Do personal data rules apply to an online seller?
Short answer
Yes. Order, payment and marketing records are personal data, and the checkout is where all three regimes meet at the same time.
Read against the registers 2026-08-26.
Who the role is
A trader who sells to a consumer at a distance, on its own site or through a marketplace.
What the topic covers
The three main personal data regimes cover the same records but start from different premises. The GDPR asks for a legal basis before processing. California gives the consumer rights after the fact. PIPL asks for separate consent for named categories.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Requires a legal basis per purpose, information to the person, and rights of access, correction and erasure.
- ePrivacy Directive — Directive 2002/58/EC: Covers terminal equipment: cookies and similar reading of a device need consent unless strictly necessary.
United States
- California Consumer Privacy Act, as amended by the CPRA: Applies above stated thresholds. Consumers can know, delete, correct and opt out of sale or sharing.
- FTC Act Section 5, unfair or deceptive practices in AI and data: Data claims in a privacy notice are enforceable as representations under Section 5.
China
- Personal Information Protection Law of the People's Republic of China: Requires a lawful ground, separate consent for sensitive categories and a named person responsible.
Where companies usually start
- List the purposes first, then the data each purpose needs, and not the other way round.
- Check which of the three regimes the same record falls under at the same time.
- Keep one written record of purposes that all three notices are generated from.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for seller in distance selling
- Do ai governance rules apply to an online seller?
- Do cross-border data rules apply to an online seller?
- Do cybersecurity rules apply to an online seller?
- Do health data rules apply to an online seller?
- Do online platforms rules apply to an online seller?
- Do consumer rights rules apply to an online seller?
- Do product safety rules apply to an online seller?
- Do climate disclosure rules apply to an online seller?
- Do export controls rules apply to an online seller?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
