eCommerce & Marketplaces Compliance in Latvia

Latvia is open to online retail and marketplaces from Latvia and from elsewhere in the European Union. Rules come from two layers: directly applicable EU regulations (the Digital Services Act, the General Product Safety Regulation, the General Data Protection Regulation) and Latvian statutes on consumer rights, alcohol, tobacco, tax reporting and electronic identification.

The Consumer Rights Protection Centre is the central authority: it enforces consumer and unfair commercial practice law, is Latvia's Digital Services Coordinator and can block access to websites. The State Revenue Service handles platform tax reporting, alcohol licensing and enforcement of the tobacco distance-sale ban.

The biggest obstacle for a new entrant is product-specific: an age-restricted range (alcohol, tobacco products) changes the onboarding flow, the delivery process and, for tobacco, whether the product can be sold online at all. Marketplaces shipping from outside the EU also face new customs charges introduced in 2026.

1. Who regulates this sector

2. Licensing and authorisation

Running an online shop or marketplace requires no sector licence; obligations attach to the goods sold and the business's role.

Alcohol

Online retail is permitted under Section 6.¹ of the Alkoholisko dzērienu aprites likums (Handling of Alcoholic Beverages Law), but the place of sale is the website or mobile app named in the special retail licence; VID requires the site to be registered as a structural unit first. Only cashless payment is allowed online (small breweries have a narrow exception), and every other distance sale of alcohol is prohibited by Section 6(1)(8).

Tobacco and e-cigarettes

Section 8(2) of the Tobacco Products Circulation Law prohibits selling tobacco products, tobacco substitutes, e-cigarettes and refill containers to consumers by distance means, including from outside the EU. There is no online licence route.

Marketplaces

No authorisation, but the Digital Services Act imposes trader traceability, and the General Product Safety Regulation requires a registered single point of contact on the EU Safety Gate Portal.

Payment handling

Under the Law on Payment Services and Electronic Money, payment services may be provided only by the institutions listed in Section 2(2); Latvijas Banka decides licence applications within three months (Section 24). Payments made through a commercial agent authorised to act only for the buyer or only for the seller are excluded (Section 3(1)(2)).

3. Identity framework (AML rules do not apply)

Online retailers and marketplaces are not, as such, obliged entities under the Noziedzīgi iegūtu līdzekļu legalizācijas un terorisma un proliferācijas finansēšanas novēršanas likums (Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing). Section 3(1)(9) brings in persons trading in goods or providing services only where payment is made in cash, or cash is paid into the seller's bank account, of 10,000 euro or more, in one operation or several linked ones. A business in scope is supervised by VID and must notify it within ten working days of starting the business relationship (Section 45(2)(5) and (4)).

In practice the trigger is rarely reached lawfully. Under Section 30 of the law Par nodokļiem un nodevām (On Taxes and Fees), businesses declare by the 15th of each month cash transactions with each other above 1,500 euro and may not make cash transactions above 7,200 euro (Section 30(1)); private individuals face the same cap (Section 30(8)). In retail sales the cap and the declaration duty fall only on the buyer (Section 30(4)), except that businesses declare by 1 February each year cash transactions with non-business individuals above 3,000 euro in a single operation (Section 30(7)).

Two points apply regardless. Section 3.¹ obliges persons outside the obliged-entity list to report every suspicious transaction to FIU Latvia, and payment providers, as obliged entities, will ask for merchant due diligence (KYB) data.

The EU Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027. It keeps traders of ordinary goods outside the obliged-entity list and caps cash payments for goods or services at 10,000 euro (Article 80), with lower national limits allowed. [Adopted, applies 10 Jul 2027]

4. Identity verification and onboarding

Seller verification on marketplaces

Article 30 of the Digital Services Act (Regulation (EU) 2022/2065) requires marketplaces to obtain, before a trader can offer products: name, address, telephone and email; a copy of an identification document or other electronic identification under eIDAS (Regulation (EU) No 910/2014); payment account details; the trade register and registration number where registered; and a self-certification that only compliant products will be offered. The platform must make best efforts to check these details against free official databases or reliable documents and swiftly suspend traders who do not correct them. Micro and small platforms are exempt (Article 29).

Seller due diligence for tax reporting

Cabinet Regulation No. 97 of 7 March 2023 (Latvia's transposition of the EU platform reporting rules, known as DAC7) requires reporting platform operators to collect, for individual sellers, name, principal address, tax identification number (or place of birth if none), VAT number and date of birth; for entity sellers, name, address, tax identification number, VAT number, business registration number and permanent establishments (points 7 and 8). Sellers with fewer than 30 sales of goods and no more than 2,000 euro of consideration in the period are excluded (point 2.16.4). Where a tax authority flags inaccurate data, the operator must request independent evidence such as a government identity document (point 14).

Buyer age verification

For alcohol, Section 6.¹(4) of the Handling of Alcoholic Beverages Law requires the retailer, before the sale and before taking payment, to verify the buyer's identity and age with a qualified or qualified increased security electronic identification means, or with an electronic identification means meeting the strong customer authentication requirements of Directive (EU) 2015/2366. The minimum age is 18 (Section 6(2)). VID's guidance gives an e-signature and online-bank authentication as examples, and notes that the state-owned Latvijas Valsts radio un televīzijas centrs (LVRTC) provides a technical solution for the check free of charge. Under the Fizisko personu elektroniskās identifikācijas likums (Law on Electronic Identification of Natural Persons), Section 3(3), identification with a qualified or qualified increased security means is equivalent to an in-person check of an identity document.

5. Digital channels: what's different

Bottom line: a physical shop checks a buyer's age by looking at an identity document; online, Latvian law requires an electronic identification check before payment for alcohol, bans distance sales of tobacco and e-cigarettes, and adds seller verification and withdrawal duties that a shop counter never triggers.

Online alcohol sales in practice

The European Commission's guidelines under Article 28 of the DSA (C/2025/5519) treat the sale of alcohol or tobacco on online platforms as a case for age verification and consider self-declaration inappropriate. Delivery may not take place earlier than six hours after the order, or outside 10:00 to 20:00 Monday to Saturday and 10:00 to 18:00 on Sundays (both since 1 August 2025), and the courier must ask for an identity document (Section 6.¹(6) and (7)); an unattended delivery service must use the same electronic identification means (Section 6.¹(8)). Small breweries that verify identity and age before purchase and at delivery may skip electronic identification (Section 6.¹(9)). Since 1 August 2025, price and discount advertising for alcohol is banned online, including in the shop itself, and multi-buy or loyalty discounts are prohibited (Section 11(5) and (7)).

Online withdrawal function

Cabinet Regulation No. 562, in force 25 September 2026, added Chapter III.¹ to Regulation No. 255 on distance contracts: contracts concluded online need a clearly labelled withdrawal function ("Atteikties no līguma"), available for the whole 14-day period, with an electronic acknowledgement.

Marketplace transparency

Point 5.¹ of Regulation No. 255 requires marketplaces to tell consumers how offers are ranked and whether the third party is a trader, based on its own declaration.

6. Data protection and biometrics

The GDPR applies, with the Fizisko personu datu apstrādes likums (Personal Data Processing Law), supervised by the DVI.

• Children's consent. Under Section 33 of the Personal Data Processing Law, where an information society service relies on consent, a child aged 13 or over can consent; below 13, a parent or guardian must.
• Biometrics. Facial images used to uniquely identify a person are biometric data, a special category under Article 9 GDPR that is prohibited unless an exception applies, typically explicit consent. The DVI's 2021 guidance says private use of facial recognition for marketing or security can be based only on consent; where it carries out a task delegated by legislation, the public-interest basis (GDPR Articles 6(1)(e) and 9(2)(g)) may apply; an impact assessment is needed first. Age classification without a unique-identification template may not be biometric processing. Where the law prescribes eID for alcohol, a biometric selfie check is not needed to comply.
• Minimisation and retention. Article 28(3) DSA states that protecting minors does not oblige platforms to process additional personal data to assess age. Trader data collected under Article 30 DSA must be stored securely for six months after the contract ends and then deleted (Article 30(5)), while DAC7 records must be kept for five to ten years after the reporting period (Regulation No. 97, point 40).

7. Sector-specific obligations

Digital Services Act enforcement in Latvia

Section 19.¹ of the Informācijas sabiedrības pakalpojumu likums (Law on Information Society Services) has designated PTAC as Digital Services Coordinator since 21 June 2024; it may inspect without a court warrant (Section 19.³). Under Article 56 DSA it supervises platforms whose main establishment is in Latvia; others answer to their home coordinator or, for very large platforms, the Commission.

Platform tax reporting

Under Regulation No. 97, a reporting platform operator files seller data with VID by 31 January following the reporting year (point 22). If a seller does not supply the data after the initial request and two reminders, and no earlier than 60 days after the request, the operator must close the account and prevent re-registration, or withhold payouts until the data is provided (point 39). Since 1 January 2026 (Regulation No. 380 of 25 June 2025), operators may rely on an identification service provided free of charge by a Member State or the EU to confirm a seller's identity and tax residence.

Product safety

Since 13 December 2024, Article 22 of Regulation (EU) 2023/988 (General Product Safety Regulation) requires online marketplaces to designate single points of contact for market surveillance authorities and consumers and to register on the Safety Gate Portal.

Other age limits

Since 1 January 2025, Section 8(3) of the Tobacco Products Circulation Law sets the minimum age at 20 (previously 18), with ID required from buyers aged 20 to 25 (Section 8(4)). Energy drinks may not be sold to under-18s, with the retailer asking for an identity document (Energy Drinks Circulation Law, Section 3(1)); the law sets no separate online method.

8. Risk indicators and red flags

Seller and fraud indicators drawn from PTAC, FIU Latvia, the DSA and Regulation No. 97

• Missing trader identity: no company name, registration number, legal address or working contact details on the shop or listing.
• Details that do not match official registers: registration data that differs from the public register or a VAT number that does not validate.
• Non-delivery and refused refunds: repeated complaints about undelivered orders and money not returned, the pattern behind PTAC's 2026 blocking decision.
• Re-launch under a new domain: the same operator reappearing on a new website or social media account after a block.
• Seller refusing tax data: a paid seller who does not supply a tax identification number or date of birth after reminders.
• Fictitious sales through shop accounts: online shop accounts receiving criminal proceeds disguised as fictitious sales, or trades at inflated or deflated prices (FIU Latvia typologies 5 and 6).
• Hidden third-country origin: a shop that presents as local but ships from outside the EU, which PTAC and ECC Latvia flag as a source of complaints.
• Restricted goods in listings: tobacco or e-cigarettes offered for delivery to Latvian consumers, or alcohol offered without a licensed website.

9. Enforcement and penalties

One fine unit is five euro (Administrative Liability Law, Section 16(2)). As Digital Services Coordinator, PTAC reported 59 DSA complaints and 497 orders against illegal content notified to it in 2025. It also restricts access to websites under Section 26.¹⁵ of the Consumer Rights Protection Law. On 5 January 2026 it blocked, until 30 December 2027, the shop and social media pages of SIA "Heavenly Furniture" after 93 complaints in 2025 about undelivered goods and refunds, and a new domain launched despite earlier blocks. On 23 October 2026 it found that 220.lv (SIA "Pigu Latvia") unfairly refused to refund standard delivery costs on withdrawal.

10. Recent changes and what to watch

• September 2027: new Union Customs Code applies[Adopted, applies 21 Sep 2027]. Regulation (EU) 2026/2108 replaces the current code; its handling fee provision already applies.
• July 2027: EU Anti-Money Laundering Regulation applies[Adopted, applies 10 Jul 2027]. EU-wide 10,000 euro cash cap; ordinary online retail stays outside the obliged-entity list.
• EU age verification and digital identity[Wallet due 24 Dec 2026]. Commission Recommendation (EU) 2026/1035 sets a common framework for age verification tools. Cabinet Order No. 483 of 13 August 2026 approved the State Digital Development Agency's project to implement the EU Digital Identity Wallet, due by 24 December 2026 under Regulation (EU) 2024/1183.
• November 2026: 2 euro handling fee on non-EU online purchases[In force 1 Nov 2026]. Delegated Regulation (EU) 2026/2152 sets the fee under Article 20(2) of Regulation (EU) 2026/2108 for goods sold in distance sales from outside the EU; it is payable at purchase where the seller uses IOSS. Product identifiers are also required for such goods up to 150 euro (Delegated Regulation (EU) 2026/1022).
• September 2026: online withdrawal function[In force 25 Sep 2026]. Regulation No. 562 requires a withdrawal button for contracts concluded online.
• EU KIDS Act[Proposed 17 Sep 2026]. A Commission proposal (COM(2026) 681) for harmonised age assurance rules; its scope covers social networks, video platforms, app stores, games, operating systems and AI chatbots, not online marketplaces.
• July 2026: end of the 150 euro customs relief[In force 1 Jul 2026 to 1 Jul 2028]. Regulation (EU) 2026/382 applies a customs duty of 3 euro per item to consignments up to 150 euro sold under IOSS or sent by post.
• January 2026: EU identification service for DAC7[In force 1 Jan 2026]. Regulation No. 380 lets platforms rely on an official identification service to confirm seller identity and tax residence.
• August 2025: online alcohol rules tightened[In force 1 Aug 2025]. Delivery hours aligned with trading hours, a six-hour delivery delay and a ban on online price advertising; packaging limits follow on 1 January 2028.

11. What this means for identity verification

• Verify sellers, not every buyer. Collect an identity document or eIDAS eID, payment account and registry data, with a suspension workflow.
• Plan for tax data. Collect tax numbers and dates of birth from paid sellers and automate the 60-day closure rule.
• Use eID for alcohol. Build the pre-payment age check on qualified or qualified increased security eID means (such as the chip in the national identity card, or schemes notified under eIDAS) or bank-grade strong customer authentication, and capture a second document check at delivery.
• Block, do not verify, for tobacco. Age verification cannot make a distance sale of tobacco or e-cigarettes lawful.
• Record where goods ship from. For cross-border sellers, capture country of dispatch and import scheme, since customs charges now apply per item.
• Minimise and time-limit data. Apply the six-month DSA and five-to-ten-year DAC7 retention periods separately.