eCommerce & Marketplaces Compliance in Austria

Austria is open to online retail and marketplaces without sector-specific authorisation. The rules that shape onboarding come mainly from EU law applied through Austrian statutes: the Digital Services Act (DSA), which requires marketplaces to identify business sellers, and the EU platform tax-reporting rules (DAC7), implemented by the Digital Platforms Reporting Obligation Act (DPMG).

The principal authorities are KommAustria, the Digital Services Coordinator; the Tax Authority Austria under the Federal Ministry of Finance, for platform reporting; and the Federal Competition Authority (BWB) and the consumer protection ministry for consumer enforcement. The biggest practical obstacle for a new marketplace is building seller verification that satisfies both the DSA trader checks and DPMG tax due diligence, with blocking and payout holds when sellers do not comply.

1. Who regulates this sector

KommAustria estimates that 50 to 60 online platforms and marketplaces under its DSA jurisdiction are potentially subject to the platform rules (annual report, August 2025). Youth protection, including age limits for alcohol, is legislated by the nine provinces. The Federal Minister of the Interior monitors sanctions compliance outside the financial sector (Sanctions Act 2024, § 12).

2. Licensing and authorisation

There is no licence for operating an online shop or marketplace as such: Austria follows the EU principle that information society services need no prior authorisation, and neither the DSA nor the Digital Services Coordinator Act (KDD-G) requires notification. Trades are generally exercised on the basis of registration under the Trade Act 1994 (Gewerbeordnung 1994, GewO § 5(1)). Every service provider must keep its name, address, email and any company register number permanently accessible (E-Commerce Act, ECG § 5(1)).

Platform registration for tax reporting

The DPMG covers platform operators with their seat, place of management or a permanent establishment in Austria, and operators with no tax residence or establishment anywhere in the EU that facilitate reportable activity in Austria (DPMG § 4(4)). An operator in the second group registers once in a Member State of its choice, in Austria within one month of starting activity (DPMG § 7(1)). A platform whose business model has no reportable sellers can obtain an exemption by proving this to the Tax Authority Austria between 1 December and 31 January (DPMG § 4(3)).

Handling buyers' money

A marketplace that collects and passes on payments may be providing a payment service that needs FMA authorisation under the Payment Services Act 2018 (ZaDiG 2018 § 7(1)). Payments through a commercial agent acting for only the payer or only the payee are excluded (ZaDiG 2018 § 3(3)(2)).

3. Identity framework (AML rules do not apply)

Online shops and marketplaces are not, as such, obliged entities under Austria's AML law. AML duties for traders sit in the Trade Act and reach only specific activities. Under GewO § 365m1(2)(1)(a), the AML chapter applies to traders, including auctioneers, insofar as they make or receive cash payments of at least EUR 10,000, in one operation or in linked operations. A separate trigger covers dealing in works of art at EUR 10,000 or more (§ 365m1(2)(1)(b) and (c)).

A trader in scope applies the Trade Act's due diligence and reporting regime. Suspicious transaction reports go to the A-FIU, while ongoing supervision and sanctioning lie with the district administrative authority (GewO § 365m1(3)). The trigger is keyed to cash; card, transfer and wallet payments do not count toward it.

What governs identity instead

Seller traceability (DSA Article 30)

Marketplaces must identify every business seller before it can offer products to consumers in the EU.

Tax due diligence (DPMG)

Platforms must collect, check and report identity, tax and payment data of sellers.

VAT record-keeping (VAT Act)

Platforms facilitating sales to consumers in Austria must keep records on the underlying sellers.

Age limits for restricted goods

Federal product laws and provincial youth protection acts govern sales to minors.

Neither regime requires verifying a seller's beneficial owners.

4. Identity verification and onboarding

Business sellers on a marketplace

Under Article 30(1) DSA, a platform that lets consumers conclude distance contracts with traders must obtain, before a trader may promote or offer products to consumers in the EU: name, address, telephone number and email; a copy of an identification document or an electronic identification as defined by the eIDAS Regulation; payment account details; the trade register and registration number where applicable; and a self-certification that the trader offers only products compliant with EU law. Platforms must make best efforts to check that the information is reliable and complete, using official databases or interfaces or supporting documents (Article 30(2)). Micro and small enterprise platforms are exempt (Article 29).

The DPMG adds tax data: for individual sellers, name, main address, tax identification number and issuing state (or, if none, place of birth), date of birth and VAT number; for entities, registered name, main address, tax identification numbers, registration number and VAT number. Reliability is checked against the platform's own records and free electronic interfaces for validating tax and VAT numbers (DPMG § 19(1)). Where a seller was identified through an identification service, a free electronic procedure provided by a participating state or the EU to establish identity and tax residence, the platform meets the reporting duty for the address, tax, birth-date and VAT items by reporting the service's identifier and issuing Member State (DPMG § 6(10), § 13(2)). Due diligence ends by 31 December of each reporting period (DPMG § 22(1)).

Electronic identification

Private-sector organisations can identify a person through ID Austria using a sector-specific identifier derived from the E-ID, provided they run a suitable technical environment (E-Government Act § 14(1)). Each Member State must provide at least one European Digital Identity Wallet within 24 months of the relevant implementing acts entering into force (Regulation (EU) 2024/1183, Article 5a(1)). Those implementing acts entered into force on 24 December 2024, so the deadline is 24 December 2026.

Consumers and age

Identity and age checks on shoppers arise from product rules. Under GewO § 114, traders may not supply alcoholic drinks to young people where provincial youth protection law prohibits it, and must establish age with an official photo ID, a youth card recognised under provincial law or E-ID authentication. The Supreme Administrative Court reads the ID duty as applying where there is justified doubt about age, and the offence as requiring an actual supply to a minor, not merely a weak control system (Ra 2026/04/0046, 30 April 2026). The provinces set the limits at 16 for alcohol and 18 for drinks containing spirits, and the rules of the province where the young person is apply. Six provinces prohibit supplying such drinks to minors without limiting the ban to particular places; Vienna, Lower Austria and Burgenland frame it around publicly accessible places and public events (Vienna also public facilities). Section 114 does not address distance selling, and the court's 2026 decisions concern unattended vending-machine shops, so whether these rules reach home delivery is unsettled (November 2026). Under the DSA, platforms accessible to minors must ensure a high level of privacy, safety and security, but are not obliged to process additional personal data to assess whether a user is a minor (Article 28(1) and (3)).

5. Digital channels: what's different

Bottom line: a physical shop has no duty to identify third-party sellers, but an online marketplace must identify, verify and report every business seller, and some products that may be sold over the counter cannot be sold online at all.

Seller verification is an online-only duty

Article 30 DSA and the DPMG apply only to online platforms. If a trader does not correct inaccurate or incomplete information, the platform must swiftly suspend it (DSA Article 30(3)). Under the DPMG, a seller who does not supply information after two written reminders at least seven days apart must, 60 days after the second reminder, either have the account closed and re-registration prevented, or have payment withheld until the information is provided (DPMG § 20).

Product bans and channel restrictions

The Tobacco and Non-Smoker Protection Act (TNRSG) bans distance selling of tobacco products and related products, defined to include e-cigarettes and liquids, novel tobacco products and tobacco-free nicotine products (§ 1(1e), § 2a). Distance selling of medicines is prohibited except for non-prescription medicines authorised or registered in Austria and sold by Austrian public pharmacies or by pharmacies authorised in another EEA state (Medicinal Products Act, AMG § 59(8) and (9)).

Online withdrawal function

For distance contracts concluded through an online interface, traders must provide a clearly labelled withdrawal function, available throughout the withdrawal period, through which consumers can send an online withdrawal notice (Distance and Off-Premises Contracts Act, FAGG § 13a). It applies to contracts concluded after 30 September 2026.

Pending change

A ministerial draft amending the Audiovisual Media Services Act and the KommAustria Act [Proposed, consultation closed 21 Sep 2026] would require video-sharing platforms with features such as recommendation algorithms or endless scrolling to deny access to users under 14.

6. Data protection and biometrics

The GDPR applies, supplemented by the Federal Act concerning the Protection of Personal Data (DSG) and supervised by the DSB. Seller identity collection rests on legal obligations under DSA Article 30 and the DPMG. A selfie match or liveness check that goes beyond these laws processes biometric data, a special category under Article 9 GDPR that needs its own exemption, usually explicit consent. The explanatory notes to the October 2026 Trade Act amendment state that an E-ID age check creates no obligation to keep data beyond confirming the customer's age.

Retention is fixed by the source law. DSA trader information must be stored securely for six months after the relationship ends and then deleted (Article 30(5)). DPMG reported information must be deleted ten years after the end of the reporting period (DPMG § 15(3)). Trader data may be disclosed only where the law requires it (DSA Article 30(6)), and Austrian courts may order intermediaries to disclose user data (ECG § 13).

7. Sector-specific obligations

DPMG reporting cycle

Reporting platform operators must send the seller information listed in DPMG § 13 to the Tax Authority Austria by 31 January each year for the previous reporting period, electronically (DPMG § 14). The duty arises only where the transaction was concluded and the consideration paid or credited. Sellers that sold goods fewer than 30 times for total consideration of no more than EUR 2,000 are excluded (DPMG § 5). Platforms must tell each seller what will be reported before each report (DPMG § 15(2)).

VAT record-keeping and deemed supplier status

A platform that facilitates supplies of goods ending in Austria to non-business customers, or services to non-business customers in Austria, must keep records on the underlying supplier and each transaction, including name, address, VAT or tax number and bank details where available (VAT Act § 18(11)). Platforms facilitating certain supplies of goods become the deemed supplier liable for VAT (§ 3(3a)), and platforms that breach due diligence can be liable for the tax (§ 27(1)).

Product safety on marketplaces

Since 13 December 2024 the General Product Safety Regulation (EU) 2023/988 requires marketplaces to designate contact points, register on the Safety Gate Portal, act on authority orders within two working days and process product-safety notices within three working days (Article 22).

Online pharmacies

A public pharmacy must notify BASG before selling medicines at a distance and display the EU common logo on every relevant page (AMG § 59a(2) and (3)).

8. Risk indicators and red flags

Marketplace and online retail fraud indicators

• Buyer sends a payment-confirmation link: phishing pages pose as a payment portal and authorise payments from the seller.
• Courier-pays-cash story: a buyer abroad proposes collection by a shipping service and asks the seller to prepay "insurance".
• Orders in someone else's name: online orders placed using another person's identity, and goods ordered but never paid for.
• Forged supporting documents: falsified payslips or registration certificates used to open online accounts or contracts.
• Fake and phishing shops: criminal webshops, whose number rises in the pre-Christmas period.
• Missing or forged CE marking and fake scarcity claims: practices the BWB identified on a large marketplace.

Internet fraud was the largest cybercrime category in 2025, with 31,001 reported cases (Cybercrime Report 2025).

9. Enforcement and penalties

KommAustria fines providers under Austrian jurisdiction; the European Commission supervises very large online platforms. KommAustria's published DSA decisions to November 2026 concern trusted flaggers, dispute settlement and user complaints, not marketplace fines; marketplace enforcement has so far used consumer and competition law.

Two 2026 cases involved Temu. In a court settlement of 20 March 2026, following a lawsuit brought for the consumer protection ministry, Temu committed to mandatory age checks for erotic products and defined dangerous products such as knives and crossbows, and to let users switch off personalised recommendations. In its March 2026 case report the BWB found breaches of the Federal Act Against Unfair Competition, issued a warning, and recorded that Temu stopped the practices.

10. Recent changes and what to watch

• 30 October 2026: E-ID age checks for alcohol[In force]. GewO § 114 now expressly allows traders to check age by E-ID authentication instead of a photo ID.
• 1 October 2026: online withdrawal function[In force]. Online contracts concluded after 30 September 2026 need a "withdraw from contract" function (FAGG § 13a).
• July 2026: age verification for video-sharing platforms[Proposed, consultation closed 21 Sep 2026]. The draft requires the most data-minimising methods available, separate from the platform, with identity checks to the standard of the Financial Markets Anti-Money Laundering Act and the Online Identification Regulation, or equivalent.
• March 2026: Temu settlement and BWB case report[Settlement final]. Age checks for restricted product categories are now a settlement term for a major marketplace.
• 1 January 2026: DPMG amendments[In force]. Federal Law Gazette I No. 96/2025 aligned definitions with the updated EU directive and clarified reporting when an identification service is used.
• 24 December 2026: European Digital Identity Wallets due[Adopted, deadline 24 Dec 2026]. Very large online platforms that require user authentication must also accept the wallets at the user's request (Regulation (EU) 2024/1183, Article 5f(3)).
• 10 July 2027: EU cash cap and AML Regulation[Adopted, applies 10 Jul 2027]. Traders may not accept cash above EUR 10,000 (Regulation (EU) 2024/1624, Article 80), and dealers in high-value goods, such as watches and jewellery over EUR 10,000, become obliged entities.

11. What this means for identity verification

• Verify sellers, not buyers. The legal burden falls on business sellers; shopper checks are needed for restricted products or to manage fraud.
• Accept documents and e-IDs. DSA Article 30 accepts an ID document copy or an eIDAS electronic identification, so ID Austria and EU Digital Identity Wallets fit.
• Validate tax numbers automatically. Build DPMG checks against official interfaces into onboarding rather than year-end review.
• Design for blocking and payout holds. Both the DSA and the DPMG require suspension or withheld payments when data stay incomplete.
• Keep two retention clocks. Six months after the relationship ends for DSA trader data; deletion ten years after the reporting period for DPMG data.
• Use age attributes, not full identity, for age checks. The E-ID route for alcohol and the draft rules for video-sharing platforms both favour confirming age without retaining identity data.