Law, Ethics, Governance and Sustainable Commerce

Introduction

Electronic commerce is not merely the digital exchange of products and payments. It is a legally regulated, socially embedded and environmentally consequential system involving consumers, merchants, platforms, payment providers, logistics firms, advertisers, software developers and public authorities. A technically successful online store may still fail because its terms are unenforceable, its advertising is misleading, its data practices violate privacy rules, or its supply chain creates unacceptable social and environmental harm.

This chapter examines the legal, ethical and governance foundations of e-commerce. It focuses on electronic contracts, consumer protection, intellectual property, taxation, privacy, advertising, platform regulation, organizational controls, dark patterns, inclusion and sustainable commerce. Because laws differ across jurisdictions, the chapter presents general principles rather than jurisdiction-specific legal advice. Organizations must obtain current professional advice before entering a market or designing a compliance program.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain how electronic contracts are formed and enforced.
2. Evaluate consumer-protection, intellectual-property, privacy and advertising obligations.
3. Distinguish legal compliance from broader ethical responsibility.
4. Design a governance structure for data, vendors, risk and compliance.
5. Identify dark patterns and assess their effects on autonomy and inclusion.
6. Analyze taxation and platform-regulation issues in cross-border commerce.
7. Propose practical measures for environmentally and socially sustainable e-commerce.

1. Legal Foundations of Digital Commerce

1.1 Electronic contracts

A contract is generally formed when parties reach an enforceable agreement supported by consideration or another legally recognized basis. In e-commerce, the parties may never meet, and agreement may be expressed through clicks, electronic signatures, electronic messages or conduct such as payment and delivery.

The principal elements commonly include:

• offer: a sufficiently definite proposal capable of acceptance;
• acceptance: an unqualified agreement to the offer;
• consideration or an equivalent legal requirement;
• intention to create legal relations;
• capacity of the parties;
• legality of purpose; and
• certainty of terms.

A product page is not always a legal offer. In some systems it is an invitation for customers to make offers, which the seller may accept when it confirms the order. The answer depends on the wording, jurisdiction and commercial context. Automated ordering systems should therefore distinguish between an order acknowledgement and a legally significant order acceptance.

Electronic contracts raise special questions. Can a record be retrieved and reproduced? Was the identity of the contracting party authenticated? Did the user have reasonable notice of terms? Was consent obtained before the transaction? Were material terms displayed clearly? Electronic-transactions legislation in many jurisdictions gives electronic records and signatures legal recognition, but usually subject to conditions concerning reliability, consent, retention and accessibility.

A clickwrap agreement requires the user to actively select a button such as “I agree” after being presented with terms. A browsewrap arrangement attempts to bind the user merely through use of a website while terms are linked elsewhere. Clickwrap generally provides stronger evidence of notice and assent. A good design separates acceptance of sale terms from consent to optional marketing and does not make a consumer accept unrelated conditions to purchase an essential product.

Electronic records should preserve the version of terms applicable at the time of contracting, timestamps, identity or account information, transaction details, notices and acceptance evidence. However, storing evidence does not cure unfair or unlawful terms. Contractual clauses may be invalidated by consumer-protection rules, unconscionability doctrines, public policy or mandatory local law.

1.2 Consumer protection

Consumer law seeks to correct information and bargaining-power imbalances. Typical obligations include accurate product descriptions, transparent prices, disclosure of delivery charges, fair cancellation or withdrawal rights, warranties, refund procedures, accessible complaint channels and protection against unsafe goods.

Important principles include:

• Transparency: material information must be clear, timely and understandable.
• Accuracy: claims about performance, origin, scarcity and reviews must be truthful.
• Fairness: terms should not impose disproportionate penalties or remove mandatory rights.
• Safety: products and services must meet applicable safety standards.
• Remedy: consumers need effective refunds, repair, replacement or compensation mechanisms.
• Accessibility: people with disabilities and users with limited digital skills must not be excluded.

Marketplace operators must clarify whether they are the seller, an agent, an intermediary or a service provider. That role affects liability, product-safety duties, tax collection, seller verification and dispute resolution. A platform that presents every merchant as if it were the platform itself may create consumer confusion and additional legal exposure.

Reviews deserve particular attention. Incentivized reviews, fabricated testimonials, suppression of negative reviews and undisclosed ranking manipulation undermine informed choice. A responsible system identifies verified purchases where feasible, discloses incentives and explains moderation criteria without selectively deleting legitimate criticism.

1.3 Intellectual property

E-commerce relies heavily on intellectual property (IP): trademarks identify sellers, copyright protects text and images, patents may protect technical inventions, and trade secrets protect confidential commercial information. Digital copying makes infringement rapid and inexpensive.

A retailer should obtain permission for product photographs, music, software, fonts, written descriptions and influencer content unless a valid license or legal exception applies. “Found online” does not mean “free to use.” Licenses should specify territory, duration, media, modification rights and sublicensing. Open-source software also carries license conditions; some licenses require disclosure of source code for derivative works, while others permit more restrictive distribution.

Trademark risks include using another party’s mark in a domain name, keyword advertising, metadata or product listing in a way that causes confusion. Counterfeit goods create both IP and consumer-safety risks. Platforms commonly use notice-and-action procedures, repeat-infringer policies, seller verification and evidence preservation, but these systems must avoid removing lawful criticism, comparative advertising or legitimate resale.

2. Privacy, Data Governance and Cybersecurity

2.1 Privacy as a governance responsibility

E-commerce processes identity data, contact details, payment information, location, browsing behavior, purchase history and inferred preferences. Privacy is not simply a technical security issue. It concerns power, autonomy, dignity, fairness and the appropriate use of information.

Common privacy principles include:

1. Lawfulness, fairness and transparency: explain what is collected and why.
2. Purpose limitation: use data for specified legitimate purposes.
3. Data minimization: collect only what is reasonably necessary.
4. Accuracy: allow correction of materially inaccurate information.
5. Storage limitation: retain data no longer than justified.
6. Security: protect confidentiality, integrity and availability.
7. Accountability: demonstrate compliance through policies and evidence.

Organizations should identify the legal basis for processing where required, distinguish necessary transaction processing from optional profiling, provide understandable privacy notices and manage consent records. Consent should be informed, specific, freely given and withdrawable where consent is the basis. Bundling optional marketing consent into an unavoidable purchase flow is ethically weak and may be unlawful.

Special care is needed with children’s data, biometric information, precise location, health-related information and inferences used for credit, pricing or eligibility decisions. Cross-border transfers may require contractual, organizational or regulatory safeguards. A privacy impact assessment is appropriate for high-risk activities such as large-scale profiling, facial recognition or combining datasets from multiple sources.

2.2 Data governance

Data governance allocates decision rights and accountability. A practical governance model includes:

• a board or executive committee responsible for risk appetite;
• a privacy or data-protection lead;
• information-security leadership;
• business data owners;
• technical data stewards;
• procurement and vendor-management staff;
• legal, compliance and internal-audit functions; and
• an incident-response team.

A data inventory should record categories, sources, purposes, owners, systems, retention periods, access groups, transfers and deletion methods. Classification schemes may distinguish public, internal, confidential and highly restricted information. Access should follow least privilege: a user receives only the access needed for assigned duties.

Security controls should include encryption in transit and at rest where appropriate, multifactor authentication, secure development, vulnerability management, logging, backups, employee training and tested incident-response procedures. No control guarantees perfect security. Governance therefore includes detection, communication, remediation and learning after incidents.

2.3 Artificial intelligence in commerce

AI can personalize search, detect fraud, forecast demand and automate customer service. It can also produce discriminatory offers, infer sensitive traits, generate deceptive content or make opaque eligibility decisions. Governance should require documented purposes, data-quality testing, human oversight for consequential decisions, model monitoring, explainability appropriate to the use case and a route for correction or appeal.

An AI-generated product description remains the merchant’s responsibility. Automated systems should not invent safety certifications, medical claims, reviews or legal rights. Generative tools should also be assessed for copyright, confidentiality and personal-data risks.

3. Advertising, Dark Patterns and Inclusion

3.1 Responsible digital advertising

Advertising law commonly prohibits false, misleading or unsubstantiated claims. Claims about price, discounts, environmental benefits, health effects, availability, delivery time and product performance should be supported before publication. A “was” price should represent a genuine prior price rather than an artificial reference point. Sponsored influencer content should be clearly disclosed, and endorsements should reflect genuine experience.

Behavioral advertising creates additional concerns. Tracking technologies, profiling and retargeting should respect applicable privacy rules and provide meaningful choices. Children and vulnerable groups require heightened protection because they may have less ability to recognize persuasion or resist manipulation.

3.2 Dark patterns

Dark patterns are interface designs that steer, pressure or deceive users into choices they might not otherwise make. Examples include:

• preselected optional add-ons;
• confusingly unequal “accept” and “reject” buttons;
• hidden subscription renewal;
• false countdown timers;
• difficult cancellation paths;
• guilt-laden wording when a user declines; and
• disguised advertisements or misleading social-proof messages.

The ethical problem is not persuasion itself. Commerce necessarily communicates value and attempts to influence decisions. The problem arises when design impairs comprehension, autonomy or the ability to choose freely. A useful test asks whether a reasonable user can understand the choice, identify the commercial purpose, decline without disproportionate friction and reverse the decision.

3.3 Inclusion and accessibility

Inclusive commerce considers disability, language, literacy, income, age, geography, connectivity and cultural differences. Practical measures include keyboard navigation, screen-reader compatibility, sufficient color contrast, captions, text alternatives, plain language, local payment methods, transparent delivery limitations and non-digital support channels. Accessibility should be designed from the beginning rather than treated as a late compliance patch.

4. Taxation and Cross-Border Commerce

E-commerce may trigger obligations concerning sales tax, value-added tax, goods and services tax, customs duties, income tax, withholding tax and digital-services taxation. The applicable rule may depend on customer location, seller establishment, product classification, transaction value, marketplace status and whether the supply is goods, services or digital content.

A platform may be required to register, collect tax, issue invoices, verify sellers, retain records or report transactions. Cross-border shipments also involve customs declarations, import restrictions, product standards and sanctions controls. “Tax-free” marketing can be misleading when the consumer later pays duties or brokerage charges.

A sound tax-control process maps each product and transaction to jurisdiction, tax category, rate, exemption status, evidence of customer location and invoicing requirements. Tax engines can automate calculations, but responsibility for configuration, rate updates and exception handling remains with the organization. Finance, legal, product and engineering teams should jointly test tax changes before deployment.

5. Platform Regulation and Governance

Digital platforms exercise power through ranking, search visibility, seller access, commissions, data collection and dispute procedures. Regulation increasingly addresses intermediary liability, systemic risk, illegal goods, transparency of recommender systems, competition and the protection of minors. Requirements vary considerably by jurisdiction and platform size.

A platform governance framework should define:

• seller onboarding and identity verification;
• prohibited goods and services;
• content and listing standards;
• notice, appeal and reinstatement procedures;
• product-safety escalation;
• conflicts of interest in ranking;
• advertising disclosure;
• data access and portability where required;
• algorithmic accountability; and
• regulatory reporting.

Governance must balance enforcement with due process. Automated detection can identify suspicious listings at scale, but false positives can unfairly remove small businesses. High-impact decisions should permit explanation, human review and timely appeal. Platform rules should be consistently applied and publicly documented in language users can understand.

6. Enterprise Governance, Risk and Compliance

Compliance is most effective when integrated into business decision-making rather than treated as paperwork. A governance system establishes who may decide, risk management identifies threats and opportunities, and compliance translates legal obligations into controls and evidence.

A basic risk model can express expected loss as:

Here, E(L) is expected loss, P(L) is the estimated probability of a specified loss event, and I(L) is the financial or operational impact if it occurs. This is a simplified prioritization model, not a prediction of exact outcomes. It assumes that probability and impact can be estimated on a comparable basis and does not adequately capture legal penalties, reputational harm, correlated events or catastrophic low-probability risks.

For example, if a payment-control failure is estimated to have a 2% annual probability and a monetary impact of $500,000, the simplified expected monetary loss is:

E(L) = 0.02 × 500,000 = $10,000

The result should not be interpreted as permission to accept the risk automatically. A privacy breach may be unacceptable even if its expected monetary value is low.

A compliance register links obligations to owners, controls, evidence, review dates and escalation routes. Controls may be preventive, detective or corrective. Examples include approval workflows, segregation of duties, automated validation, audit logs, reconciliations, access reviews, complaint monitoring and incident exercises.

Vendor governance is essential because cloud providers, payment processors, fulfillment firms, advertisers and analytics companies may process customer data or affect consumer outcomes. Due diligence should assess security, privacy, financial stability, labor practices, subcontractors, geographic exposure, business continuity and environmental performance. Contracts should address permitted processing, confidentiality, audit rights, breach notification, deletion or return of data, service levels, insurance and exit assistance.

7. Sustainable Commerce

Sustainable commerce seeks to create economic value while reducing environmental damage and respecting human rights. E-commerce can improve efficiency through demand matching and digital distribution, but it may also increase packaging, returns, expedited transport, warehouse energy use and labor pressure.

Key environmental concerns include:

• carbon emissions from manufacturing, warehousing, delivery and returns;
• packaging materials and waste;
• energy and water use in data centers and facilities;
• electronic waste and device replacement;
• unsold inventory and destruction; and
• emissions associated with reverse logistics.

A credible sustainability program begins with measurement boundaries and evidence. Organizations should distinguish direct emissions from purchased-energy emissions and value-chain emissions, while avoiding unsupported claims. Carbon-neutral or environmentally friendly claims should identify the basis, scope and limitations. Offsets do not justify continuing avoidable pollution and should not be presented as equivalent to direct reductions.

Operational measures include right-sized recyclable packaging, consolidated delivery, accurate product information to reduce returns, repair and resale programs, renewable electricity procurement, efficient computing, route optimization and supplier standards. Social sustainability includes safe working conditions, fair treatment of warehouse and delivery workers, responsible sourcing, accessibility and avoidance of forced or child labor.

Sustainability involves trade-offs. A reusable package may require more reverse transport; rapid delivery may increase emissions; a cheap product may have a short life and high replacement rate. Decisions should therefore consider the product life cycle rather than a single attractive metric.

Figure: A continuous governance cycle linking legal obligations, risk assessment, controls, monitoring and improvement.

8. Applied Case: MarketSphere Marketplace

Background

MarketSphere is a fictional regional marketplace selling clothing, electronics and household products through third-party merchants. It uses targeted advertising, automated ranking and outsourced fulfillment. Rapid growth has produced complaints about hidden subscription renewals, counterfeit accessories, unclear import charges, excessive packaging and delayed privacy responses.

Problem

Management initially treats each complaint as an isolated operational issue. A review shows that the problems are connected: the revenue model rewards aggressive conversion tactics, seller onboarding is weak, data responsibilities are unclear and sustainability is measured only by warehouse electricity.

Analysis

The company maps stakeholders and obligations. Consumers need clear pricing, cancellation and remedy procedures. Sellers need fair rules and appeal rights. Regulators may require tax reporting, product-safety cooperation and privacy controls. Workers and communities are affected by delivery practices and packaging waste. The board identifies legal, ethical, operational and reputational risks rather than relying only on expected financial loss.

Approach and solution

MarketSphere adopts a governance program with five actions:

1. It redesigns checkout so optional insurance and marketing are unselected by default, prices include mandatory charges, and cancellation is as easy as enrollment.
2. It introduces seller identity checks, product-document requirements, counterfeit detection and a human appeal process.
3. It creates a data inventory, separates transaction data from optional profiling, limits retention and gives vendors documented processing instructions.
4. It establishes a tax and cross-border working group to validate product classification, customer location and import disclosures.
5. It measures packaging, delivery emissions, return rates and worker-safety indicators, then sets reduction targets supported by evidence.

The board receives quarterly reports covering complaints, unlawful-listing removals, appeal outcomes, privacy incidents, accessibility defects, vendor-risk reviews and sustainability indicators.

Outcome

In this illustrative case, customer complaints about cancellation and hidden charges decline, seller quality improves and the company can explain its decisions to regulators and merchants. Costs increase initially because of verification, accessibility remediation and packaging redesign. Management concludes that governance is an investment in trust, resilience and long-term market access rather than merely a compliance expense.

Learning points

The case demonstrates that legal, ethical and sustainability issues are interdependent. A dark pattern may increase short-term conversion while increasing complaints and regulatory exposure. A vendor can become a privacy or human-rights risk even when it is not part of the organization’s legal department. Effective governance combines clear design, accountable ownership, evidence, monitoring and remediation.

Challenges and Limitations

First, laws change rapidly and differ across jurisdictions. A global policy may be too vague for local compliance or unnecessarily restrictive in some markets. Second, automated compliance tools can produce false positives and may encode bias. Third, sustainability data often depends on suppliers and estimates, making comparisons uncertain. Fourth, small merchants may lack the resources to meet complex platform requirements; proportionate support is therefore important. Fifth, compliance cannot resolve every ethical disagreement. Questions about fair prices, labor automation, personalization and acceptable environmental trade-offs require stakeholder judgment and public debate.

Best-Practice Checklist

An e-commerce organization should:

• identify applicable jurisdictions and obligations before launch;
• preserve reliable evidence of electronic assent;
• show total prices, material terms and remedies clearly;
• use lawful, licensed and attributable content;
• maintain a current data inventory and retention schedule;
• conduct privacy, security, accessibility and AI-risk assessments;
• prohibit deceptive interface practices and test cancellation flows;
• verify vendors and manage subcontractors;
• provide notice, appeal and human escalation mechanisms;
• maintain tax, customs and product-safety controls;
• measure environmental and social impacts across the value chain; and
• test controls, report incidents and improve continuously.

Chapter Summary

E-commerce operates within a network of contract, consumer, intellectual-property, privacy, advertising, tax, platform and product-safety rules. Electronic assent is strongest when users receive clear notice, actively agree and can access the records later. Consumer protection requires transparency, fair terms, truthful claims, safe products and effective remedies. IP governance protects both the organization and creators by requiring licenses, attribution and appropriate responses to infringement.

Privacy is a governance responsibility involving purpose limitation, minimization, security, retention and accountability. Advertising must be truthful and substantiated, while dark patterns should be replaced by choice architectures that respect autonomy. Platform governance requires seller controls, ranking transparency, fair enforcement and appeals. Risk, vendor and compliance systems translate principles into accountable controls and evidence. Finally, sustainable commerce considers life-cycle environmental effects, labor conditions, inclusion and credible measurement. Responsible e-commerce therefore combines legal compliance, ethical judgment, technical controls and continuous stakeholder engagement.

Key Terms

Electronic contract: A legally recognized agreement formed through electronic records or communications.

Clickwrap: An agreement accepted through an affirmative action such as selecting “I agree.”

Browsewrap: Terms presented through website use without a clearly affirmative acceptance action.

Consumer protection: Laws and practices that protect buyers from unsafe, unfair or misleading commerce.

Intellectual property: Legally protected creations, marks, inventions and confidential information.

Trademark: A sign that identifies and distinguishes the source of goods or services.

Privacy: Protection of people’s control, dignity and interests in relation to personal information.

Data minimization: Limiting collection to information reasonably necessary for a stated purpose.

Purpose limitation: Restricting data use to specified legitimate purposes.

Dark pattern: A design that manipulates or deceives users into choices contrary to their interests.

Accessibility: Designing products and services for use by people with diverse abilities.

Platform governance: Rules and controls governing an intermediary’s users, content, sellers and algorithms.

Vendor risk: Potential harm arising from a supplier’s conduct, weakness or failure.

Compliance register: A record linking obligations to owners, controls, evidence and review dates.

Expected loss: A simplified risk estimate calculated as probability multiplied by impact.

Product safety: Measures ensuring that goods do not create unacceptable risks to users.

Sustainable commerce: Commerce that pursues economic value while reducing environmental and social harm.

Greenwashing: Misleading presentation of environmental performance or benefits.

Review Questions

Short Answer Questions

1. What is the difference between clickwrap and browsewrap agreements?
2. State four principles of responsible personal-data governance.
3. Why are online reviews a consumer-protection issue?
4. Give three examples of dark patterns.
5. What responsibilities may a platform have toward third-party sellers?

Long Answer Questions

1. Explain how an e-commerce organization can establish reliable evidence of electronic contract formation.
2. Discuss the relationship between privacy, cybersecurity and data governance.
3. Analyze the legal and ethical issues raised by targeted advertising and influencer marketing.
4. Explain how vendor governance can reduce legal, operational and sustainability risks.
5. Evaluate the argument that sustainable e-commerce requires life-cycle analysis rather than isolated environmental metrics.

Analytical / Application Questions

1. An online retailer preselects an insurance add-on, hides mandatory delivery charges until the final screen and requires three steps to cancel a subscription. Identify the consumer, ethical and governance problems and propose a redesign.
2. A marketplace discovers that a high-volume overseas seller has supplied counterfeit chargers. Develop an immediate response and a long-term seller-governance program.
3. A platform wants to use purchase history, location and inferred household income to personalize prices. Assess the privacy, fairness, transparency, competition and reputational risks, and recommend controls.

Multiple Choice Questions with Answers

Question 1

Which design generally provides the strongest evidence of affirmative electronic assent?

A. A terms link in the website footer

B. A clickwrap agreement requiring the user to select “I agree”

C. A preselected marketing checkbox

D. A statement that continued browsing constitutes acceptance

Correct Answer: B. A clickwrap agreement requiring the user to select “I agree”

Question 2

Which principle requires an organization to collect only information reasonably necessary for a stated purpose?

A. Data minimization

B. Unlimited retention

C. Purpose expansion

D. Open access

Correct Answer: A. Data minimization

Question 3

Which is the clearest example of a dark pattern?

A. Providing a plain-language refund policy

B. Offering keyboard navigation

C. Making cancellation substantially harder than enrollment

D. Showing the total price before payment

Correct Answer: C. Making cancellation substantially harder than enrollment

Question 4

A platform’s seller-governance program should most directly include which control?

A. Unreviewable automated removal of all disputed listings

B. Seller verification and an appeal process

C. Automatic acceptance of every seller

D. Removal of all negative customer reviews

Correct Answer: B. Seller verification and an appeal process

Question 5

If the estimated probability of a loss is 0.02 and its impact is $500,000, what is the simplified expected loss?

A. $1,000

B. $10,000

C. $25,000

D. $1,000,000

Correct Answer: B. $10,000

Question 6

Which advertising practice is most likely to mislead consumers?

A. Disclosing that an influencer received payment

B. Supporting a performance claim with evidence

C. Using an artificial former price to advertise a discount

D. Displaying mandatory charges before checkout

Correct Answer: C. Using an artificial former price to advertise a discount

Question 7

What is the primary purpose of data retention schedules?

A. To keep all data permanently

B. To define how long information is justified and when it should be deleted

C. To eliminate access controls

D. To make optional profiling mandatory

Correct Answer: B. To define how long information is justified and when it should be deleted

Question 8

Which action best supports sustainable e-commerce?

A. Measuring only warehouse electricity

B. Using unsupported carbon-neutral claims

C. Considering packaging, delivery, returns and product life-cycle impacts

D. Encouraging unnecessary expedited delivery

Correct Answer: C. Considering packaging, delivery, returns and product life-cycle impacts

Question 9

Why should AI-generated product descriptions be reviewed?

A. AI output is automatically legally accurate

B. The merchant remains responsible for false claims and potential IP or privacy problems

C. Review is needed only for spelling

D. Generated text cannot affect consumers

Correct Answer: B. The merchant remains responsible for false claims and potential IP or privacy problems

Question 10

Which statement best distinguishes compliance from ethics?

A. Compliance and ethics are identical in every situation

B. Compliance concerns applicable obligations, while ethics may require broader consideration of fairness and harm

C. Ethics applies only to nonprofit organizations

D. Compliance is unnecessary when a company acts in good faith

Correct Answer: B. Compliance concerns applicable obligations, while ethics may require broader consideration of fairness and harm