eCommerce & Marketplaces Compliance in Estonia

Estonia is open to online retail and marketplaces, and most of the rules that govern them come from directly applicable EU regulations, enforced nationally. The Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet, TTJA) is the central regulator: it is Estonia's Digital Services Coordinator and also enforces consumer protection, product safety and the rules on selling alcohol and tobacco. The Estonian Tax and Customs Board (Maksu- ja Tolliamet) supervises platform tax reporting and excise goods.

The identity question in this sector is mainly about sellers, not buyers. Marketplaces must verify the businesses that sell through them, while shops verify buyers only for age-restricted goods. The biggest obstacle for a new entrant is product scope: tobacco and related products cannot be sold online at all, and alcohol can only be sold online through a notified shop or catering business.

1. Who regulates this sector

The TTJA's role as the independent Digital Services Coordinator, and its supervision of the Platform-to-Business Regulation (EU) 2019/1150 and the Digital Services Act (Regulation (EU) 2022/2065), are set by § 12 of the Information Society Services Act (Infoühiskonna teenuse seadus). Very large online platforms are supervised by the European Commission for their systemic-risk obligations. Local governments also supervise parts of the alcohol and tobacco sales rules.

2. Licensing and authorisation

Estonia has no general licence for online shops or marketplaces. An information society service provider established in Estonia must comply with Estonian law wherever in the European Economic Area it provides the service (§ 3 of the Information Society Services Act), and must make the following permanently accessible: its name, registry code and register, address and email, any activity licence number, whether prices include taxes and delivery, and its value added tax (VAT) number (§ 4).

Authorisation depends on the products sold:

• Alcohol. Retail sale requires a notice of economic activities, which must give the website address when the sale is by e-commerce (§ 23 of the Alcohol Act, Alkoholiseadus). Online retail is allowed only through a shop or catering establishment recorded in the register of economic activities (§ 40(1) clause 12).
• Tobacco and related products. Retail sale requires a notice of economic activities (§ 18 of the Tobacco Act, Tubakaseadus), but both domestic and cross-border distance sales are prohibited (§ 22(2) clauses 6 and 7), so no online route exists.

A marketplace that receives buyers' money and passes it on to sellers should check whether that activity needs a payment services authorisation; the payment licensing rules sit outside this guide's scope. A provider established outside the EU that offers data storage or communication services in Estonia must appoint a legal representative in the EU for electronic evidence requests in criminal proceedings (§ 4¹, in force since 19 July 2026).

3. Identity framework (AML rules do not apply)

Online retailers and marketplaces are not, as such, obliged entities under the Money Laundering and Terrorist Financing Prevention Act (Rahapesu ja terrorismi rahastamise tõkestamise seadus). The Act reaches a trader only where a cash payment of at least €10,000 is made to or by it, as a single payment or as related payments over up to one year (§ 2(1) clause 5). In that case the trader must apply customer due diligence each time such a cash payment is made (§ 19(2)), report every cash transaction above €32,000 to the Financial Intelligence Unit within two working days (§ 49(3)), and keep identification records for at least five years (§ 47). Card, bank and wallet payments are not cash, so a purely online business does not normally meet this test. Persons dealing in precious metals and precious stones are covered regardless of payment method (§ 2(1) clause 6).

The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) [Applies from 10 Jul 2027] replaces this approach. It caps cash payments for goods and services at €10,000 (Article 80), and its recitals explain that ordinary traders in goods no longer need to be subject to AML obligations, with the exception of dealers in precious metals, precious stones, other high-value goods and cultural goods.

What governs identity for most of the sector instead is a combination of three regimes: seller verification for marketplaces under Article 30 of the Digital Services Act; seller due diligence for tax reporting under the Tax Information Exchange Act (Maksualase teabevahetuse seadus); and age checks for restricted goods under the Alcohol Act and the Tobacco Act. Financial sanctions under EU regulations apply directly to every business, so a marketplace that pays out to sellers should screen them against EU sanctions lists.

4. Identity verification and onboarding

Seller verification on marketplaces

Article 30 of the Digital Services Act requires providers of online platforms that let consumers conclude distance contracts with traders to obtain, before a trader can offer products to consumers in the EU:

• the trader's name, address, telephone number and email address;
• a copy of an identification document, or an electronic identification as defined in the eIDAS Regulation (EU) No 910/2014;
• payment account details;
• the trade register and registration number, where the trader is registered;
• a self-certification that it will only offer products that comply with EU law.

The platform must make best efforts to check that this information is reliable and complete, using freely accessible official databases or interfaces, or supporting documents from reliable sources. If it later has reason to believe the data is inaccurate, it must ask the trader to correct it and suspend the trader if the trader does not. The trader is liable for the accuracy of what it provides (Article 30(2) and (3)). The obligation does not apply to micro and small platforms, unless they are designated as very large online platforms (Article 29).

Seller due diligence for tax reporting

Under the Tax Information Exchange Act, a platform operator must identify its reportable sellers by 31 December each year (§ 20²⁴(1)). It may rely on information collected and verified within the last 36 months unless it has reason to doubt it (§ 20²⁴(3)), and may use a third party, but remains responsible for compliance (§ 20²⁴(4)). Sellers of goods with fewer than 30 sales and no more than €2,000 in fees in the year are excluded (§ 20²²(3) clause 4).

Buyer age verification

For alcohol, the person handing over the goods must establish the recipient's age from an identity document, unless the recipient is clearly an adult or known to them, and may not hand over the goods if an apparent minor does not show a document (§ 47(3) of the Alcohol Act). The Tobacco Act imposes the same identity document check on sellers (§ 28(2) to (4)). Under the Personal Data Protection Act (Isikuandmete kaitse seadus), where an information society service relies on consent, a child can consent alone from the age of 13; below that, a legal representative must consent (§ 8).

5. Digital channels: what's different

Bottom line: the biggest difference is product scope: tobacco and related products cannot be sold at a distance at all, and alcohol can be sold online only through a notified shop or catering business, with the age check moved to the doorstep.

Alcohol: online only through a notified place of business

The Alcohol Act lists e-commerce as a permitted retail form only through a shop or catering establishment recorded in the register of economic activities (§ 40(1) clause 12), and an undertaking may sell only through the place of business named in that register (§ 41(6)). Handing alcohol to a consumer as part of a delivery service is prohibited between 22:00 and 10:00 (§ 41(5)), and the identity document check applies at the moment of handover (§ 47(3)). This makes the courier step, not the checkout, the legally required age check.

Age assurance at checkout

The Commission's guidelines on Article 28 of the Digital Services Act [Published 10 Oct 2025] treat access restrictions backed by age verification as appropriate and proportionate for online platforms where alcohol, tobacco or nicotine-related products are sold, and state that self-declaration is not an appropriate age-assurance measure (Communication C/2025/5519, section 6.1.3.1). Commission Recommendation (EU) 2026/1035 of 29 April 2026 aims for privacy-preserving proof-of-age tools to be available to all EU citizens by the end of 2026, as standalone apps or within European Digital Identity Wallets.

Remote powers against online interfaces

The TTJA can order a provider to remove information, restrict access to an online interface or display a warning to consumers where EU consumer law is breached and there is no other effective remedy (§ 62² of the Consumer Protection Act). The Tax and Customs Board has a similar power when a platform fails to report seller data (§ 22¹ of the Tax Information Exchange Act).

6. Data protection and biometrics

The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies directly and is supplemented by the Personal Data Protection Act, supervised by the Data Protection Inspectorate. Seller verification has its own retention rule: marketplaces must store trader data securely for six months after the contractual relationship ends and then delete it, and may disclose it only where the law requires (Article 30(5) and (6) of the Digital Services Act). Article 28(3) of the same Regulation states that protecting minors does not oblige platforms to process additional personal data to assess whether a user is a minor.

Where onboarding uses face matching to confirm that a seller is the person on the identity document, that comparison processes biometric data for the purpose of uniquely identifying a person, which is a special category under Article 9(1) GDPR and needs a condition under Article 9(2), such as explicit consent. Age checks are best designed to return only an over or under 18 result, which fits both the data minimisation principle and the Commission's age-verification guidance. GDPR breaches carry fines of up to €20,000,000 or 4% of worldwide annual turnover, whichever is higher (§ 65 of the Personal Data Protection Act).

7. Sector-specific obligations

Consumer information on marketplaces

For goods offered on an online marketplace, the material information that must be given includes whether the third party offering them is a trader, based on that party's declaration to the marketplace (§ 17(2) clause 8 of the Consumer Protection Act, Tarbijakaitseseadus). Where consumers search across offers, the main ranking parameters and their relative importance must be disclosed (§ 17(2¹)). Claiming that reviews come from real buyers without taking reasonable steps to verify this, and submitting or commissioning fake reviews, are misleading practices (§ 16).

Product safety on marketplaces

Under the General Product Safety Regulation (Regulation (EU) 2023/988), which has applied since 13 December 2024, online marketplaces must register with the Safety Gate Portal, designate single points of contact for authorities and consumers, keep internal product safety processes, and act on orders concerning dangerous product offers within two working days (Article 22).

Platform tax reporting (DAC7)

Platform operators resident in Estonia, and non-EU operators that register in Estonia, report information on reportable sellers to the Tax and Customs Board by 31 January of the following year (§ 20²⁵(1) of the Tax Information Exchange Act). The operator must give each seller the information about them before reporting it (§ 20²⁵(5)). No report is due where no reportable sellers were found, if the operator tells the Board by 31 January (§ 20²⁵(3)).

8. Risk indicators and red flags

Seller identity and compliance indicators

• Register mismatch: the name or registration number does not match the trade register entry the seller cites.
• Payout account mismatch: payment account details belong to a person or entity other than the verified trader.
• Shared credentials: one identity document or payment account behind several seller accounts.
• Trader posing as consumer: high-volume or repeat listings by a seller declared as a private person.
• Prohibited listings: tobacco or related products offered for delivery, which is a prohibited distance sale.
• Review manipulation: bursts of unverified positive reviews on new listings.
• Large cash settlement: a request to pay €10,000 or more in cash, which brings the trader into AML scope.
• Missing tax data: sellers who stall on providing information needed for platform tax reporting.

9. Enforcement and penalties

Estonian misdemeanour fines for individuals are set in fine units; one fine unit equals €8 (§ 47(1) of the Penal Code, Karistusseadustik, since 1 January 2025). Fines for legal persons are set per offence in each Act:

Domain blocking for tax reporting failures requires a prior warning with an additional term of at least 90 days (§ 22¹(4) of the Tax Information Exchange Act). The TTJA and the Tax and Customs Board may make test purchases to check compliance with the consumer, alcohol and tobacco rules (§ 63 of the Consumer Protection Act; § 33² of the Tobacco Act).

10. Recent changes and what to watch

• 10 July 2027 [Adopted, applies 10 Jul 2027]: the EU Anti-Money Laundering Regulation's €10,000 cash payment cap applies; plan checkout and cash-on-delivery limits now.
• 1 November 2026 [Adopted, effective 1 Nov 2026]: amendments to the Alcohol Act remove the requirement for alcohol to be entered in the state register of alcohol; the e-commerce, delivery and age rules are unchanged.
• 27 September 2026 [In force]: Consumer Protection Act rules on environmental claims and on goods with digital elements took effect; product pages need substantiated green claims.
• 19 July 2026 [In force]: providers of data storage and communication services must appoint an EU legal representative for electronic evidence requests (§ 4¹ of the Information Society Services Act).
• 13 July 2026 [In force]: maximum fines for unfair commercial practices rose to €400,000, and to 4% of turnover for large-scale or EU-scale breaches.
• 29 April 2026 [Adopted, non-binding]: Commission Recommendation (EU) 2026/1035 sets a common framework for EU age-verification tools, targeting availability by the end of 2026.
• 10 October 2025 [Published]: Commission guidelines on protecting minors under Article 28 of the Digital Services Act name online sales of alcohol and tobacco as cases for age verification.

11. What this means for identity verification

For marketplaces, the core flow is know-your-business-customer onboarding of sellers: capture an identity document or eIDAS electronic identification, confirm the trade register entry against an official database, and check that the payment account belongs to the verified trader before any listing goes live. Keep a re-verification trigger for when data appears inaccurate, because Article 30(3) requires suspension until it is corrected. Retention is short: six months after the seller relationship ends for Digital Services Act data, while tax due diligence can be reused for up to 36 months.

For age-restricted goods, two checks are needed: an age verification at checkout, which the Commission's guidance expects to be stronger than self-declaration, and an identity document check by the courier at handover, which the Alcohol Act requires. Returning a simple over-18 result keeps data processing to the minimum. Where face matching is used, treat it as special category processing under Article 9 GDPR. Tobacco and related products should be blocked from Estonian delivery addresses entirely.