian users (Scams Prevention Framework Rules 2026, rules 1-5, 1-6, 3-10); until 31 March 2027 only its code, dispute-resolution and scheme-membership provisions apply to those services [Adopted, core obligations from 31 Mar 2027]. The Children's Online Privacy Code [Draft, registration due 10 Dec 2026] will cover apps and websites likely to be accessed by children.

6. Data protection and biometrics

The Privacy Act 1988 (Compilation No. 104, 4 June 2026) and its Australian Privacy Principles (APPs) apply to businesses with annual turnover above A$3 million and to some smaller ones (section 6D). Three points bite on online identity and age checks.

• Biometrics are sensitive information. Section 6 includes biometric information used for automated biometric verification or identification, and biometric templates. The OAIC's facial recognition guide (29 July 2026) requires valid consent and necessity and proportionality, or a narrow exception.
• Age-check data for social media is ring-fenced. Under section 63F of the Online Safety Act, personal information collected to keep under-16s off an age-restricted platform may be used only to decide whether the person is under 16, under limited exceptions or with specific, withdrawable consent, and must then be destroyed. The OAIC enforces this.
• Automated decisions must be disclosed. From 10 December 2026, APP 1.7 to 1.9 require privacy policies to describe the use of computer programs to make, or do things substantially and directly related to making, decisions that could significantly affect individuals [Applies from 10 Dec 2026].

Section 26GC of the Privacy Act requires the OAIC to register a Children's Online Privacy Code within 24 months of 10 December 2024 assent. It will bind social media, relevant electronic and designated internet services likely to be accessed by children; the exposure draft (31 March 2026) includes best-interests duties and consent before targeted advertising to children.

7. Sector-specific obligations

Is a marketplace an age-restricted social media platform?

Part 4A of the Online Safety Act 2021 (Compilation No. 4, 12 September 2026), in force since 10 December 2025, applies to services with a sole or significant purpose of online social interaction, user-to-user interaction and posting, plus a recommender or logged-in feature such as an endless feed (Online Safety (Age-Restricted Social Media Platforms) Rules 2025, rule 4A, added in March 2026). Online business interaction does not count, and rule 5(1)(c) excludes services mainly for sharing product or service information, such as reviews. A transactional marketplace is unlikely to qualify, but social commerce features change the analysis. eSafety has no formal power to declare a service age-restricted; providers must self-assess, and in eSafety's November 2025 list Pinterest was among the services it considered not age-restricted.

Age-Restricted Material Codes

Industry codes registered by eSafety protect children from pornography, high-impact violence, self-harm material and simulated gambling. Codes for app distribution platforms, social media, relevant electronic services and designated internet services (websites) took effect on 9 March 2026, after codes for hosting, carriage and search services on 27 December 2025. A storefront or app store offering such material needs age assurance.

Platform reporting to the tax office

Under Schedule 1, section 396-55 of the Taxation Administration Act 1953 (table item 15), an operator of an electronic distribution platform must report transactions made by suppliers through the platform. Supplies by way of transfer of ownership of goods, real property and financial supplies are excluded, so the duty falls on service marketplaces (such as rides, accommodation and tasks) rather than goods marketplaces. Under the ATO's Sharing Economy Reporting Regime (all reportable transactions since 1 July 2024), platforms report twice a year each seller's name, date of birth, address, email, phone and bank details, or ABN and business name for entities.

8. Risk indicators and red flags

Identity and age-abuse indicators for online retail

• Split high-value payments: several cash or crypto payments for one precious item that together reach A$10,000 (AUSTRAC linked-transaction guidance).
• Lay-by structuring: instalments in cash or virtual assets on jewellery or bullion that keep each payment under the threshold.
• Mismatch at the door: the person receiving age-restricted goods is not the verified purchaser or nominated adult.
• Synthetic or AI-generated documents: false identity documents, AI tools or deepfakes used to pass an age check (eSafety).
• VPN or location masking: users appearing outside Australia to avoid age restrictions.
• Sanctions exposure: sellers, payees or delivery addresses linked to persons on the Consolidated List.

9. Enforcement and penalties

When a maximum penalty multiplies

Maximums apply per contravention and can scale up:

The Commonwealth penalty unit is A$364 for offences committed on or after 1 July 2026 (Crimes (Amount of a Penalty Unit) Instrument 2026); earlier conduct uses the amount in force at the time. Act No. 83, 2026 doubled the minimum age penalties to 60,000 units for conduct from 12 September 2026.

In a determination dated 26 August 2025 ([2025] AICmr 155, published 18 September 2025), the Privacy Commissioner found that Kmart breached APPs 1, 3 and 5 by using facial recognition at 28 stores against refund fraud without notice or consent; it is under Administrative Review Tribunal review, with hearings in early 2027. In Bunnings ([2026] ARTA 130, 4 February 2026) the Tribunal upheld breaches of APPs 1 and 5 (inadequate notice, no documented risk assessment) but let Bunnings rely on the consent exception for its specific crime problem.

10. Recent changes and what to watch

• 1 July 2027: [Adopted, effective 1 Jul 2027] Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 bans unfair trading practices that manipulate consumers or distort their decisions, and adds drip-pricing and subscription-contract rules.
• 31 March 2027: [Adopted, effective 31 Mar 2027] core Scams Prevention Framework obligations apply to designated social media, search and messaging services, including social platforms that host marketplaces.
• 10 December 2026: [Applies from 10 Dec 2026] privacy-policy transparency for automated decisions (APP 1.7 to 1.9); [Draft, registration due 10 Dec 2026] Children's Online Privacy Code for services likely to be accessed by children.
• 12 September 2026: [In force] social media minimum age penalties doubled and eSafety's investigative powers expanded.
• 1 September 2026: [Proposed, Treasury-led review] the ACCC reported that Treasury will lead Government work that includes making online marketplaces subject to mandatory product safety obligations; the Australian Product Safety Pledge (six marketplaces) remains voluntary.
• 1 July 2026: [In force] dealers in precious metals, stones and products accepting A$10,000 or more in cash or virtual assets became AUSTRAC reporting entities.
• 28 March 2026: [In force] maximum Australian Consumer Law penalty for companies doubled to A$100 million (or 3 times the benefit or 30% of turnover) for conduct from this date.

11. What this means for identity verification

• Gate by product, not by platform. Verify age only for categories that require it (alcohol, R18+ material), consistent with data minimisation.
• Offer more than one route. Combine accredited Digital ID, document plus liveness, and facial age estimation; on age-restricted social features a non-government-ID option is mandatory.
• Plan for the last mile. Delivered alcohol needs a second, in-person check, so the verified identity must travel to the courier's hand-over step.
• Treat face data as sensitive. Obtain consent, document a privacy impact assessment and delete images and templates when no longer needed.
• Watch payment methods. Crypto or cash of A$10,000 or more for jewellery switches on full AML duties.