Cybersecurity, Privacy, Law, Ethics and Governance

Introduction

An e-commerce venture is not merely a website with a payment function. It is a socio-technical system that collects personal information, creates contractual relationships, processes payments, uses third-party platforms, manages intellectual property, and makes decisions that can affect consumers, workers, suppliers, and communities. Consequently, cybersecurity, privacy, law, ethics, and governance are strategic capabilities rather than compliance afterthoughts.

A security breach may interrupt sales, expose payment credentials, trigger regulatory enforcement, and permanently damage trust. An inaccessible storefront may exclude customers and create legal liability. An unclear returns policy may undermine the enforceability of consumer contracts. An algorithm that personalizes prices or ranks sellers may be commercially effective while producing discriminatory outcomes. Responsible digital commerce requires these issues to be designed into the business model, technology architecture, and operating procedures.

This chapter develops an integrated framework for assessing consumer protection, contracts, intellectual property, taxation, accessibility, privacy, cybersecurity, and cross-border compliance. It also examines responsible data, platform, vendor, and algorithmic governance. Laws vary by jurisdiction; therefore, the chapter presents general principles and identifies where specialist legal and tax advice is essential.

Learning Objectives

By the end of this chapter, readers should be able to:

1. Explain the legal, ethical, and strategic foundations of trustworthy e-commerce.
2. Assess consumer-protection, contract, intellectual-property, taxation, accessibility, privacy, and cybersecurity risks.
3. Distinguish legal compliance from broader ethical responsibility.
4. Design governance controls for data, platforms, vendors, and algorithms.
5. Evaluate cross-border risks and construct a practical compliance program.
6. Apply these principles to a realistic digital-storefront decision.

1. E-Commerce as a Governed System

Governance is the allocation of decision rights, responsibilities, controls, and accountability. In a digital storefront, governance answers questions such as:

• Who may collect, access, change, or delete customer data?
• Who approves vendors and monitors their security?
• Which products or sellers may use the platform?
• How are complaints, refunds, and data breaches escalated?
• Who reviews automated recommendations, fraud scores, and pricing models?
• What evidence demonstrates that controls operated effectively?

A useful distinction is between compliance, risk management, and ethics. Compliance asks whether the enterprise meets applicable legal requirements. Risk management asks whether threats are identified, assessed, treated, and monitored. Ethics asks whether conduct is fair, respectful, transparent, and responsible even when a practice is technically lawful.

These domains overlap but are not identical. A dark-pattern checkout process may evade a specific prohibition while still manipulating consumers. Conversely, a security control may exceed minimum legal requirements because the commercial consequences of failure are substantial.

A governance system should establish:

• Accountability: named owners for legal, privacy, security, accessibility, and vendor risks.
• Policies: approved rules for acceptable data use, security, retention, complaints, and content.
• Processes: repeatable methods for risk assessment, approval, incident response, and review.
• Evidence: records showing what was decided, by whom, and on what basis.
• Assurance: audits, testing, independent review, and corrective action.

2. Consumer Protection and Digital Contracts

Consumer protection

Consumer-protection law commonly addresses truthful marketing, price transparency, unfair terms, product safety, delivery obligations, refunds, warranties, subscription cancellation, and treatment of vulnerable consumers. A storefront should display the total material price before purchase, identify recurring charges, state delivery conditions, and avoid claims that cannot be substantiated.

Common risks include:

• hidden shipping, service, or renewal charges;
• false scarcity messages such as unsupported “only one left” claims;
• fabricated reviews or suppression of genuine negative reviews;
• confusing consent mechanisms and preselected optional purchases;
• unclear distinctions between a marketplace seller and the platform operator;
• failure to provide legally required cancellation, refund, or warranty rights.

The principle of transparency requires information to be understandable at the moment it matters, not merely buried in lengthy terms. Fairness requires that contractual and interface design do not exploit information asymmetry, urgency, disability, age, or financial vulnerability.

Contract formation

An online transaction generally involves an offer or invitation to treat, acceptance, consideration, and an intention to create legal relations, although the precise rules depend on jurisdiction. The checkout design should make clear when the customer is placing a binding order, whether the seller may reject it, and when payment is authorized.

Important contractual documents include:

• terms of sale;
• privacy notice;
• acceptable-use or community rules;
• delivery, returns, refund, and warranty policies;
• subscription terms;
• seller or vendor agreements;
• employment and contractor agreements;
• data-processing agreements with service providers.

Terms should identify the contracting entity, governing law, dispute process, limitations of liability, intellectual-property ownership, service levels, and conditions for suspension or termination. Clauses that attempt to exclude mandatory consumer rights may be ineffective and can create enforcement risk.

A clickwrap agreement requires the user to actively indicate assent, for example by selecting an unchecked box linked to terms. A browsewrap arrangement relies on use of a site as implied assent and is generally more vulnerable where notice and assent are unclear. Good practice is to present important terms conspicuously, require affirmative acceptance where appropriate, preserve the version accepted, and make terms accessible before payment.

3. Intellectual Property and Content Governance

Digital commerce depends on intellectual property (IP), including trademarks, copyright, patents, designs, trade secrets, domain names, software, photographs, product descriptions, and user-generated content.

A business should establish ownership or licensing rights for every important asset. Purchasing a photograph from a stock library does not necessarily permit resale of the image as a logo. Hiring a freelancer does not always transfer copyright unless the contract does so effectively. A vendor’s authorization to sell a product does not automatically authorize use of the manufacturer’s trademark in every promotional context.

Key controls include:

1. Conduct trademark and domain-name searches before launching a brand.
2. Record ownership, licenses, territories, duration, permitted media, and attribution requirements.
3. Use written agreements with designers, developers, influencers, photographers, and agencies.
4. Prohibit vendors from uploading infringing or counterfeit material.
5. Establish a notice-and-review process for alleged infringement.
6. Preserve evidence when removing or restoring disputed content.
7. Protect confidential algorithms, customer lists, pricing methods, and supplier terms through access controls and contractual confidentiality.

User-generated content creates additional issues. Terms should specify whether the platform receives a license to host, display, moderate, and promote content, while avoiding unnecessarily broad claims over users’ underlying ownership. Moderation should be consistent, explainable, and subject to an appeal route where feasible.

4. Taxation and Cross-Border Commerce

E-commerce taxation may involve sales tax, value-added tax (VAT), goods and services tax (GST), customs duties, excise taxes, income tax, withholding obligations, and platform reporting rules. Liability may depend on customer location, product type, seller identity, marketplace status, fulfillment location, and economic nexus thresholds.

A basic transaction tax calculation is:

The equation assumes that the sale is taxable, the tax base is correctly identified, exemptions and credits have been addressed, and the rate is expressed as a decimal. For a taxable sale of 100 monetary units at 20%, tax due is 100 × 0.20 = 20 monetary units. If the displayed price is tax-inclusive, the tax component is instead:

where r is the tax rate as a decimal. Thus, a tax-inclusive price of 120 at 20% contains 120 × 0.20 ÷ 1.20 = 20 of tax, leaving 100 as the net sale value.

These formulas are accounting representations, not universal legal rules. They do not determine whether a transaction is taxable, where tax is owed, or whether a marketplace is responsible for collection. Businesses should maintain transaction-level records of customer location, product classification, tax applied, exemptions, invoices, refunds, and evidence supporting tax decisions.

Cross-border operations add risks involving:

• import classification and customs valuation;
• restricted goods and sanctions screening;
• consumer rights in the buyer’s country;
• data transfers and localization requirements;
• foreign exchange and payment regulation;
• permanent-establishment or digital-presence rules;
• language and accessibility requirements.

A prudent expansion process maps each target market before launch rather than assuming that a domestic storefront can simply be translated and opened internationally.

5. Accessibility and Inclusive Design

Accessibility means that people with disabilities can perceive, understand, navigate, interact with, and complete transactions using the storefront. It is both a legal obligation in many jurisdictions and a design quality that expands market reach.

A practical accessibility baseline includes:

• keyboard-operable navigation;
• logical heading structure and meaningful link text;
• sufficient color contrast and non-color indicators;
• text alternatives for informative images;
• captions or transcripts for relevant media;
• clear error messages and form labels;
• adequate focus indicators;
• compatibility with screen readers and browser zoom;
• accessible authentication, checkout, payment, and customer service;
• plain language and predictable navigation.

Accessibility should be tested throughout the customer journey, not only on the home page. Automated testing can detect some structural problems but cannot reliably assess meaningful alternative text, comprehensibility, or the experience of users with assistive technologies. Human testing and procurement requirements are therefore important.

Accessibility also intersects with privacy and security. For example, a fraud-control process that demands unnecessary biometric data may exclude users or create excessive privacy risk. Inclusive design seeks the least burdensome method that achieves the legitimate business purpose.

6. Privacy and Responsible Data Stewardship

Privacy governance begins with data mapping. The enterprise should identify what data is collected, from whom, why, where it is stored, who receives it, how long it is retained, and how it is deleted or anonymized. Typical e-commerce data includes identity, contact details, addresses, order history, payment tokens, device identifiers, behavioral data, customer-service records, and inferred preferences.

Core privacy principles commonly include:

• Lawfulness and transparency: use data on a valid basis and explain the practice clearly.
• Purpose limitation: collect for specified purposes rather than indefinite future uses.
• Data minimization: collect only what is reasonably necessary.
• Accuracy: correct materially inaccurate information.
• Storage limitation: retain data only as long as justified.
• Integrity and confidentiality: protect data against unauthorized access or loss.
• Accountability: demonstrate compliance through records and controls.

The legal terminology differs across regimes. Some frameworks distinguish controllers from processors; others impose sector-specific duties or consumer privacy rights. Organizations may need processes for access, correction, deletion, portability, objection, restriction, or withdrawal of consent. Consent should not be treated as a universal solution: it must be informed, specific, freely given where required, and capable of withdrawal.

A privacy impact assessment is appropriate when processing is likely to create significant risk, such as large-scale behavioral profiling, sensitive information, location tracking, facial recognition, or automated decisions with substantial effects. The assessment should describe the processing, identify risks to individuals, evaluate necessity and proportionality, and specify safeguards.

Privacy by design means that privacy requirements are included in architecture and product decisions. Examples include tokenizing payment details, separating identity from analytics identifiers, using role-based access, applying retention schedules, masking data in test environments, and offering privacy-preserving defaults.

7. Cybersecurity as Enterprise Risk Management

Cybersecurity protects confidentiality, integrity, and availability. In e-commerce, confidentiality concerns customer and business data; integrity concerns prices, orders, inventory, code, and content; availability concerns the ability to browse, pay, fulfill, and support customers.

A layered security program should include:

• asset inventories and data classification;
• strong authentication, including multifactor authentication for privileged access;
• least-privilege authorization and periodic access review;
• secure software development and dependency management;
• encryption in transit and at rest where appropriate;
• patching and vulnerability management;
• web-application firewalls and rate limiting where justified;
• payment-card security controls and tokenization;
• backups tested for restoration, not merely created;
• logging, monitoring, and alert triage;
• phishing resistance and staff training;
• incident response and communications plans;
• supplier security assessment and contractual controls.

Risk can be conceptualized as a function of threat, vulnerability, exposure, and impact. It is not necessary to assign a false precision to every risk. A qualitative matrix may classify likelihood and impact as low, medium, or high, provided the criteria are defined and applied consistently.

An incident-response lifecycle typically involves preparation, detection and analysis, containment, eradication, recovery, and post-incident learning. Notification duties may be triggered by the type of data, level of harm, jurisdiction, and contractual commitments. A business should maintain contact lists, decision thresholds, evidence-preservation procedures, customer communication templates, and relationships with legal, forensic, insurance, and law-enforcement resources.

Security controls can fail through misconfiguration, compromised vendors, credential theft, insecure application programming interfaces, malicious insiders, social engineering, or operational error. Security therefore requires continuous improvement rather than a one-time certification.

8. Platform, Vendor, and Algorithmic Governance

Platform governance

A marketplace must govern seller admission, product safety, prohibited goods, counterfeit detection, reviews, advertising, ranking, complaints, suspension, and appeals. Rules should be published in understandable language and applied consistently. Governance must address conflicts of interest, especially where the platform sells its own products while ranking third-party sellers.

Vendor governance

Vendor risk management should classify suppliers according to access, criticality, data sensitivity, geographic exposure, and operational dependence. Contracts should address security standards, confidentiality, subprocessors, breach notification, audit rights, deletion or return of data, business continuity, service levels, and termination assistance. Due diligence is not sufficient: vendors should be monitored throughout the relationship.

Algorithmic governance

Algorithms influence search ranking, recommendations, credit or fraud decisions, advertising, pricing, inventory allocation, and content moderation. Governance should document:

• the purpose and decision being supported;
• data sources and quality limitations;
• performance and error measures;
• potentially affected groups;
• human oversight and escalation;
• explainability appropriate to the decision;
• monitoring for drift and disparate outcomes;
• procedures for correction, appeal, and retirement.

A model may be accurate on average while systematically disadvantaging a subgroup. Fairness analysis should therefore examine relevant error rates and outcomes across groups where lawful and ethically appropriate. This analysis must consider measurement limitations, privacy, sample size, and the fact that fairness criteria can conflict. No single metric resolves all normative questions.

Generative AI introduces additional risks: fabricated product claims, leakage of confidential prompts or customer information, copyright disputes, unreviewed automated communications, and opaque vendor dependencies. Human review is essential for high-impact outputs, and organizations should prohibit the submission of unnecessary personal or confidential information to public AI services.

9. An Integrated Compliance Architecture

A mature program integrates legal requirements with operational controls. The following cycle is suitable for a growing digital venture:

1. Scope: identify markets, products, channels, data, vendors, and automated decisions.
2. Map obligations: identify applicable consumer, tax, privacy, accessibility, IP, security, and sector rules.
3. Assess risk: evaluate likelihood, impact, affected people, dependencies, and uncertainty.
4. Design controls: select preventive, detective, corrective, and compensating controls.
5. Assign ownership: name accountable executives and operational control owners.
6. Implement evidence: preserve approvals, logs, training records, contracts, tests, and decisions.
7. Monitor: track incidents, complaints, access reviews, vendor performance, accessibility defects, and model outcomes.
8. Improve: remediate weaknesses, test assumptions, and update controls after business or regulatory change.

A board or founders’ governance dashboard might include unresolved critical vulnerabilities, time to revoke access, incident response exercise results, complaint and refund patterns, accessibility defects, overdue vendor reviews, privacy-rights response times, tax exceptions, and algorithmic disparity indicators. Metrics should lead to decisions; collecting numbers without accountability creates the appearance rather than the substance of governance.

10. Illustrative Case: Northstar Marketplace

Background

Northstar is a fictional graduate-level case involving a marketplace that sells home electronics through independent merchants. It plans to enter three additional countries and introduce personalized recommendations, automated fraud screening, and a subscription-based service plan.

Problem

The founders discover that Northstar stores unnecessary identity documents, uses a single administrator account shared by contractors, imports product descriptions from suppliers without verifying IP rights, and displays prices excluding delivery charges until the final checkout step. Its fraud model rejects customers using certain prepaid cards at a substantially higher rate, but the company has not tested whether the pattern is justified or discriminatory. A logistics vendor has access to full customer addresses indefinitely.

Analysis

The risks are interconnected. Excessive data collection increases breach impact and may lack a defensible purpose. Shared accounts prevent reliable accountability and increase credential risk. Unverified supplier content creates copyright and trademark exposure. Late disclosure of charges may violate consumer-protection expectations and reduce trust. The fraud model may be using a proxy for geography or socioeconomic status. Indefinite vendor retention conflicts with minimization and storage limitation principles. Cross-border expansion may trigger new tax, consumer, privacy, and product-safety obligations.

Approach and solution

Northstar establishes a governance committee chaired by an executive with authority over risk. It creates a data inventory and deletes identity documents not required for a defined legal or operational purpose. Individual accounts, multifactor authentication, privileged-access reviews, and centralized logging replace shared administration.

The company redesigns checkout to show material charges before order confirmation, records the accepted version of terms, and creates a clear marketplace-seller disclosure. Supplier contracts include IP warranties and indemnity provisions, while content is reviewed through a takedown and appeal process.

The logistics contract is revised to limit access, prohibit unauthorized reuse, define breach-notification timeframes, require deletion or return of data, and permit assurance activities. Northstar conducts a privacy impact assessment for personalization and fraud screening. It tests the fraud model for performance across relevant customer groups, introduces a human review path, records reasons for adverse decisions, and monitors outcomes after deployment.

Before entering each country, the firm obtains local advice on indirect tax registration, customs, consumer rights, data transfers, accessibility, product restrictions, and dispute resolution. It runs keyboard and screen-reader testing on checkout and customer support, and establishes a quarterly governance review.

Outcome

The measures increase initial implementation cost and slow international launch, but they reduce unnecessary data holdings, improve conversion transparency, strengthen supplier accountability, and identify an avoidable source of unfair fraud rejections. Northstar gains a defensible evidence base for regulators, investors, partners, and customers.

Learning points

The case demonstrates that compliance is architectural. Privacy affects data design; security affects identity and vendor access; consumer law affects interface design; IP affects content operations; and algorithmic governance affects both product performance and legitimacy. Treating each issue as a separate legal checklist would have missed these dependencies.

11. Challenges and Limitations

First, legal rules differ across jurisdictions and change frequently. A general framework cannot replace current legal advice. Second, small enterprises may lack dedicated privacy, security, tax, and accessibility specialists. They must prioritize high-impact controls and use qualified external support without outsourcing accountability.

Third, compliance can become symbolic. Policies that employees cannot follow, assessments that are never revisited, and dashboards without decision rights provide little protection. Fourth, ethical judgments are contested. Fairness, privacy, convenience, personalization, and fraud prevention may conflict. Responsible governance requires documenting trade-offs, consulting affected stakeholders, and providing remedies.

Finally, technical controls have limits. Encryption cannot correct deceptive marketing; an accessibility statement cannot repair an unusable checkout; and an accurate algorithm can still optimize an ethically unacceptable objective. Governance must therefore combine technology, law, organizational behavior, and human judgment.

Best-Practice Checklist

Before launch or major expansion, an e-commerce venture should be able to answer “yes” to the following questions:

• Are prices, material terms, recurring charges, delivery, refunds, and seller identity clear?
• Are contracts, licenses, trademarks, and user-generated-content rights documented?
• Are tax, customs, product, and cross-border obligations mapped for each market?
• Can customers with disabilities complete the entire purchase and support journey?
• Is personal data mapped, minimized, protected, retained, and deleted appropriately?
• Are privileged accounts individual, authenticated strongly, and reviewed?
• Are backups, monitoring, vulnerability management, and incident response tested?
• Are vendors assessed, contracted, monitored, and terminated safely?
• Are automated decisions documented, tested, explainable as appropriate, and appealable?
• Are governance owners, evidence, metrics, and review dates defined?

Chapter Summary

Trustworthy e-commerce requires more than functional technology. Consumer protection demands transparent prices, fair interfaces, reliable claims, and effective remedies. Digital contracts should communicate assent, responsibilities, dispute arrangements, and mandatory rights clearly. Intellectual-property governance protects brands, software, content, and user contributions through ownership records, licenses, contracts, and takedown procedures.

Tax and cross-border compliance require transaction records and market-specific analysis. Accessibility is a legal, ethical, and commercial responsibility extending through checkout and customer support. Privacy governance applies minimization, purpose limitation, transparency, security, retention control, and accountability. Cybersecurity protects confidentiality, integrity, and availability through layered technical and organizational safeguards.

Platform, vendor, and algorithmic governance allocate responsibility and control conflicts of interest, supplier exposure, automated decisions, bias, explainability, and appeal. The central managerial lesson is integration: legal and ethical requirements must be embedded in product design, data architecture, contracts, procurement, operational processes, and leadership oversight.

Key Terms

Accessibility: Designing products and services so people with disabilities can use them effectively.

Algorithmic governance: Oversight of automated systems, including purpose, data, performance, fairness, monitoring, and accountability.

Breach notification: Communication required or undertaken after unauthorized access, disclosure, loss, or compromise of information.

Clickwrap: A digital agreement requiring affirmative user action to indicate acceptance.

Consumer protection: Legal and organizational measures safeguarding buyers from deception, unfairness, unsafe products, and improper treatment.

Controller: An entity that determines purposes and means of personal-data processing in regimes using this terminology.

Data minimization: Limiting collection to information reasonably necessary for a defined purpose.

Data-processing agreement: A contract defining how a service provider processes data for another organization.

Governance: Allocation of authority, responsibilities, controls, evidence, and accountability.

Intellectual property: Legally protected creations and commercial identifiers, such as copyright, trademarks, patents, designs, and trade secrets.

Least privilege: Providing only the access necessary to perform an authorized task.

Marketplace: A platform through which multiple sellers offer products or services to buyers.

Personal data: Information relating to an identified or identifiable person.

Privacy impact assessment: A structured evaluation of privacy risks and safeguards for proposed processing.

Risk-based approach: Prioritizing controls according to likelihood, impact, exposure, and affected stakeholders.

Tokenization: Replacing sensitive data with a substitute value that has limited use outside a controlled system.

Vendor governance: Due diligence, contracting, monitoring, and oversight of suppliers and service providers.

Vulnerability: A weakness that may be exploited by a threat.

Zero trust: A security approach that continuously verifies users, devices, and access rather than assuming inherent trust.

Review Questions

Short Answer Questions

1. Distinguish compliance, risk management, and ethics in an e-commerce context.
2. What information should a data inventory contain?
3. Explain why individual administrator accounts are preferable to shared accounts.
4. Identify four accessibility features relevant to online checkout.
5. What are the principal purposes of a vendor data-processing agreement?

Long Answer Questions

1. Explain how consumer protection and contract design influence the architecture of a digital storefront.
2. Develop an integrated privacy and cybersecurity program for a medium-sized online retailer.
3. Discuss the intellectual-property risks associated with supplier content and user-generated content.
4. Analyze the principal legal and operational challenges of cross-border e-commerce expansion.
5. Explain how an organization should govern an algorithm used for fraud screening or personalized recommendations.

Analytical / Application Questions

1. A marketplace reveals shipping charges only after payment details are entered. Analyze the consumer-protection, contractual, ethical, and conversion risks, and propose a redesign.
2. A recommendation system produces higher rejection rates for customers using prepaid cards. Design an investigation covering data quality, fairness, privacy, human review, and remediation.
3. Construct a 90-day governance plan for a startup that has no formal privacy program, uses several cloud vendors, and is preparing to enter two foreign markets.

Multiple Choice Questions with Answers

Question 1

Which practice best demonstrates data minimization?

A. Collecting all available customer information in case it becomes useful later

B. Collecting only information reasonably necessary for a specified purpose

C. Retaining every customer record permanently

D. Sharing customer data with all operational vendors

Correct Answer: B. Collecting only information reasonably necessary for a specified purpose

Question 2

A tax-inclusive price is 120 monetary units and the tax rate is 20%. What is the tax component?

A. 20 monetary units

B. 24 monetary units

C. 100 monetary units

D. 120 monetary units

Correct Answer: A. 20 monetary units

Question 3

Which feature most directly strengthens accountability for privileged access?

A. One shared administrator password

B. Individual accounts with multifactor authentication and access reviews

C. Disabling system logs

D. Allowing permanent access to all contractors

Correct Answer: B. Individual accounts with multifactor authentication and access reviews

Question 4

What is a principal purpose of a privacy impact assessment?

A. To maximize the number of fields collected

B. To identify privacy risks and evaluate safeguards before high-risk processing

C. To replace all cybersecurity testing

D. To determine a product’s customs classification

Correct Answer: B. To identify privacy risks and evaluate safeguards before high-risk processing

Question 5

Which statement best describes clickwrap?

A. Use of a website automatically creates assent without notice

B. A user actively indicates acceptance of presented terms

C. A contract signed only by a vendor

D. A privacy notice that cannot be changed

Correct Answer: B. A user actively indicates acceptance of presented terms

Question 6

Which control is most relevant to intellectual-property governance?

A. Using supplier content without verification

B. Maintaining records of ownership, licenses, territories, and permitted uses

C. Deleting all product descriptions

D. Giving every user ownership of the company’s trademarks

Correct Answer: B. Maintaining records of ownership, licenses, territories, and permitted uses

Question 7

Which activity belongs to incident response?

A. Ignoring evidence after a suspected breach

B. Preparation, detection, containment, recovery, and post-incident learning

C. Removing all monitoring controls

D. Publishing passwords to affected customers

Correct Answer: B. Preparation, detection, containment, recovery, and post-incident learning

Question 8

Why is human review important in high-impact algorithmic decisions?

A. It guarantees that an algorithm is always accurate

B. It provides escalation, contextual judgment, and an opportunity to challenge outcomes

C. It eliminates the need for data protection

D. It makes documentation unnecessary

Correct Answer: B. It provides escalation, contextual judgment, and an opportunity to challenge outcomes

Question 9

Which is an example of accessibility testing beyond automated scanning?

A. Testing only the logo’s color

B. Using keyboard navigation and screen-reader testing through checkout

C. Removing labels from form fields

D. Disabling browser zoom

Correct Answer: B. Using keyboard navigation and screen-reader testing through checkout

Question 10

Which statement about cross-border e-commerce is most accurate?

A. A domestic storefront can always be launched abroad without modification

B. Only currency conversion matters in international expansion

C. Each target market should be assessed for tax, consumer, privacy, customs, and product obligations

D. Cross-border sales eliminate the need for contracts

Correct Answer: C. Each target market should be assessed for tax, consumer, privacy, customs, and product obligations