UK Consumer Rights & E-Commerce Regulations 2026: Sellers' Compliance Guide

The 2026 UK E-Commerce Regulation Map

Few jurisdictions layer consumer protection as tightly as the UK. The cards below summarise the five core regulations (and the new DMCC enforcement layer) covered in this guide — keep them nearby as you read each deep-dive section.

1. Consumer Rights Act 2015 — Overview & Scope

What the CRA 2015 Replaced

The Consumer Rights Act 2015 (CRA 2015) came into force on 1 October 2015 and is the single most important UK statute for B2C e-commerce sellers. It consolidated and modernised a tangle of older legislation — the Sale of Goods Act 1979, the Supply of Goods and Services Act 1982, parts of the Unfair Contract Terms Act 1977, the Sale and Supply of Goods to Consumers Regulations 2002 and the Unfair Terms in Consumer Contracts Regulations 1999 — into one coherent code. For the first time it explicitly recognised digital content (software, ebooks, in-app purchases, downloadable music) as a separate category alongside goods and services.

Who Is a "Consumer" and Who Is a "Trader"?

The Act applies whenever a trader sells to a consumer. The definitions are deliberately broad:

• Trader — any person (individual or corporate) acting for purposes relating to their trade, business, craft or profession, whether acting personally or through someone else acting in their name. A sole trader selling on Etsy is a trader; so is an Amazon UK third-party seller registered as a sole director limited company.
• Consumer — an individual acting for purposes which are wholly or mainly outside that individual's trade, business, craft or profession. The phrase "wholly or mainly" matters: a freelance graphic designer who buys a laptop used 60% privately and 40% for work is still a consumer.

This consumer/trader distinction determines which rights apply, who bears the burden of proof and which forum can hear a dispute. Mis-classifying the relationship — for example, treating a consumer as a B2B buyer to dodge the 30-day reject right — is a classic enforcement target for Trading Standards.

The Three Core Quality Statutory Rights (§§9–11)

Sections 9, 10 and 11 of the CRA 2015 implant three implied terms into every B2C contract for goods. They cannot be excluded by contract or by Terms and Conditions. Every product sold to a UK consumer must be:

• Satisfactory quality (§9) — meeting the standard a reasonable person would consider satisfactory, taking into account description, price and all other relevant circumstances. Includes fitness for all common purposes, appearance and finish, freedom from minor defects, safety and durability.
• Fit for particular purpose (§10) — if the consumer made known any particular purpose for which the goods are bought, the goods must be reasonably fit for that purpose, even if not a common purpose. Example: telling the seller the kettle will be used at altitude in the Lake District.
• As described (§11) — the goods must match any description given by the trader, including images, marketing copy, sample swatches and pre-sale conversations on chat.

Goods, Services, Digital Content — Three Parallel Regimes

The Act runs three parallel regimes: Goods (§§9–32) for physical products with the full 30-day reject + 6-month repair hierarchy; Digital Content (§§33–47) covering ebooks, software, streaming and in-app purchases, with a right to refund where the consumer's device is damaged; and Services (§§48–57) which must be performed with reasonable care and skill (§49) and at a reasonable price where price was not fixed (§51).

Unfair Terms in Consumer Contracts (Part 2)

Part 2 of the Act (§§61–76) imposes a fairness test on all consumer contract terms. An unfair term — one that, contrary to good faith, causes a significant imbalance to the consumer's detriment — is not binding. Schedule 2 lists 20 example terms presumed unfair (the "grey list"): excluding liability for death or personal injury, allowing unilateral price changes after sale, requiring disproportionate compensation. Trading Standards and the CMA enforce against unfair terms directly without needing a private dispute.

2. Consumer Contracts Regulations 2013 — The 14-Day Right of Withdrawal

The CCR 2013 in Context

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 — usually shortened to CCR 2013 or "the distance selling regulations" — implement EU Directive 2011/83/EU into UK law. They came into force on 13 June 2014, replacing the older Distance Selling Regulations 2000 and the Doorstep Selling Regulations 2008. After Brexit they were retained verbatim as UK law; nothing changed in substance.

The CCR 2013 cover three contract types: on-premises contracts (in a shop), off-premises contracts (at the consumer's home, doorstep, or a public space — sometimes called "pressure sale" contracts), and the type that matters most for online sellers — distance contracts, concluded without the simultaneous physical presence of trader and consumer, using one or more means of distance communication (website, phone, post, email).

The Pre-Contract Information Duty (Regulation 13)

Before a distance contract is concluded, the trader must provide a long list of mandatory information clearly and comprehensibly. The Schedule 2 list runs to 21 items including the main characteristics of the goods, trader identity and contact details, total price including taxes, all delivery and other charges, payment/delivery/complaint arrangements, a reminder of CRA 2015 rights, the conditions, time limit and procedures for exercising the right to cancel, and the standard Model Cancellation Form reproduced in Schedule 3, Part B. Failure to provide the cancellation information extends the 14-day cooling-off period to 12 months and 14 days — an expensive omission.

The 14-Day Cooling-Off Period (Regulations 29–38)

Under regulation 29, the consumer can cancel a distance contract without giving any reason within 14 calendar days. The clock starts:

• For a service contract — the day after the contract is concluded
• For a goods contract — the day after the goods are delivered to the consumer (or to the third party nominated by the consumer)
• For multiple goods in separate parcels — the day after the last item is delivered
• For regular delivery contracts (e.g. monthly coffee subscription) — the day after the first delivery

Refund Obligations and Timing (Regulations 34–35)

On cancellation the trader must refund all sums paid including standard outbound delivery (but not premium upgrades — only up to the cheapest standard option), within 14 days of either receiving the goods back or evidence they have been sent. Refunds must use the same means of payment unless the consumer expressly agrees otherwise. The consumer is liable for any diminished value from handling beyond what is necessary to establish nature, characteristics and functioning — i.e. inspect like in a shop, not use as a fashion show.

Exceptions to the 14-Day Right (Regulation 28)

Some categories are excluded: custom-made or personalised goods (engraved jewellery, made-to-measure curtains), perishables (fresh food, flowers), unsealed audio/video/software, sealed hygiene goods once unsealed (cosmetics, intimate apparel), newspapers/magazines (except subscriptions), and digital content supplied not on a tangible medium where the consumer expressly consented to immediate performance and acknowledged loss of the cancellation right. Sellers relying on an exception must inform the consumer clearly in advance — burying it in T&Cs is not enough.

3. The 30-Day Short-Term Right to Reject — CRA 2015 §20

A Tier-One Remedy

Section 20 of the CRA 2015 grants UK consumers a 30-day short-term right to reject goods that fail to meet the §9 satisfactory quality, §10 fitness-for-purpose or §11 description tests. This right is one of the most consumer-friendly in Europe — there is no equivalent in many EU jurisdictions, where consumers must first allow the trader to repair or replace.

The 30-day window starts on the later of:

• The day ownership of the goods passes to the consumer (usually delivery), and
• The day the goods are delivered, and
• If the contract requires installation by the trader, the day installation is complete

Perishable Goods — A Shorter Window

For perishable goods that a reasonable person would not expect to last more than 30 days (fresh meat, dairy, fresh produce), the short-term right runs only for as long as the goods could reasonably be expected to last. A 28-day "use by" loaf of bread is rejectable for 28 days, not 30.

The Consumer's Remedy: A Full Refund (§20(7))

If the consumer exercises the short-term right within 30 days the trader must give a full refund — no deduction for use, no restocking fee, no "store credit only" workarounds — within 14 days of agreeing the consumer is entitled. The trader bears all reasonable costs of return, including return shipping. The consumer chooses whether to take the refund or request a repair/replacement (which suspends the 30-day clock pending the trader's response).

Burden of Proof Within 30 Days

Within 30 days the burden of proving the goods were satisfactory at the point of sale rests with the trader. Trading Standards and the CMA treat any "no refund" sign at distance — including in returns-policy copy — as an unfair commercial practice when applied to in-fault returns within the first 30 days.

What "Reject" Looks Like Procedurally

A statutory rejection notice does not have to use particular words — an email, marketplace ticket, or phone call saying "I'm returning this for a refund, it's faulty" suffices. The trader cannot insist on a particular form. The right operational response is to acknowledge within 24 hours, issue a pre-paid return label within 48 hours, refund within 14 days of receipt, and log the rejection reason for supplier-side defect-rate analysis.

4. The 6-Month Repair/Replacement Period — CRA §§23–24

Tier-Two Remedy Hierarchy

If the consumer does not exercise the 30-day short-term reject right — or chooses to give the trader a chance to fix the goods — they move into the tier-two remedies under sections 23 and 24 of the CRA 2015: repair or replacement. The window during which this hierarchy operates with the burden of proof reversed in the consumer's favour is six months from delivery.

The Reverse Burden of Proof — §19(14)–(15)

For any breach of §§9, 10 or 11 that becomes apparent within six months of delivery, the goods are presumed to have been faulty at the point of sale. The trader must prove they were not. After six months the burden flips to the consumer, who must show the fault existed at delivery rather than being caused by wear, misuse or accidental damage.

For the seller this six-month window has hard operational consequences: detailed delivery condition photos, batch-level supplier quality data and serial-number tracking are all worth the cost because they let you discharge the burden in the rare disputed case.

Repair, Replacement and Reasonable Time (§23)

Within the repair/replacement tier the consumer chooses between repair or replacement, unless one is impossible or disproportionate. The trader must complete the remedy within a reasonable time and without significant inconvenience, bearing all necessary costs (shipping, labour, materials). The consumer has only one attempt — if that attempt fails too, they move to tier-three remedies.

Tier-Three Remedies — Price Reduction or Final Right to Reject (§24)

If the single repair or replacement attempt fails (or is impossible), the consumer may choose price reduction (keep the goods, partial refund) or the final right to reject (full return for refund). For the final right, the trader can make a reasonable deduction for use only if the consumer has had the goods for more than six months — no deduction within the first six months for any product other than a motor vehicle.

Limitation Periods — Six Years (or Five in Scotland)

The CRA itself sets no overall lifetime cap, but the underlying contract claim is subject to the general limitation period under the Limitation Act 1980: six years from the date of breach in England, Wales and Northern Ireland, and five years from the date the consumer first knew (or could reasonably have known) about the fault, under the Prescription and Limitation (Scotland) Act 1973. These periods are dramatically longer than the typical 12-month manufacturer guarantee and are why "durability" appears in the §9 satisfactory quality test.

5. UK GDPR + Data Protection Act 2018

The Post-Brexit Data Protection Stack

From 1 January 2021, the EU General Data Protection Regulation was retained in UK domestic law as the UK GDPR by section 3 of the European Union (Withdrawal) Act 2018, sitting alongside the Data Protection Act 2018 (DPA 2018). The two instruments together govern personal-data processing by every UK e-commerce seller and every overseas seller offering goods or services to UK residents.

Substantively the UK GDPR mirrors the EU GDPR almost word-for-word. The DPA 2018 fills the gaps the GDPR leaves to national law: the age of consent for online services (13 in the UK, rather than 16 in many EU states), the framework for special category data, criminal-records data, exemptions for journalism and research, and the law-enforcement and intelligence-services regimes.

Lawful Bases (Article 6)

Every processing operation needs a lawful basis. For e-commerce the four practical bases are: Contract (Art. 6(1)(b)) for order fulfilment, delivery, returns and support; Legal obligation (Art. 6(1)(c)) for VAT records, AML checks and HMRC reporting; Legitimate interests (Art. 6(1)(f)) for fraud prevention, network security and basic CRM analytics (with a documented Legitimate Interest Assessment); and Consent (Art. 6(1)(a)) for marketing emails, non-essential cookies and profile-based personalisation.

Data Subject Rights — Articles 12–22

Every consumer has the rights to: access, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability, objection, and not to be subject to solely automated decisions with legal or similarly significant effects. A subject access request (SAR) must be answered within one month (extendable by two months for complex requests), free of charge for the first request. ICO enforcement notices have repeatedly targeted online retailers that fail to respond to SARs on time.

Breach Reporting — Article 33

If a personal data breach is likely to result in a risk to the rights and freedoms of individuals, it must be reported to the ICO within 72 hours of the controller becoming aware. If the risk is high, affected individuals must also be notified without undue delay. The 72-hour clock starts at "awareness", not at incident detection by your SOC — but practical investigations need a documented "we became aware on" timestamp to stand up to ICO scrutiny.

EU–UK Adequacy and Cross-Border Transfers

Data flows from the EU/EEA into the UK rely on the EU–UK Adequacy Decision adopted by the European Commission in June 2021 and renewed in June 2026. The renewed decision runs to 27 December 2031, removing the need for Standard Contractual Clauses on most EU-to-UK transfers. UK-to-rest-of-world transfers still need either the UK Addendum to the EU SCCs or the standalone UK International Data Transfer Agreement (IDTA), plus a transfer risk assessment.

ICO Registration Fee

Most data controllers must pay the ICO's annual data protection fee: £40 for small organisations (≤10 staff or turnover ≤£632k), £60 for medium, and £2,900 for large. Failure to pay is itself an offence and is regularly enforced. Marketplace sellers are individual controllers — registering as part of a broader brand group does not satisfy the obligation.

6. PECR — Privacy and Electronic Communications Regulations

The Forgotten Twin of UK GDPR

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) sit on top of the UK GDPR and govern cookies, marketing emails, marketing SMS, marketing calls and website tracking. Many sellers concentrate on GDPR compliance and let PECR slip — yet ICO penalty volume for PECR breaches has consistently outpaced GDPR fines in headline terms, because PECR retains the older £500,000 maximum fine and is easier to evidence (a cookie scan or a marketing list audit produces hard evidence quickly).

The Cookie Consent Standard

Regulation 6 PECR requires prior, informed consent for any storage of or access to information on a user's device that is not "strictly necessary". Strictly necessary cookies (session, basket, load balancing, CSRF tokens) need no consent. Analytics, marketing, retargeting, fingerprinting and social plug-ins all require consent before the cookie is set. Pre-ticked boxes are not consent (confirmed in Planet49). The ICO's January 2026 cookie guidance update requires "Reject All" with equal prominence to "Accept All" at the first banner layer, and consent must be refreshable and withdrawable as easily as it was given.

Email and SMS Marketing

Regulation 22 governs unsolicited B2C electronic marketing — default is opt-in. The narrow "soft opt-in" exception (reg. 22(3)) applies when the contact details came from an actual sale or sale negotiations, the marketing relates to similar products, a simple opt-out was offered at collection, and every message thereafter offers a simple opt-out. For B2B email to corporate identifiable addresses (info@, sales@) opt-out is permissible — but personal corporate addresses (first.last@) are treated as B2C in practice.

Calls and Trace-Free Communications

Live unsolicited marketing calls are blocked for any number registered with the Telephone Preference Service (TPS) unless the recipient has separately notified your business of consent. Automated calling systems require prior consent regardless of TPS registration. Calling line identification must be presented — anonymous marketing calls are an automatic PECR breach.

Enforcement: The £500k Cap

PECR enforcement remains under the Data Protection Act 1998 regime for fines — the pre-GDPR statutory maximum of £500,000 per breach. The ICO uses this aggressively against nuisance-call companies and SMS spam operators. For online retailers the practical risk surface is cookie banners and unsolicited email — both regularly investigated after consumer complaints.

7. Distance Selling vs Storefront — Why the Distinction Matters

The Three Contract Categories

The CCR 2013 split B2C contracts into three categories, and the differences shape almost every part of a seller's compliance stack:

• On-premises (storefront) contracts — concluded at the trader's business premises where the consumer is physically present, e.g. a high-street till purchase. Light-touch pre-contract disclosure under regulation 9. No 14-day cancellation right.
• Off-premises contracts — concluded somewhere other than the trader's premises in the consumer's simultaneous physical presence: doorstep sales, sales at the consumer's home, public-space pop-up booths, or even pre-arranged consumer-home visits. 14-day cancellation right applies, with extensive pre-contract disclosure under regulation 10 and Schedule 2.
• Distance contracts — concluded under an organised distance-sales scheme, using exclusively means of distance communication: website checkout, phone order, mail order, marketplace listing. 14-day cancellation right applies, with the heaviest pre-contract disclosure regime under regulation 13 and Schedule 2.

Why the Pre-Contract Disclosure Regimes Differ

The information asymmetry is much greater in distance contracts — the consumer cannot touch the product, cannot read the box, cannot ask the shop assistant. The legislator compensates with mandatory pre-contract disclosure: trader identity, total price, delivery costs, payment methods, the cancellation right and the model cancellation form. Schedule 2 lists 21 items for distance and off-premises contracts vs only 9 for on-premises contracts under Schedule 1.

The "Express Order Confirmation" Trap (Regulation 14)

For distance contracts concluded by electronic means and entailing payment, the trader must clearly and prominently inform the consumer of the information in Schedule 2, points (a), (f), (g), (h) and (s) directly before the consumer places the order. The order button must use the words "Order with obligation to pay" or an equivalent unambiguous formulation. A button labelled "Submit" or "Continue" is not compliant — the resulting contract is not binding on the consumer. The CMA's 2024 sweep of subscription sign-up flows found that roughly 30% of UK online retailers were technically non-compliant with regulation 14.

Mixed Channels: Click-and-Collect, Reserve in Store

Hybrid flows (book online, pay in store; reserve online for in-store pickup) are usually treated as distance contracts because the contract is concluded online. The 14-day cooling-off period applies, with the clock typically starting on the day the consumer takes possession in store. Marketplace sellers running click-and-collect through partner pickup networks (Argos, John Lewis click-and-collect, Royal Mail Tracked Click & Collect) need to align their internal "delivery confirmed" event with the statutory delivery point.

Practical Compliance Checklist

• Use "Order with obligation to pay" (or equivalent) on every checkout submit button
• Surface total price including taxes and delivery before the order button
• Provide trader identity, geographic address, email and complaint-handling information at no more than one click away from any product page
• Include the Schedule 3, Part B Model Cancellation Form as a downloadable PDF in your Returns Policy
• Send the durable medium confirmation (typically an email) within a reasonable time of contract conclusion

8. Required Disclaimers, Terms & Legal Notices

The "Six Pillars" of UK Online Store Legal Pages

A compliant UK online store publishes six core legal documents. Missing any one is a routine Trading Standards or CMA enforcement target. Zunapro's UK template library bundles ready-to-edit drafts of each.

1. Terms and Conditions of Sale — the master B2C contract; must align with the CRA 2015 and CCR 2013; must not include any term on the §62 unfair-terms grey list
2. Privacy Notice — UK GDPR Article 13/14 mandatory information: identity of the controller, contact details, purposes, lawful bases, recipients, retention, data subject rights, ICO complaint route
3. Cookie Policy — paired with a PECR-compliant cookie banner; lists every cookie, its purpose, retention period, third-party recipients
4. Returns and Refunds Policy — must explicitly mirror both the CCR 14-day right and the CRA §20 30-day reject right; must include the Model Cancellation Form
5. Trader Identity Disclosure — under the Electronic Commerce (EC Directive) Regulations 2002 and the Companies Act 2006, every B2C-facing webpage must disclose the registered company name, company number, registered office address, VAT number (if registered), and email contact
6. Marketplace Terms Acknowledgement — Amazon UK, eBay UK, OnBuy and similar platforms layer their own terms on top of statutory rights; sellers must align internal policies

Trader Identity — The Companies Act 2006 Layer

Section 82 of the Companies Act 2006 (and the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015) requires every UK limited company to display, on every business letter, order form and website:

• The registered company name
• The company number
• The place of registration (e.g. "Registered in England and Wales")
• The address of the registered office
• If a limited company, the fact of limited liability

Footer placement is acceptable for the website disclosure. Penalties for non-compliance are modest in individual amounts but accumulate per breach.

The Electronic Commerce Regulations 2002

Beyond the Companies Act, the e-Commerce Regulations require every UK online service provider to publish the provider's name, geographic address, contact details including email, any relevant trade register and registration number, VAT identification number where applicable, and for regulated professions the professional body and rules.

The DMCC Act's 2026 Disclaimer Layer

The DMCC Act 2024 introduced new disclosure obligations from April 2026: a drip pricing ban (any mandatory fee must be included in the headline price on product pages), a subscription notice regime (reminder before each renewal, one-click cancel route), and a fake review prohibition (soliciting, posting or hosting fake reviews is a banned commercial practice — sellers must take reasonable steps to detect them).

9. The Returns Process — Cost Responsibility, Refunds & Operational Flow

The Three Statutory Grounds for Return

Every UK consumer return falls into one of three statutory categories. The seller's cost obligations differ in each:

• Change of mind under CCR 2013 (within 14 days) — consumer pays return shipping, unless pre-contract information failed to make this clear; outbound shipping is refunded up to standard rate; refund within 14 days of receipt or evidence of dispatch
• Faulty under CRA 2015 §20 (within 30 days) — trader pays return shipping; full refund including all delivery and any other charges; refund within 14 days of agreement
• Faulty under CRA 2015 §§23–24 (within 6 months / 6 years) — trader pays return shipping for repair, replacement or final reject; the consumer can claim consequential losses where caused by the breach

Outbound Delivery Refunds — A Common Trap

Under regulation 34(2)–(4) CCR 2013, when a consumer exercises the 14-day right the trader must refund the cost of standard delivery, even if the consumer chose a premium upgrade (next-day, named-day, Saturday). The trader's refund cap is the lowest cost standard option the trader offered — not the cost of the actual delivery service used. Failure to refund standard delivery is one of the most common items in CMA sweep reports.

Diminished Value (Regulation 34(9))

When the consumer exercises the 14-day cancellation right, they are entitled to handle the goods only as much as is necessary to establish their nature, characteristics and functioning — "as in a shop". Any further handling can reduce the refund by the diminished value. In practice:

• Clothes can be tried on, not worn for an evening
• Electronics can be powered on briefly, not used for a week
• Cosmetics can be opened only if the seal allows return at all — many cosmetics fall under regulation 28 exceptions once unsealed

Trading Standards practice is to apply diminished-value deductions cautiously — the seller bears the burden of proving the loss of value beyond reasonable inspection.

Refund Timing — The 14-Day Rule (Twice)

Both the CCR and CRA refund clocks run for 14 days — but they start at different points:

• CCR change of mind — 14 days from the earlier of receiving the goods back or evidence the consumer has sent them back
• CRA §20 reject — 14 days from the date the trader agrees the consumer is entitled to a refund
• CRA §24 final reject — 14 days from the date the consumer ends the contract

Refund Method — Same Means of Payment

Refunds must use the same payment method the consumer used, unless the consumer expressly agrees otherwise. Refunding to a "store credit" account in place of cash refund is not compliant unless the consumer explicitly agrees in advance. Gift card original purchases are typically refunded as cash to the cardholder of record, not as gift card top-up.

Returns Operational Stack — 2026 Best Practice

The pragmatic 2026 returns stack for a UK marketplace seller is:

• Pre-paid return label generator baked into the post-purchase email
• Statutory ground tagger — every inbound return is classified as CCR, §20, §23 or §24 to compute the right cost responsibility
• Refund timer — automated reminders ahead of the 14-day refund deadline
• Diminished value evidence pack — photo and weight on inbound, supplier QC data on outbound, to support deductions if disputed
• Marketplace dispute integration — Amazon UK A-to-Z, eBay Money Back Guarantee, PayPal disputes routed via the same workflow

10. Trading Standards & CMA Enforcement

The Two-Tier Enforcement Stack

UK consumer-law enforcement is split between local-authority Trading Standards services (operating in roughly 200 unitary, county and London-borough authorities) and the UK-wide Competition and Markets Authority (CMA). The two layers overlap deliberately so that small-volume local issues are handled locally while market-wide patterns trigger national action.

Trading Standards — Local Powers Under the CPUTRs

Trading Standards officers operate primarily under:

• Consumer Protection from Unfair Trading Regulations 2008 (CPUTRs) — prohibits unfair, misleading and aggressive commercial practices
• The CRA 2015 enforcement powers (Schedule 5) — investigation rights, test purchasing, document seizure
• Sector-specific statutes — toy safety, food labelling, weights and measures, age-restricted product enforcement

Routine Trading Standards tools include improvement notices, fixed penalty notices, criminal prosecutions in the magistrates' court (sentence up to two years' imprisonment plus unlimited fines for serious CPUTR breaches), product seizures and applications for enforcement orders in the County Court.

The Competition and Markets Authority — From Court Route to Direct Enforcement

The CMA was created in April 2014 by the merger of the Office of Fair Trading and the Competition Commission. Until April 2026 its consumer-law enforcement followed the "court route": investigate, negotiate undertakings, and if necessary take the trader to court.

The Digital Markets, Competition and Consumers Act 2024 (DMCC Act), in force from April 2026, fundamentally reshaped the CMA's consumer-law toolkit. The CMA now has direct administrative enforcement with:

• Civil monetary penalties up to 10% of global annual turnover for breaches of specified consumer law
• Fixed penalties up to £300,000 for breaches of information requirements
• Daily penalties up to 5% of daily worldwide turnover for continued failure to comply with directions
• Online interface orders requiring takedown of misleading product pages and listings

The Information Commissioner's Office (ICO)

The ICO is the UK's data protection supervisory authority — independent of Trading Standards and the CMA. The ICO enforces the UK GDPR (up to £17.5M or 4% of global annual turnover) and PECR (up to £500,000). Online retailers are the ICO's most frequent enforcement target by volume — cookie banners, marketing email lists and subject access response failures dominate the casebook.

The Online Sweep Pattern

Both Trading Standards (through National Trading Standards' eCrime team) and the CMA increasingly use online sweeps — automated crawling of retailers, marketplaces, and review platforms — to surface non-compliance at scale. 2024–2026 high-profile sweeps targeted:

• Drip pricing on holiday-rental and concert-ticket sites
• Fake-review networks selling positive reviews to Amazon UK and Trustpilot sellers
• Subscription auto-renewal flows that obscure exit paths
• Cookie banners lacking equal-prominence "Reject All" controls
• Drip-pricing in food-delivery service fees

Penalty Comparison Table 2026 — All Regulators

The single most useful artefact for prioritising compliance work is a regulator-by-regulator penalty view. The table below summarises 2026 penalty maxima and the relevant statutes.

Regulator	Statute	Maximum Civil Penalty	Criminal Sanctions	Typical Triggers
CMA	DMCC Act 2024	10% of global turnover or £300,000	None directly	Drip pricing, fake reviews, subscription traps
Trading Standards	CPUTRs 2008 + CRA 2015	Unlimited fines on conviction	Up to 2 years' imprisonment	Misleading practices, unsafe products, false claims
ICO (GDPR)	UK GDPR + DPA 2018	£17.5M or 4% of global turnover	Limited (s.170 DPA offences)	SAR failures, breach reporting, lawful basis errors
ICO (PECR)	PECR 2003	£500,000	None	Cookie consent, unsolicited marketing
HMRC	VAT Act 1994 etc.	100% of evaded tax + interest	Tax fraud (up to 7 years)	VAT under-declaration, marketplace VAT reform
FCA	FSMA 2000	Unlimited / disgorgement	Up to 7 years	Unauthorised BNPL, payment services

Reading the table: The CMA's 10% global turnover headline is the biggest single penalty risk, but the ICO has the highest enforcement frequency and Trading Standards has the broadest reach across product categories. A 2026-compliant UK seller's compliance roadmap addresses all four — most pragmatically by funnelling the entire UK channel through a panel that encodes the rules.

How to Become UK-Compliant — 2026 Step-by-Step

1. Audit Your Current Compliance Posture

• Legal pages check — T&Cs, Privacy Notice, Cookie Policy, Returns Policy, trader identity block
• Cookie banner audit — confirm "Reject All" parity at first layer
• Marketing-list audit — confirm lawful basis recorded against every email address
• SAR readiness — confirm a one-month workflow exists
• Returns workflow — confirm CCR vs CRA logic is routed correctly

2. UK Company or Foreign Entity Path

You have three legal-entity options for selling into the UK:

• UK Limited Company (Ltd) — registered at Companies House, requires UK registered office, ~24-hour registration via Companies House Web Incorporation
• UK Sole Trader — register with HMRC for Self Assessment, simpler but unlimited personal liability
• Foreign entity selling into the UK — keep your existing entity, register for UK VAT if needed, appoint an Article 27 UK GDPR representative

3. UK VAT & Marketplace VAT Reform

UK VAT registration is mandatory once taxable turnover exceeds £90,000 over a rolling 12-month period (raised from £85,000 in April 2024). Marketplaces such as Amazon UK and eBay UK collect and remit UK VAT on behalf of overseas sellers under the 2021 marketplace VAT reforms — the seller still needs accurate UK VAT records for their own returns and HMRC reporting.

4. ICO Registration and DPO Appointment

Pay the ICO data protection fee (£40 / £60 / £2,900) within 21 days of starting personal-data processing. A Data Protection Officer (DPO) is mandatory only for public authorities or large-scale special-category processing, but most marketplaces of any significant size designate a "data protection lead" voluntarily — useful for ICO correspondence and SAR handling.

5. Connect via Zunapro (10-Minute Integration)

1. Sign in to Zunapro and open the UK module
2. Connect each marketplace — paste API keys / OAuth into the Amazon UK, eBay UK, OnBuy and ASOS Marketplace tiles
3. Map your master catalogue — Zunapro auto-suggests category mappings; you confirm with a few clicks
4. Enable the UK Compliance Pack — CRA returns engine, UK GDPR register, PECR cookie controls — single toggle each
5. Go live — first sync completes in roughly 10 minutes for a 1,000-SKU catalogue

UK Consumer Rights & E-Commerce FAQ 2026