eCommerce & Marketplaces Compliance in the United States

The US market is open to online marketplaces and sellers without a federal licence. Obligations come instead from consumer protection, tax reporting, children's privacy and product-specific rules, most of which are triggered by activity on the platform rather than by a licence.

The Federal Trade Commission is the principal federal authority, sharing enforcement of the marketplace transparency statute with state attorneys general. The Internal Revenue Service sets the payment reporting that drives seller tax identification, and the Drug Enforcement Administration and Customs and Border Protection regulate specific goods and imports.

The biggest obstacle for a new entrant is operational: tracking when each seller crosses the high-volume threshold and completing collection, verification and, where required, disclosure on 10-day clocks, while running age checks that satisfy state laws without retaining more data than the children's privacy rule allows.

1. Who regulates this sector

There is no single eCommerce regulator: federal agencies own particular duties, and states enforce federal marketplace law and their own statutes.

State privacy regulators, such as the California Privacy Protection Agency, and state licensing bodies for alcohol, tobacco and other restricted goods also apply where a platform sells into their state.

2. Licensing and authorisation

Operating an online store or a third-party marketplace requires no federal licence or registration. The defining federal statute for marketplaces, the INFORM Consumers Act (15 U.S.C. 45f), imposes conduct duties rather than authorisation. It took effect on 27 June 2023 and covers any consumer-directed platform that lets third-party sellers sell, take payment for, store, ship or deliver consumer products in the United States, is used by at least one such seller and has a contractual relationship with buyers. Small niche platforms are covered as well as national names.

Authorisation matters in three cases: a platform that holds and transmits buyers' funds outside the payment processor exemption may be a money transmitter, a separate federal and state regime; a retailer of pseudoephedrine products must self-certify staff training to the Department of Justice before selling; and importers must file formal customs entries for parcels that once entered under the de minimis exemption.

3. Identity framework (AML rules do not apply)

Selling goods online does not make a business a "financial institution" under the Bank Secrecy Act, so there is no customer identification programme or suspicious activity reporting for buyers. The boundary is the money transmitter definition, which excludes a person that only acts as a payment processor facilitating the purchase of goods or services through a clearance and settlement system by agreement with the seller (31 CFR 1010.100(ff)(5)(ii)(B)). FinCEN's rulings require that the service facilitate a purchase, run through clearance and settlement systems admitting only BSA-regulated institutions, and rest on a formal agreement with at least the seller receiving the funds. Paying sellers by other means, such as monetary instruments, can take a platform outside the exemption.

In place of an AML regime, identity obligations in eCommerce come from four sources:

Seller verification

The INFORM Consumers Act requires collection and verification of identity, tax and bank details from high-volume third-party sellers.

Tax reporting

Payment platforms must report sellers paid more than $20,000 over more than 200 transactions in a calendar year on Form 1099-K, which requires the seller's taxpayer identification number.

Cash reporting

Any trade or business receiving more than $10,000 in cash in one or related transactions files Form 8300 within 15 days, after examining the payer's identification document.

Sanctions

All US persons, including US-incorporated platforms, must comply with OFAC sanctions, which in practice means screening sellers and counterparties.

4. Identity verification and onboarding

Who is a high-volume third-party seller

A third-party seller becomes "high-volume" on a given marketplace when, in any continuous 12-month period during the previous 24 months, it has entered into 200 or more discrete sales of new or unused consumer products and $5,000 or more in gross revenue. Only sales paid through the marketplace or its processor count. Excluded are the marketplace itself and a business that publicly discloses its name, address and contacts, supplies the marketplace under an ongoing contract and has already provided verified identifying information.

What must be collected

Within 10 days of qualifying, the seller must provide a bank account number (or payee name), which may sit with a processor if retrievable within 3 business days; a business or personal taxpayer identification number; a working email address and phone number; and contact information. For an individual seller, contact information is the individual's name. For any other seller it is either a copy of a valid government-issued identification for an individual acting on the seller's behalf, or a copy of a valid government-issued record or tax document showing the business name and physical address.

How verification works

The marketplace must verify the information within 10 days of collection, and any change within 10 days of being notified. The statute names no method: "verify" means confirming, by one or more methods, that the information and documents are valid, correspond to the seller or its representative, and are not misappropriated or falsified. A valid government tax document is presumed verified as of its issue date. Document authentication, face matching and tax number checks all fit.

Ongoing duties

At least annually, each high-volume seller must electronically certify within 10 days of a reminder that its information is current. A seller that fails to provide information or certification gets notice and 10 days to comply, then must be suspended from future sales until it does. Data collected for the statute must be secured and may not be reused unless the law requires it.

Age verification

No federal statute sets a general age-verification duty for online retail. Age checks come from state law for particular content and goods and from the children's privacy rule (section 7).

5. Digital channels: what's different

Bottom line: most eCommerce identity rules exist only online. A physical shop has no duty to verify the businesses that supply it or to disclose them to customers, and checks age by looking at an ID card; an online marketplace must verify high-volume sellers on statutory clocks and must age-gate remotely under state law and the children's privacy rule.

Verification that has no counter-side equivalent

The INFORM Consumers Act's clocks run from the moment a seller crosses the threshold on that platform, so marketplaces need continuous counting of platform-paid sales over a rolling window, then remote collection and verification. The FTC's first case turned on online presentation, including disclosures missing from gamified listings and the mobile website.

Remote age checks are constitutionally tested

In Free Speech Coalition v. Paxton (27 June 2025) the Supreme Court held that Texas's requirement for commercial websites with sexual material harmful to minors to verify that visitors are 18 or older is subject to intermediate scrutiny and survives it. The Court reasoned that proof of age serves the same function online as in a shop, and called the permitted methods, government-issued identification and transactional data, used directly or through a third-party service, plainly legitimate.

Cash in person, platform payments online

A physical business taking more than $10,000 in cash must examine an identification document and report the payer. A platform paying sellers is a third party settlement organisation and must instead obtain each payee's taxpayer identification number to report on Form 1099-K above the threshold, and apply backup withholding where no number is provided.

6. Data protection and biometrics

There is no single federal data protection statute or authority. Identity data captured by an eCommerce platform is governed by sector rules (the INFORM Consumers Act's use limitation and security duty, the COPPA Rule), by the FTC's general power over unfair and deceptive practices, and by state comprehensive privacy and biometric laws, such as those in Illinois, Texas and Washington.

For children, the amended COPPA Rule now expressly treats as personal information government-issued identifiers (such as passport or state ID numbers) and biometric identifiers usable for automated recognition, such as fingerprints, voiceprints, facial templates and faceprints. Operators may keep children's personal information only as long as reasonably necessary for the purpose collected, may not retain it indefinitely, and must publish a written data retention policy in their online notice (16 CFR 312.10).

For adults, the FTC's 2023 biometric policy statement treats facial images and templates as biometric information and will scrutinise failures to assess foreseeable harms before collection, surreptitious collection, weak vendor oversight and failure to monitor performance, including across demographic groups.

7. Sector-specific obligations

Disclosure and reporting on listings

For a high-volume seller with $20,000 or more in annual gross revenue on the platform, the marketplace must clearly disclose the seller's full name, physical address and direct contact details on the listing page or in the order confirmation and account history. Partial disclosure is allowed where the seller certifies it has only a residential address or a personal phone number, but false certifications or unresponsiveness to buyers trigger notice and suspension. Every high-volume seller's listing must also show an electronic and telephone mechanism for reporting suspicious activity. State laws that conflict with these requirements are preempted.

Children's privacy and age assurance

The COPPA Rule covers services directed to children under 13 and general-audience operators with actual knowledge that they collect a child's data. The 2025 amendments took effect on 23 June 2025, with general compliance from 22 April 2026. Verifiable parental consent comes first; methods include a payment card transaction, a call or video call with trained staff, a government ID checked against databases, knowledge-based questions, a government photo ID matched to a live image by facial recognition and confirmed by trained staff (with ID and images deleted promptly) and, where data is not disclosed, email-plus or the new text-plus method. Under the FTC's February 2026 enforcement policy statement, mixed-audience and general-audience operators may collect personal information solely to determine age without prior parental consent if they use and share it only for that purpose, bind vendors to protect and delete it, delete it promptly, disclose it, secure it, use reasonably accurate methods and otherwise comply with the rule. An age check that identifies a user as under 13 gives the operator actual knowledge.

Regulated goods sold remotely

Under the Combat Methamphetamine Epidemic Act, an in-store seller of pseudoephedrine products checks government photo identification and keeps a signed logbook for two years; a mail-order seller confirms the purchaser's identity before shipping, within 7.5 grams per customer per 30 days.

8. Risk indicators and red flags

eCommerce is not an AML-obliged sector, so the relevant indicators are fraud and identity abuse that the governing rules are designed to catch.

Seller and buyer identity red flags

• Threshold splitting: one operator running several seller accounts that each stay under 200 sales or $5,000.
• Mismatched identity data: tax identification number, government ID and bank account names that do not correspond.
• Address claims to avoid disclosure: residential-address certifications from sellers with commercial volumes, or no response to buyers.
• Stolen or counterfeit stock: new goods sold well below market price in bulk, the conduct the INFORM Consumers Act targets.
• Structured cash payments: payments broken up to stay at or below $10,000, which Form 8300 rules treat as related transactions.
• Unverified recipients: restricted goods shipped to a third party whose identity and address have not been checked.
• Age-gate gaming: repeated age attempts with changed birth dates on mixed-audience services.

9. Enforcement and penalties

A violation of the INFORM Consumers Act or of the Take It Down Act's platform duties is treated as a violation of an FTC rule, so the FTC can seek civil penalties per violation under Section 5(m)(1)(A) of the FTC Act. The maximum is $53,088 per violation (16 CFR 1.98(d)), set in January 2025; the FTC confirmed on 15 September 2026 that it will make no adjustment for 2026 and will continue to apply the 2025 levels. State attorneys general may also sue under the INFORM Consumers Act for injunctions, the same penalties and restitution, but not against a defendant already facing an FTC action on the same violations.

The first INFORM Consumers Act case (5 September 2025) settled allegations against Whaleco, Inc., operator of Temu, for a $2 million civil penalty. The complaint alleged no telephone reporting mechanism and missing or hard-to-find disclosures on gamified listings and the mobile site; the order requires clear disclosures on every version of the platform.

Form 8300 failures carry IRS penalties, with a minimum of $25,000 for intentional disregard, and structuring to avoid reporting can be prosecuted criminally.

10. Recent changes and what to watch

• 15 September 2026: FTC civil penalty maximums unchanged for 2026 [In force]. The $53,088 per-violation figure continues to apply.
• 10 August 2026: IRS final regulations on backup withholding for third party network transactions [In force]. Platforms backup withhold only once a payee passes the $20,000 and 200-transaction threshold, for payments from 2025 onward.
• 19 May 2026: Take It Down Act notice-and-removal duties [In force]. Covered platforms must remove nonconsensual intimate images and known identical copies within 48 hours of a valid request.
• 22 April 2026: general compliance date for the amended COPPA Rule [In force]. Biometric and government identifiers, retention limits and the new consent methods now apply in full.
• 25 February 2026: FTC enforcement policy statement on age verification [Optional relief]. Operators that meet its conditions can collect data to determine age without prior parental consent; the FTC intends to review the COPPA Rule on age verification, and no proposal had been published as of October 2026.
• 24 February 2026: Executive Order 14388 continues the suspension of duty-free de minimis treatment for all countries first ordered on 30 July 2025 [In force]. Low-value parcels other than postal shipments need a formal entry in CBP's system by a qualified party.
• 23 October 2025: IRS confirms the Form 1099-K threshold of over $20,000 and over 200 transactions [In force]. Public Law 119-21 restored it retroactively, replacing the lower threshold enacted in 2021.

11. What this means for identity verification

Marketplace onboarding needs two tiers. Every seller can be screened against sanctions lists and asked for a taxpayer identification number up front, which serves both Form 1099-K and the INFORM Consumers Act. Once the high-volume trigger fires, the platform needs remote collection of a government ID (for the individual acting for a business seller) or a government record or tax document, document authentication, a face match where an individual's ID is used, and checks that tax, bank and identity data correspond, all within 10 days, with an audit trail showing dates.

Re-verification triggers are fixed by law: a notified change, the annual certification and any false partial-disclosure certification. Statutory data should be stored apart and not reused for marketing.

Age assurance differs by purpose. For adult content, state laws such as Texas's accept government ID or transactional data. Under the February 2026 enforcement statement, age data from users who may be under 13 must be limited to that purpose, deleted promptly and shared only with vendors under written assurances. Facial age estimation and face matching are biometric processing that the FTC expects firms to risk-assess and that state biometric laws may require consent for.