E-Commerce in the Philippines: Common Compliance Risks

First Establish Your Role: Operator, Seller, or Direct Site

The same action carries different legal meaning depending on which of the three roles you occupy, and that is the first divide in e-commerce compliance. Place yourself first, then work through obligations — otherwise you will simultaneously miss duties you hold and absorb liability that was never yours.

Role one: the platform operator. You do not sell; you provide the venue, the payment rail or the matching service. Your duties lean towards governance and duty of care: verifying and identifying onboarded sellers, running a working mechanism to remove non-compliant goods and claims, providing complaint and dispute channels, publishing rules and notifying changes, and acting on valid notice of infringing or unlawful content. Exposure arises from knowing, or having reason to know, and failing to act.

Role two: the platform seller. You are the actual seller, and you carry primary responsibility for product compliance, truthful claims, fulfilment, after-sales service and receipting. Platform rules are contractual obligations; legal obligations do not transfer merely because the platform collects the money. The exposure is treating platform rules as the whole of compliance — what the platform does not police, the regulator may still police.

Role three: your own site or social commerce. You hold both the operator and seller roles, plus full responsibility for payments, data and content, with no platform dispute mechanism to absorb complaints — they arrive at the regulator directly.

Three practical points. First, roles overlap and change: a mainly first-party site that opens to a handful of third-party sellers has become a platform. Second, allocate liability in agreements but do not rely on agreements alone: an onboarding contract pushing everything to sellers does not necessarily discharge the operator's regulatory duty of care. Third, your entity choice determines every registration that follows — local company, branch or pure cross-border seller decides whether you can issue receipts, act as importer of record, or collect locally. Entity options are in e-commerce company registration.

Line One: Platform Versus Seller Liability — Duty of Care Sits Outside the Contract

Philippine regulation of online transactions has been tightening, in the direction of holding platforms responsible in proportion to the control they exercise rather than treating them as neutral conduits. Scope and commencement follow the regulator's prevailing rules, but the structural direction of the obligations is already clear.

Three questions platforms get asked. One, seller verification: is the registration information genuine, and does it trace to an entity that can be contacted and held responsible? When a consumer complains and the seller cannot be found, the pressure returns to the platform. Two, capacity to act on violations: is there a functioning takedown, restriction and review mechanism, is notice acted on within a reasonable time, and is there a record of what was done? Three, rule transparency and change notice: commissions, deductions, store suspension and fund holds directly affect seller rights — are they published, and is there an appeal route? Disputes arising from suspended stores and held settlement funds are the highest-volume conflict on the platform side.

Three misjudgments on the seller side. First, treating platform approval as a compliance endorsement: being listed does not mean the product satisfies category entry rules, and regulated categories — food, supplements, cosmetics, medical devices, electronics — still need their registrations and permits, per restricted and regulated imports. Second, opening a store under someone else's entity: when things go wrong you may lose the store and surface a misrepresentation problem at once. Third, treating platform withholding as the end of your tax obligations: withholding is a collection mechanism, not a completed filing — see e-commerce tax compliance.

The shared danger zone is who bears fulfilment failure. Wrong item, late dispatch, lost parcel, item not as described — whose problem it is under the contract, in the consumer's eyes, and in the regulator's eyes can be three different answers. The workable approach is to write allocation, liability caps, recovery routes and evidence-retention requirements into both the onboarding agreement and the after-sales SOP, and to ensure retained transaction and logistics data can reconstruct any disputed order. Delivery and cash-on-delivery settlement are covered in e-commerce delivery and COD.

Line Two: Returns and Disputes — Statutory Rights Are Not Platform Policy

The common error runs both ways: treating a platform's no-questions return window as a legal requirement, or treating a "no returns" sign as an effective disclaimer. Neither holds, and this line generates the largest volume of consumer complaints.

Separate the two layers. The first is statutory rights: Philippine consumer protection law provides remedies where goods are defective, not as described, or fail safety and quality requirements, and a seller cannot unilaterally exclude those by posting a notice. The second is platform policy and your own promises: change-of-mind returns, who pays return shipping, refund timelines — these come from platform rules and your commitments and sit at the contractual layer. The operative conclusion: platform policy may be more generous than statutory rights, but not so restrictive as to displace them.

Three disputes specific to online selling. One, refusal at cash-on-delivery: COD carries a high share of Philippine e-commerce, and refusal rates are an operational reality — but once refusal is combined with an "item not as described" claim, it moves from commercial loss to dispute. Two, proving what was described: the product page, hero images, spoken descriptions in a livestream and customer-service chat logs can all be treated as part of the promise — what the page says and what the agent typed both count later. Three, escalation route: where platform mediation fails, consumers can take the matter to the trade authority's consumer complaint channel, at which point you face a regulatory process rather than platform rules. The consumer-side walkthrough is in returns and refunds.

One cross-channel reality is worth adding: where you run stores as well as an online shop, the returns policies have to reconcile. Promising change-of-mind returns online while the physical store refuses them, or applying different windows and shipping rules on each side, converts straight into complaints. The in-store pricing and consumer obligations sit in retail chain compliance risks.

Four defences. Issue one compliance-reviewed returns policy across all channels rather than a different version per store; bring product pages, livestream scripts and customer-service templates into a single review process, because together they constitute your promise; retain a full evidence chain of transaction, logistics, communication and unboxing records, since disputes usually turn on who kept records; and set photography and description standards in advance for high-return categories rather than arguing after the fact.

Line Three: Data Privacy — E-Commerce Is the Most Data-Intensive Sector

An online store inherently holds large volumes of personal data: names, phone numbers, delivery addresses, purchase histories, payment details, and sometimes images of identity documents. The Philippines has a dedicated data privacy framework and regulator, and the obligations are not waived because you are foreign-owned or operating cross-border.

The baseline obligations. Maintain and publish a privacy notice covering what is collected, why, how long it is kept and with whom it is shared; designate the person responsible for data protection matters and meet the applicable registration requirements; process on a lawful basis (consent, necessity for performance, or another lawful ground); apply organisational and technical safeguards proportionate to the risk; and notify as required where a breach is likely to cause real harm. Applicability thresholds, registration requirements and notification timelines follow the regulator's prevailing rules.

Five scenarios where e-commerce teams get into trouble. One, treating the customer list as a portable asset — exported for off-platform marketing, handed to an agency, or walked out the door by a departing employee. This is the most common and the hardest to reverse. Two, default sharing by third-party tools: marketing automation, helpdesk software, analytics and advertising pixels frequently transmit customer data by default, with none of it disclosed in the privacy notice. Three, cross-border transfer: sending Philippine customer data to servers or parent-company systems abroad requires a lawful basis and appropriate arrangements — "it is all one company" is not a basis. Four, logistics and outsourcing: sharing address data with carriers and fulfilment partners is necessary, but their permitted use must be bounded by contract. Five, over-collection: asking at sign-up for identity documents unrelated to the transaction — the more you hold, the worse a breach becomes.

Employee data falls under the same regime, for example biometric attendance capture, discussed in fingerprint and facial attendance and privacy. The minimum viable programme is three steps: run a data inventory (what you hold, where, who can access it, who receives it), rewrite the privacy notice to match actual practice, and log access and export activity.

Line Four: Claims, Livestreams and Reviews — the Display Is the Point of Sale

E-commerce compresses advertising and selling into one screen, which means any claim can simultaneously be an advertisement and a contractual promise. That is one of the deepest differences from physical retail.

Overreaching claims are the first risk. Efficacy claims, comparative claims and absolutes — cures, eliminates, the most effective, the only, the lowest anywhere — can constitute misleading advertising where they are unsubstantiated or where conditions are not adequately disclosed. Regulated categories are especially sensitive: food and supplements may not carry medical efficacy claims, and cosmetics may not stray into drug claims. See supplement claim limits and cosmetics notification. Price claims need substantiation too: a struck-through "was" price that never transacted is price deception.

Livestream and influencer selling is the second risk, and the worst documented. A spoken commitment on a livestream is a claim, yet many teams keep no recording; where an influencer says more than your approved material supports, the brand can still be exposed; and paid promotion and material connections should be disclosed, since dressing a commercial arrangement as personal experience misleads consumers. The practical fix: give creators a vetted claims list and prohibited-word list, require recordings to be retained, and allocate responsibility for claim overreach in the collaboration agreement.

Authenticity of reviews and sales figures is the third risk. Fake orders, paid positive reviews, suppression or deletion of genuine negative reviews, and gifts exchanged for a specified rating are, from a regulatory standpoint, fictitious transactions and fake reviews — and the platform's own data is the evidence. No naming or comparing specific competitors' enforcement outcomes here, but the structural conclusion is plain: these practices leave far more trace online than offline, and reconstruction is cheap for a regulator.

The defence is a single claims vocabulary in three tiers — approved, requires substantiation, prohibited — applied simultaneously to product pages, paid media, livestream scripts and service templates; substantiation files kept for every claim; and an archiving routine for social campaigns. Operational aspects of social advertising are in advertising in practice.

Line Five: Cross-Border Trade — Importing and Selling Are Two Separate Accounts

The structural error in cross-border e-commerce is treating "getting goods in" and "selling goods" as one exercise. They run on two rule sets, two authorities and two documentation regimes, and a gap at either end surfaces at the other.

On the import side, the core question is who is the importer. Goods entering the Philippines need a compliant importing entity to carry declaration, duties and compliance responsibility. A pure cross-border seller without a local entity generally works through an importer of record or a local partner — and at that point title to goods, responsibility and whose name appears on the documents must be written down. Using someone else's import capability means the import documents are not in your name, which affects both cost deduction and any claim to the goods. Regulated categories add category entry rules and pre-arrival clearances; see import commodity clearance and restricted and regulated goods.

On the sales side, the core question is where the sale occurs. A local entity selling inside the Philippines and an offshore entity selling directly to Philippine consumers differ substantially in registration, receipting and filing obligations. Platform withholding does not complete your filing obligation; the mechanics are in e-commerce tax compliance and are not repeated here.

Three realities that get overlooked. One, the limits of parcel-by-parcel shipping: splitting a bulk consignment into many small parcels to reduce per-shipment duty can amount to circumventing declaration obligations, and the exposure sits with the goods owner rather than the courier. Two, three sets of numbers must reconcile: platform transaction data, carrier waybill data, and your books and documents — cross-matching them is the first thing an examiner does. Three, cross-border returns: shipping returns back offshore often costs more than the goods, so a local returns facility and disposition plan belongs in the launch design, not in the response to a pile of returns.

Choosing the route is itself risk management: light-touch cross-border, partial localisation, or a full local entity carry very different compliance burdens and durability. The comparison is in cross-border entry routes. If you want entity, registrations, receipting and filings held together, compliance management services can take it on.