Selling to people in the European Union means following EU rules on personal data, consent, consumer rights, online reviews, accessibility and security. They apply to any business that targets EU customers, wherever it is based.
The rules that matter for a website
Most obligations for an online business come from a handful of EU texts. Some are regulations that apply directly in every member state; others are directives that each country turns into its own law, so details can differ from one country to another.
- GDPR (Regulation (EU) 2016/679): how you collect, use, keep and protect personal data.
- ePrivacy Directive (2002/58/EC): cookies and similar trackers, and marketing emails.
- Consumer law: the Consumer Rights Directive (2011/83/EU), the Unfair Commercial Practices Directive (2005/29/EC) and the Omnibus Directive ((EU) 2019/2161), which added rules on reviews and price reductions.
- Digital Services Act (Regulation (EU) 2022/2065): transparency and protection of minors on online platforms.
- European Accessibility Act (Directive (EU) 2019/882): accessible e-commerce and digital services since 28 June 2025.
- Security: GDPR Article 32, the NIS2 Directive ((EU) 2022/2555) and the Cyber Resilience Act (Regulation (EU) 2024/2847).
What is at stake
Under the GDPR, data protection authorities can fine up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. Consumer authorities can fine widespread consumer law breaches up to at least 4% of annual turnover in the countries concerned. Beyond fines, regulators can order changes, customers can claim compensation, and a visible breach of trust costs sales.
Topics in this section
Where to start
- List the personal data your website collects and every third-party tool that receives it.
- Check your cookie banner and privacy policy against what the site really does.
- Review checkout, prices and terms against consumer law.
- Test the site for accessibility and patch the security basics.
- Keep the evidence: records and reports show regulators you take it seriously.
This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.