eCommerce & Marketplaces Compliance in Georgia

Georgia's online retail market is open. Since January 2024 the Law on Electronic Commerce has set information, contract and platform-liability rules for online sellers, alongside the 2022 consumer protection law. Both are enforced by the Georgian Competition and Consumer Agency, which can order corrections and fine traders up to 2 percent of annual turnover.

The identity framework for this sector is light by design. Georgian law gives platforms no general duty to monitor sellers, but it does require business sellers to be registered and identifiable, bans traders posing as consumers, and applies UN sanctions duties to everyone.

The biggest practical obstacle for a new entrant is age-restricted goods: tobacco cannot be sold online, and alcohol and nicotine sales require an age check that the law does not define.

1. Who regulates this sector

Georgia is a unitary state, so all the regulators below are national.

2. Licensing and authorisation

Article 3 of the Law of Georgia on Electronic Commerce (No. 3110-XIმს-Xმპ, 13 June 2023) states that providing commercial services over the internet is not subject to a licence, permit or authorisation. The exception is any activity that the Law on Licences and Permits or another law makes licensable, which keeps its licence online too.

The law applies to entrepreneurs registered in Georgia and to branches of foreign companies (Article 1(4)). It does not apply to gambling businesses, matters regulated by the National Bank of Georgia, or questions governed by the Tax and Customs Codes (Article 1(5)). A foreign platform with no Georgian branch is outside the e-commerce law's own scope, but the consumer protection law has no such limitation.

Sellers trading as a business must register. Under the Law of Georgia on Entrepreneurs (No. 875-Vრს-Xმპ, 2 August 2021), a business activity is a legitimate, repeated, independent and organised activity for profit (Article 2). Registration is mandatory and covers both state and tax registration, carried out by the National Agency of Public Registry (Article 8). An individual entrepreneur registers by application with an identity document (Article 11).

A marketplace that collects buyers' payments and passes them to sellers should assess whether this is a payment service. The National Bank of Georgia lists the services covered by Article 13 of the Law on Payment Systems and Payment Services. It also lists the exclusions, including payments made through a commercial intermediary between payer and payee, and technical providers that never hold the funds. A provider that falls inside the law registers with the National Bank and becomes subject to the AML law.

3. Identity framework (AML rules do not apply)

Online shops and marketplaces are not accountable persons under Article 3 of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 30 October 2019, consolidated to 1 April 2026). The AML obligations reach this sector only in narrow cases:

Payment handling

Payment service providers are accountable persons (Article 3(1)(a)). A marketplace that is itself a payment service provider takes on full customer due diligence.

Precious metals and stones

Traders in precious stones or metals are accountable persons, but must apply due diligence only on cash transactions above GEL 30,000, including linked transactions (Article 11(2)).

Factoring

Factoring companies and factoring platforms become accountable persons supervised by the National Bank from 1 January 2027 [Adopted, effective 1 Jan 2027].

For everyone else, identity duties come from four other sources:

• UN sanctions. Every natural and legal person must, without delay or notice, not make funds or other assets available to persons designated under UN Security Council sanctions, and must notify the Financial Monitoring Service (Articles 1(3), 41(7) and 41(8)). A first failure brings a warning and a repeat brings a GEL 1,000 fine (Article 43¹).
• Trader identity disclosure. Sellers must show who they are under the e-commerce and consumer laws (section 7).
• Platform rules. A court or an authorised body may ask a hosting platform for identification information on the users it stores content for (Law on Electronic Commerce, Article 14(2)).
• Business registration. Under the Law on Entrepreneurs, sellers trading as a business must be registered.

There is no beneficial ownership verification duty, suspicious activity reporting duty or record-keeping period for non-obliged sellers or platforms.

4. Identity verification and onboarding

Sellers

Georgian law does not prescribe a seller verification procedure for marketplaces. A platform that wants its sellers' storefronts to comply with Article 4 of the e-commerce law needs at least each business seller's company name, legal form, address, e-mail and other contact details, and registry identification number. Where the activity is licensed, the platform also needs the licence or permit number, its validity and the issuing body. Registry data is public, and anyone may view it and obtain an extract (Law on Entrepreneurs, Article 13), so the identification number can be checked against the registry.

Private individuals selling occasionally are not entrepreneurs and are not traders under consumer law, so consumer rights do not attach to their sales. Distinguishing them from traders matters. A trader who falsely presents itself as a consumer engages in a prohibited unfair commercial practice (Law on the Protection of Consumer Rights, Article 25(1)(q)).

Buyers and age

No identity check is required to sell ordinary goods. Age matters for restricted products:

• Alcohol, tobacco and nicotine. Providing a child (anyone under 18) with alcoholic beverages, tobacco or nicotine-containing products, free or for money, is prohibited (Code on the Rights of the Child, Articles 3(a) and 63(1)).
• Tobacco at the point of sale. The Law on Tobacco Control requires a seller who cannot be sure a buyer is 18 to ask for a document proving age before selling (Article 5(5)).
• Hazardous content. Selling films, computer games or other audio-visual products containing information hazardous to the child to a child is inadmissible (Code on the Rights of the Child, Article 66(4)).

Biometrics and third parties

Document capture and selfie or face-match checks are lawful only within the data protection rules in section 6. As no AML reliance regime applies, using an identity verification vendor is governed by data protection law. The vendor acts as a processor under a written agreement (Law on Personal Data Protection, Article 36).

5. Digital channels: what's different

Bottom line: the identity rules are largely channel-neutral, but selling online adds disclosure, cancellation and language duties, and tobacco cannot be sold online at all.

Trader information and cancellation

Article 4 of the e-commerce law requires the seller's details to be permanently and easily accessible, with prices showing delivery fees and taxes. Article 10 requires this information in Georgian. For distance contracts, the consumer law adds the trader's actual address, cancellation conditions and a model withdrawal form (Article 10). The buyer may withdraw within 14 calendar days without reason, extended by 12 months if the trader failed to give the required information (Article 13). These distance-contract rules do not apply to goods or services costing GEL 30 or less (Article 10(3)).

Age-restricted goods

The Law on Tobacco Control prohibits retail sale of tobacco products on the internet or by mail (Article 5(2)(j)). Nicotine-containing liquids, cartridges and capsules for electronic cigarettes count as tobacco products (Article 3(a)(a.f)). Accessories and devices, including electronic cigarettes, may be sold online only if they carry no tobacco-industry trademark or trade name. For alcohol, the under-18 prohibition applies equally online, but no statute specifies a remote age verification method.

Platforms

A hosting platform is not liable for stored information unless it has actual knowledge of illegality and fails to remove it promptly (e-commerce law, Article 13). Actual knowledge means knowledge based on a decision of a court or an authorised body (Article 2(j)). The safe harbour does not cover sellers acting on the platform's behalf or under its control (Article 13(2)). No authority may impose a general monitoring obligation on the platform (Article 14(1)).

6. Data protection and biometrics

The Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ, 14 June 2023, consolidated to 10 June 2026) governs identity capture; the e-commerce law refers to it directly (Article 6).

• Biometric data. Biometric data processed to uniquely identify a person, such as facial images, is special-category data (Article 3(b) and (d)). For a private seller or platform this usually means written consent (Article 6(1)(a)). Article 9 limits processing to cases where it is necessary, including for security or carrying out activities, and the purpose cannot be achieved by other means. Before processing, the controller must record in writing the purpose, volume, retention period, destruction procedure and safeguards (Article 9(2)).
• Minors. A person aged 16 or over may consent alone. Under 16, a parent's consent is needed and the controller must take reasonable steps to confirm it. Special-category data of any minor needs a parent's written consent (Article 7).
• Assessments and officers. A data protection impact assessment is mandatory for special-category data of a large number of people (Article 31(2)). A significant number means at least 3 percent of the population (Article 31(7)). Controllers processing data of a significant number of people must appoint a data protection officer (Article 33).
• Foreign platforms. A controller outside Georgia processing data with technical means in Georgia must appoint and register a special representative. The duty does not apply to controllers established in the EU or in countries with EU-recognised adequate protection (Article 34).
• Breaches and marketing. Incidents must be reported to the State Audit Office within 72 hours (Article 29). Direct marketing needs consent, and consent records must be kept for one year after the marketing ends (Article 12).

7. Sector-specific obligations

Contract mechanics

Before an electronic contract, the seller must explain the technical steps, storage of the contract, available languages and how to correct input errors (e-commerce law, Article 8). Orders must be confirmed electronically without delay (Article 9). The consumer must explicitly acknowledge that placing an order means an obligation to pay, otherwise they are not bound (consumer law, Article 12(2)). Goods must be delivered within 30 calendar days unless agreed otherwise (Article 7). Refunds after withdrawal are due within 14 days (Article 15).

Pricing and commercial communications

Selling price and unit price must be clear (consumer law, Article 6). Surcharges for a payment method may not exceed the trader's own cost (Article 9(1)). Commercial communications and the person sending them must be clearly identifiable, and discounts and promotional games must be clear (e-commerce law, Article 5).

Unfair practices that matter for platforms

The consumer law's blacklist (Article 25) includes the following:

• displaying trust marks without authorisation;
• false scarcity or countdown claims;
• implying that legally prohibited goods may be sold;
• traders posing as consumers.

Directly urging children to buy advertised goods is an aggressive practice (Article 27(1)(d)).

8. Risk indicators and red flags

Seller and listing red flags under Georgian law

• Hidden trader: a high-volume seller listed as a private individual with no registry number.
• Registry mismatch: the storefront name or address differs from the Registry of Entrepreneurs extract.
• Sanctions exposure: a seller, owner or payee matches a UN sanctions designation.
• Tobacco listings: cigarettes, heated tobacco or nicotine e-liquids offered for retail sale online.
• Unlicensed activity: listings for licensable services with no licence or permit data displayed.
• Fake urgency or trust marks: countdowns or quality badges without basis or authorisation.
• Under-18 buyers: alcohol or nicotine orders with signals that the buyer is a minor.

9. Enforcement and penalties

The Agency must publish its consumer and e-commerce decisions in full on its website, so its decisions on online traders are publicly searchable.

10. Recent changes and what to watch

• 1 January 2027 [Adopted, effective 1 Jan 2027]: factoring companies and factoring platforms become AML accountable persons (Law No. 1460 of 1 April 2026). Marketplaces offering seller financing through such partners should expect identity checks on sellers.
• 2 March 2026 [In force]: the State Audit Office replaced the Personal Data Protection Service as supervisor, with restated fines (Law No. 1289 of 17 December 2025). Breach notices and data protection officer details now go to the State Audit Office.
• 26 November 2025 [In force]: Law No. 1119 made UN sanctions duties enforceable against every person, with warnings and fines. Platforms need a screening step even though they are not obliged AML entities.
• 17 September 2024 [In force]: Law No. 4440 amended the Code on the Rights of the Child's definition of information hazardous to the child. Sellers of films and games should check catalogues against the current definition.
• January 2024 [In force]: the e-commerce law's trader information, contract and platform-liability provisions took effect, with Competition and Consumer Agency enforcement.

11. What this means for identity verification

• Seller checks. The core check is business verification, not personal identity: confirm the registry identification number, legal form and address, and any licence, against the public registry.
• Sanctions screening. Screening applies at seller onboarding and payout for all platforms, because the UN sanctions duty covers every person.
• Biometrics. Selfie and face-match steps are optional. Where used, they need written consent, a written purpose and retention record and, at scale, an impact assessment.
• Age checks. Age assurance for alcohol and nicotine is outcome-based: the law forbids supply to under-18s but names no remote method. Tobacco flows should be blocked entirely online.
• Children's data. Under-16s cannot consent to processing themselves, and a minor's biometric data needs a parent's written consent.