Law, Ethics, Governance and Sustainable Commerce

Introduction and context

E-commerce has transformed the relationship between firms, consumers, workers, governments and the environment. A digital marketplace can reach millions of customers, process payments across borders, personalise offers, and coordinate independent sellers at extraordinary speed. These capabilities also create risks: misleading interfaces, unlawful data collection, counterfeit goods, tax avoidance, algorithmic discrimination, unsafe products, insecure payment systems, labour exploitation and excessive packaging.

Law establishes minimum enforceable standards. Ethics asks what responsible organisations ought to do, including when legal rules are incomplete. Governance converts legal and ethical commitments into accountable structures, policies, controls and evidence. Sustainable commerce extends the analysis to long-term social, economic and environmental effects.

For managers, compliance is therefore not merely a legal department's task. Product design, marketing, procurement, information technology, logistics, customer service and finance all influence the organisation's legal and ethical exposure.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the main legal and ethical obligations affecting digital commerce.
2. Distinguish privacy, consent, security and data governance.
3. Evaluate consumer-protection, competition, intellectual-property and taxation risks.
4. Analyse dark patterns, algorithmic bias and platform power.
5. Design basic governance controls for marketplaces and digital businesses.
6. Assess worker, community and environmental consequences of e-commerce.
7. Apply these ideas to cross-border and managerial decision-making.

1. The institutional landscape of digital commerce

An online transaction may involve a consumer, seller, platform, payment processor, cloud provider, advertising network, delivery firm and public authority. Their legal relationships differ according to the business model. A first-party retailer sells its own inventory; a marketplace facilitates transactions between third-party sellers and buyers; a social-commerce platform combines content, advertising and commerce; and a subscription service creates continuing payment and cancellation obligations.

The applicable rules depend on factors such as the consumer's location, the seller's establishment, the place of delivery, the type of product, the data processed and the sector involved. Important sources commonly include consumer-protection law, privacy and data-protection law, electronic-transactions statutes, tax law, competition law, intellectual-property law, product-safety rules, employment law and environmental regulation. The exact requirements vary by jurisdiction; managers must obtain local legal advice rather than assuming that one country's rules apply globally.

A useful compliance principle is accountability: the organisation should be able to demonstrate not only that it intended to comply, but also that it identified risks, assigned responsibility, implemented controls, monitored performance and corrected failures.

2. Consumer protection and fair digital contracting

Consumer-protection law generally seeks to reduce information asymmetry and protect consumers from unsafe products, deception, unfair contract terms and exploitative sales practices. Digital commerce intensifies information asymmetry because consumers cannot physically inspect goods and may not know whether a seller, review or recommendation is genuine.

Information and transparency

A responsible interface should clearly disclose the identity of the trader, material product characteristics, total price, delivery charges, taxes where required, payment terms, subscription conditions, cancellation rights, return procedures, warranties and complaint channels. Important information should not be hidden in dense terms and conditions. A claim such as “lowest price,” “limited stock” or “carbon neutral” should be truthful, substantiated and presented with relevant qualifications.

Reviews and ratings require special care. Platforms should prohibit fabricated reviews, disclose incentives, distinguish verified purchases where the label is meaningful, and avoid suppressing unfavourable reviews merely because they are unfavourable. Ranking systems should not represent paid placement as neutral relevance without appropriate disclosure.

Digital contracts and remedies

Electronic contracts may be valid when parties receive adequate notice of terms and provide meaningful assent. A pre-ticked box, ambiguous button or hidden recurring charge may undermine informed consent and may breach consumer law. Businesses should provide accessible records of transactions and a practical way to correct input errors before submission.

Remedies can include repair, replacement, refund, cancellation, compensation or removal of unlawful content. The platform's terms should not falsely suggest that statutory consumer rights can be waived. Customer-service systems should be designed to resolve disputes, not merely to prevent contact with human staff.

3. Privacy, consent and data governance

Privacy concerns the appropriate collection and use of information about identifiable or identifiable people. Personal data may include names, contact details, identifiers, location, purchase history, device information, inferred interests and biometric information. Sensitive categories often receive stronger protection.

Privacy principles

Although legal formulations differ, sound data practice commonly includes:

• Purpose limitation: collect data for specified, legitimate purposes.
• Data minimisation: collect only what is reasonably necessary.
• Accuracy: allow correction of materially inaccurate data.
• Storage limitation: delete or anonymise data when retention is no longer justified.
• Security: protect confidentiality, integrity and availability.
• Transparency: explain collection, use, sharing and rights in understandable language.
• Accountability: document decisions and demonstrate compliance.

Consent is only one possible legal basis for processing in some legal systems. Valid consent normally requires a real choice, specific information, an affirmative act and the ability to withdraw without unreasonable penalty. Consent obtained through coercion, silence, confusing design or a bundled choice may not be meaningful. A business should not request consent for uses that are unnecessary to provide the service when refusal would unfairly prevent access.

Governance lifecycle

A practical data-governance lifecycle is:

1. Inventory: identify data categories, sources, owners, systems and recipients.
2. Classify: distinguish public, internal, confidential and sensitive information.
3. Assess: document purpose, legal basis, necessity, risk and retention period.
4. Control: apply access restrictions, encryption, authentication, logging and deletion rules.
5. Monitor: test controls, investigate incidents and review vendors.
6. Improve: update policies after regulatory, technological or business change.

Privacy impact assessments are particularly useful for profiling, biometric identification, location tracking, children's data, large-scale monitoring and high-impact automated decisions. Vendor contracts should specify permitted processing, security standards, breach notification, audit rights, deletion and subcontracting.

Security is not identical to privacy. Encryption may protect data from unauthorised access, but a company can still misuse securely stored information for an excessive or undisclosed purpose.

4. Competition and platform governance

Digital markets can generate consumer benefits through convenience, innovation and network effects. They can also become concentrated because users prefer platforms with many buyers and sellers, while sellers prefer platforms with many users. Data advantages, switching costs, self-preferencing and control over ranking can reinforce market power.

Competition concerns may arise when a platform:

• ranks its own products above better competing offers;
• uses sellers' commercially sensitive data to copy or disadvantage them;
• imposes discriminatory access or excessive fees;
• prevents multihoming or interoperability without justification;
• bundles unrelated services to exclude rivals;
• acquires emerging competitors primarily to remove future competition; or
• coordinates prices or restricts independent seller pricing unlawfully.

Not every large platform conduct is illegal, and competition analysis is jurisdiction-specific. Managers should assess market definition, market power, effects on competition, efficiency benefits and less restrictive alternatives. Governance should separate commercial decision-making from moderation and ranking where conflicts are substantial, document ranking objectives, provide seller explanations, and establish appeal mechanisms.

5. Intellectual property and counterfeit control

Intellectual property includes copyright, trademarks, patents, designs, trade secrets and, in some jurisdictions, database rights. E-commerce businesses must secure licences for photographs, music, software, product descriptions, fonts, user-generated content and third-party data. “Found online” does not mean “free to copy.”

Trademark misuse may confuse consumers about source or sponsorship. Copyright infringement may occur when a seller copies product images or when users upload protected material. Marketplaces should operate notice-and-action processes, retain evidence, identify repeat infringers, and avoid removing lawful criticism or comparative advertising merely because a complaint is filed.

Counterfeit goods create consumer-safety and reputational risks. Effective controls include seller verification, risk-based product screening, serial-number checks where feasible, trusted-brand reporting channels, customs cooperation, transaction holds and transparent enforcement. Automated detection should support, not replace, human review because false positives can harm legitimate small sellers.

6. Taxation and cross-border obligations

Tax responsibilities may involve corporate income tax, value-added or goods-and-services tax, sales tax, customs duties, withholding tax and digital-service taxes. The liability depends on jurisdiction, nexus, product classification, seller status, transaction value, customer location and marketplace rules.

A marketplace should determine whether it is merely an intermediary or is treated as a deemed supplier or marketplace facilitator for indirect tax. It may need to collect tax, issue records, verify seller information and report transactions. Cross-border shipments also require accurate descriptions, valuation, origin information and tariff classification. Artificially splitting shipments or misdeclaring value can create legal and ethical exposure.

A basic managerial control is a tax decision matrix recording: customer jurisdiction, seller jurisdiction, delivery destination, product category, applicable tax, collection party, invoice requirement and evidence retained. Tax planning can be legitimate, but deliberately concealing sales, misrepresenting residence or exploiting contradictory rules is not responsible governance.

7. Dark patterns, algorithmic bias and responsible AI

A dark pattern is a user-interface or choice architecture that materially steers people toward a decision they might not otherwise make, often by exploiting confusion, urgency or cognitive bias. Examples include hidden subscription renewal, difficult cancellation, preselected add-ons, disguised advertising, confirmshaming, misleading countdowns and visual asymmetry that makes acceptance easy but refusal difficult.

Ethical evaluation should ask:

1. Is the choice understandable?
2. Are all material options presented with comparable prominence?
3. Can the user reverse the decision easily?
4. Does the design exploit vulnerability or impaired attention?
5. Would a reasonable user describe the outcome as surprising or deceptive?

Algorithmic systems may personalise prices, rank sellers, approve accounts, detect fraud or allocate advertising. Bias can enter through historical data, labels, proxy variables, sampling, objectives and feedback loops. A model can be statistically accurate overall yet systematically disadvantage a protected or vulnerable group.

Responsible algorithm governance includes a clear purpose, data-quality testing, documentation, pre-deployment impact assessment, subgroup performance analysis, human oversight, explanation appropriate to the decision, appeal rights, monitoring for drift and controlled retirement. Fairness is not a single universal metric: different measures can conflict, and managers must connect the selected standard to legal duties, social context and the harm at stake.

8. Platform and corporate governance

Governance assigns authority and accountability. A practical structure includes board oversight, an executive owner, a cross-functional risk committee, operational control owners, internal audit and accessible reporting channels. The three-lines model is useful: operational teams own risks, specialist compliance and risk functions advise and monitor, and internal audit provides independent assurance.

A platform governance policy should cover:

• seller admission and identity verification;
• prohibited products and content;
• ranking and recommendation principles;
• advertising labelling;
• complaints, appeals and enforcement consistency;
• privacy, security and data sharing;
• intellectual-property complaints;
• incident response and regulator communication; and
• metrics, reporting and independent review.

Key performance indicators should not reward growth alone. A balanced dashboard may include complaint resolution time, refund rates, counterfeit takedowns, privacy requests, security incidents, seller appeal outcomes, algorithmic disparity indicators, delivery emissions and packaging intensity. Measurement does not eliminate judgement; it makes assumptions visible.

9. Workers, communities and environmental responsibility

E-commerce depends on warehouse employees, delivery workers, content moderators, customer-service staff and independent contractors. Risks include excessive surveillance, algorithmic scheduling, unsafe productivity targets, insecure income, misclassification, discrimination and psychological harm. Responsible firms conduct human-rights due diligence, provide safe conditions, respect lawful worker voice, assess contractor impacts and offer remedy when harms occur.

Environmental responsibility extends beyond a sustainability claim on a product page. Relevant impacts include energy use in data centres and warehouses, transport emissions, returns, packaging, unsold inventory, electronic waste and product end-of-life. A credible programme measures the full system rather than shifting emissions from one stage to another.

Useful indicators include:

• emissions per order or per delivered unit;
• packaging mass per shipment;
• return rate and avoidable-return rate;
• percentage of recycled or reusable packaging;
• delivery-consolidation rate; and
• share of products with repair, reuse or take-back options.

Claims such as “green,” “eco-friendly” or “net zero” require a defined boundary, evidence and explanation of exclusions. Carbon offsets do not automatically make a product or delivery emission-free. Sustainable commerce also requires accessible options: a premium low-carbon service that excludes lower-income consumers may create distributive concerns.

10. Cross-border compliance strategy

Cross-border commerce should be designed as a legal system, not added after market entry. Before launching, managers should map jurisdictions, products, customer groups, data flows, payment routes, fulfilment locations and third parties. They should then identify mandatory local disclosures, language requirements, consumer remedies, product standards, tax obligations, privacy transfers, sanctions controls and dispute-resolution rules.

A proportionate strategy uses risk tiers. High-risk activities—such as children's products, health claims, financial services, biometric processing and automated eligibility decisions—require enhanced review. Contracts should allocate responsibility but should not be treated as a substitute for operational control. Local counsel, tax specialists and specialised compliance teams may be necessary.

Applied case: Northstar Marketplace (illustrative)

Background

Northstar is a fictional regional marketplace selling household goods through independent merchants. Its rapid growth came from personalised recommendations, one-click purchasing and low-cost international shipping.

Problem

A consumer investigation found that the site preselected an insurance add-on, displayed a “two minutes left” countdown that repeatedly reset, and made cancellation available only through a hidden support route. Several sellers copied branded images and sold counterfeit chargers. Northstar also retained detailed browsing histories indefinitely and used seller data to launch competing products. Delivery packaging increased sharply, while contractors reported algorithmically imposed delivery targets.

Analysis

The company faced interconnected risks: possible unfair commercial practices, inadequate consent, intellectual-property and product-safety exposure, competition concerns, privacy non-compliance, worker harm and environmental impacts. The common management failure was treating growth metrics as the primary objective without a governance system capable of detecting externalities.

Approach and solution

Northstar created a board-level responsibility committee and assigned executives for consumer protection, data, marketplace integrity, workers and sustainability. It removed preselected add-ons, made refusal and cancellation as prominent as acceptance, and tested interfaces with representative users. It introduced seller verification, brand reporting, product sampling and a repeat-infringer process. Seller-data access was restricted and logged, with a review of self-preferencing.

The firm established retention schedules, a data inventory, privacy assessments for personalisation, access controls and a consumer rights portal. It changed delivery incentives to include safety and realistic service windows, consulted workers and audited contractors. Finally, it measured packaging per order, consolidated shipments where customers agreed, and required evidence for environmental claims.

Outcome

In this illustrative scenario, short-term conversion fell modestly because manipulative prompts were removed. Complaints and chargebacks declined, legitimate sellers gained confidence, and the company reduced legal uncertainty. The case demonstrates that ethical design may reduce a narrow metric while improving durable trust, resilience and stakeholder value.

Learning points

1. Legal, ethical, operational and sustainability risks often share the same root cause: weak accountability.
2. Platform governance must address both the platform's own conduct and third-party sellers.
3. Transparency is meaningful only when users can understand and act on it.
4. Responsible innovation requires monitoring after launch, not only approval before launch.

Challenges and limitations

Compliance programmes can become symbolic paperwork. Policies may be inconsistent across countries, and small firms may lack specialist resources. Automated moderation and fraud detection can produce false positives, while transparency can expose security-sensitive information or enable gaming. Sustainability metrics may omit indirect effects, and privacy-preserving personalisation may reduce some commercial performance. Finally, governance cannot resolve every value conflict: firms must make explicit choices about acceptable risk, fairness, access and distributional consequences.

Best-practice implementation checklist

A manager launching or reviewing an e-commerce service should:

1. Map stakeholders, jurisdictions, data, products and third parties.
2. Identify legal obligations and high-impact ethical risks.
3. Assign accountable owners and escalation routes.
4. Design clear choices, truthful claims and accessible remedies.
5. Minimise data and secure it throughout its lifecycle.
6. Test algorithms and interfaces for disparate impact and manipulation.
7. Verify sellers, products, licences, tax information and environmental claims.
8. Monitor workers and contractors for safety, dignity and fair treatment.
9. Measure outcomes, audit controls and publish appropriate evidence.
10. Provide remedy, learn from incidents and revise the system continuously.

Chapter Summary

Law, ethics, governance and sustainability are mutually reinforcing dimensions of responsible e-commerce. Consumer protection requires truthful information, fair digital contracts, safe products and effective remedies. Privacy requires purpose limitation, meaningful choice, minimisation, security and accountable data governance. Competition and intellectual-property rules constrain platform self-preferencing, exclusionary conduct, copying and counterfeit trade. Tax and cross-border obligations require jurisdictional analysis, accurate records and responsible transaction design.

Dark patterns undermine autonomy, while algorithmic bias can distribute opportunity and harm unfairly. Governance responds through accountable leadership, documented policies, impact assessments, monitoring, appeals and independent assurance. Sustainable commerce must include workers, communities, emissions, packaging, returns and product life cycles. The central managerial lesson is that trust and compliance must be designed into the platform's operating model rather than added after growth.

Key Terms

Accountability: The duty to explain decisions, demonstrate compliance and accept responsibility for outcomes.

Algorithmic bias: Systematic and unjustified disadvantage produced or amplified by an automated system.

Consent: A voluntary, informed and specific indication of agreement to a defined use of data or action.

Consumer protection: Legal and institutional measures protecting buyers from deception, unsafe products and unfair practices.

Dark pattern: Interface design that manipulates or pressures users into choices they may not otherwise make.

Data minimisation: Collection and use of only the data reasonably necessary for a stated purpose.

Data governance: Structures, rules and controls for managing data quality, access, use, security and retention.

Deemed supplier: A platform treated by law as responsible for a sale, often for indirect-tax purposes.

Intellectual property: Legally protected creations, signs, inventions, designs, information and content.

Marketplace: A digital platform that facilitates transactions between independent buyers and sellers.

Network effect: A change in the value of a service as the number of users increases.

Personal data: Information relating to an identified or identifiable person.

Privacy impact assessment: A structured evaluation of privacy risks and safeguards for a proposed activity.

Self-preferencing: A platform favouring its own products or services in ranking or access decisions.

Sustainable commerce: Commercial activity designed to remain economically viable while reducing environmental and social harm.

Tax nexus: A legally relevant connection that can create tax obligations in a jurisdiction.

Third-party seller: An independent merchant using a platform to offer goods or services.

Worker due diligence: Processes for identifying, preventing, mitigating and remedying labour-related harms.

Review Questions

Short Answer Questions

1. Why is security necessary but not sufficient for privacy compliance?
2. Identify four principles of responsible data governance.
3. What is a dark pattern? Give two examples.
4. Why can network effects strengthen platform market power?
5. List three environmental impacts associated with e-commerce.

Long Answer Questions

1. Explain how consumer protection applies to digital contracts, reviews, rankings and cancellation processes.
2. Discuss the governance lifecycle for personal data from inventory through deletion.
3. Analyse the relationship between platform power, self-preferencing and competition.
4. Explain how algorithmic bias can arise and propose a responsible AI control framework.
5. Evaluate the legal, ethical and sustainability responsibilities of a cross-border marketplace.

Analytical / Application Questions

1. A marketplace uses a preselected subscription box and requires six screens to cancel it. Evaluate the design and recommend changes.
2. A recommendation model produces higher seller visibility for merchants with extensive historical sales, disadvantaging new entrants. What evidence and governance controls should managers use to assess and address the problem?
3. Design a risk-based launch checklist for an online marketplace selling children's products across three jurisdictions, including privacy, safety, tax, competition and environmental issues.

Multiple Choice Questions with Answers

Question 1

Which practice best reflects data minimisation?

A. Collecting all available customer data in case it becomes useful later

B. Collecting only data necessary for a specified legitimate purpose

C. Retaining personal data permanently after the transaction

D. Sharing customer data with every marketplace seller

Correct Answer: B. Collecting only data necessary for a specified legitimate purpose

Question 2

What is a dark pattern?

A. A cybersecurity encryption method

B. A lawful trademark-registration process

C. An interface design that manipulates users into choices they may not otherwise make

D. A system for calculating customs duties

Correct Answer: C. An interface design that manipulates users into choices they may not otherwise make

Question 3

Which action most directly addresses counterfeit goods on a marketplace?

A. Removing all negative customer reviews

B. Using seller verification and a notice-and-action process

C. Increasing the number of unrelated advertisements

D. Retaining browsing data indefinitely

Correct Answer: B. Using seller verification and a notice-and-action process

Question 4

Self-preferencing occurs when a platform:

A. Allows customers to compare several sellers

B. Favours its own products in rankings or access decisions

C. Provides a refund after a defective delivery

D. Encrypts payment information

Correct Answer: B. Favours its own products in rankings or access decisions

Question 5

Which statement about consent is most accurate?

A. Silence always constitutes valid consent

B. Consent should involve a meaningful and informed choice

C. Consent permits any future use of data without limitation

D. Consent can never be withdrawn

Correct Answer: B. Consent should involve a meaningful and informed choice

Question 6

A marketplace facilitator may have tax responsibilities based primarily on:

A. The colour of its website

B. The number of product photographs used

C. Applicable jurisdictional rules, transaction facts and its legal role

D. Whether customers submit positive reviews

Correct Answer: C. Applicable jurisdictional rules, transaction facts and its legal role

Question 7

Which is an example of algorithmic-bias governance?

A. Ignoring subgroup outcomes because overall accuracy is high

B. Testing performance across relevant groups and providing appeal mechanisms

C. Removing all human oversight from high-impact decisions

D. Using historical data without examining how it was produced

Correct Answer: B. Testing performance across relevant groups and providing appeal mechanisms

Question 8

Which environmental indicator is most directly related to packaging efficiency?

A. Packaging mass per shipment

B. Number of customer passwords

C. Average seller login time

D. Trademark registrations per year

Correct Answer: A. Packaging mass per shipment

Question 9

Why should a platform provide seller appeals?

A. To eliminate all enforcement rules

B. To allow review of potentially mistaken or inconsistent decisions

C. To guarantee every seller appears first in rankings

D. To replace product-safety checks

Correct Answer: B. To allow review of potentially mistaken or inconsistent decisions

Question 10

Which governance arrangement best reflects the three-lines model?

A. Only the marketing department manages all risks

B. Operations own risks, specialist functions monitor, and internal audit provides independent assurance

C. External customers approve every internal control

D. The board delegates all responsibility without reporting

Correct Answer: B. Operations own risks, specialist functions monitor, and internal audit provides independent assurance