Start with who you sell to, then connect product, privacy, tax, and after-sales requirements to the way your store actually works.
Imagine a buyer in Germany placing an order in your Shopify store. The product page says taxes and duties are included, but the buyer is asked to pay more on delivery. They decline advertising tracking, yet the store continues sending tracking data that requires their consent. When they want to return the product, their only option is to find the customer service email and wait for a reply.
These may look like separate problems for logistics, the website, and customer service. They all come back to the same question: does the store actually deliver what it promises the customer?
That is where compliance becomes a practical concern for an independent store. You need the right documents and a clear understanding of the rules, but your pages, checkout, and after-sales processes also need to follow them. A comprehensive policy means little if customers encounter a different process when they place an order.
For a smaller business, a useful starting point is to follow one order from beginning to end. Identify what determines whether the product can be sold, where customer consent matters, where extra charges arise, and how refunds are handled. Then assign the responsibilities, information, and actions needed at each point.
Work out which rules apply to your business first
Shipping directly from China to a consumer in Germany presents different requirements from selling to a US consumer from a US warehouse, even when both orders use Shopify. A change in dispatch location, product, or customer type may also require changes to your existing setup.
Before buying a service or installing an app, write down these business facts:
- Who you sell to: the specific countries or regions, and whether the orders are consumer purchases or business procurement. Different markets, B2C, and B2B cannot simply use the same set of rules.
- What you sell: the actual model, intended use, and intended users. Wireless devices, children’s products, and ordinary household goods can face very different requirements.
- Who is responsible: the seller, manufacturer, importer, and any local responsible entity required by the applicable rules.
- How the goods move: where they are dispatched from, who imports them, who pays import taxes and duties, and where returns will be sent.
This can be a short document, but it gives subsequent tax, product safety, and after-sales decisions a factual basis. This article mainly uses goods sold to consumers in the EU and the US as examples. The obligations for a particular business still depend on its destination markets and how it operates.
Match the documents to the model before listing the product
When a supplier says a product is certified, do not stop there. Check whether the documents cover the model you actually sell, which market they cover, and whether the uses described on your product page are supported by the evidence.
Two products may look identical while one model includes a wireless module and the other does not. One may be intended for everyday adult use while another is promoted for children. Changing a few sentences on a page can change which requirements apply.
Check three things separately: market access, online information, and intellectual property
- Market access documents: CE marking applies only to products covered by EU legislation that specifically requires it. The assessment, technical documentation, and declaration of conformity must match the product category. Whether a third-party body must be involved depends on the applicable procedure. US FCC equipment authorization also depends on the device category; it cannot be reduced to buying the same certificate for every electronic product.
- Online information: EU online offers covered by the GPSR must clearly display the manufacturer’s name, postal address, and electronic address. If the manufacturer is outside the EU, the corresponding details of the required EU responsible economic operator are also relevant. Product images, type or model identifiers, necessary safety warnings, and the appropriate languages must also be addressed. Putting instructions inside the parcel does not replace information that must appear in the online offer.
- Intellectual property: check image copyright, brand trademarks, technical patents, and design rights separately. Taking your own photographs does not establish that you have the right to sell the product itself or use its brand and design.
Sources: EU guidance on CE marking · FCC equipment classification rules · Shopify guidance on the GPSR · USPTO explanation of intellectual property types
You can start by organizing this information with Shopify’s native features. Product Disclosures can link safety warnings to a product. Other information, such as manufacturer details, can go in the description or in Metafields, Shopify’s custom data fields, as needed.
After completing the fields, open the actual product page. Check whether the theme displays the information, whether the language is correct, and whether it matches the selected model. A third-party theme may need the appropriate blocks connected. A complete storefront page also does not prove that every other sales channel has received the same information. Shopify does not itself provide an EU responsible-person appointment service.
Sources: Shopify product disclosures and theme display requirements
Check what happens after a customer makes a privacy choice
When a customer selects Reject, they expect the relevant tracking that requires their consent to stop. If the banner disappears but that tracking and data transmission continue unchanged, their choice has not been put into effect.
The same principle applies to your privacy policy. Customers need to know what you collect, why you use it, who receives it, how long you keep it, and how they can exercise their rights. A template can help with drafting, but it must reflect the tools installed in the store and the processing that actually takes place.
Identify the applicable rules before configuring consent
The GDPR can cover businesses outside the EU that offer goods or services to people in the EU, or monitor their behavior within the EU. A website being accessible from the EU is not enough on its own to establish that it applies. Cookies and similar tracking also require attention to local electronic privacy rules: tracking that requires consent must wait for valid consent, while strictly necessary functions, such as the shopping cart, may qualify for an exception.
California’s CCPA also has conditions concerning the business, its scale, and its data activities. Where those conditions are met, the right to opt out of the sale or sharing of personal information and applicable GPC signals must be respected. Sharing data for cross-context behavioral advertising may count as sharing even when no money changes hands. Configure the store for those requirements rather than simply copying an EU consent banner.
Sources: European Commission: scope of the GDPR · CNIL: cookies and the choice to refuse · California Privacy Protection Agency FAQs
In Shopify, start at Settings → Customer privacy. Review the policy, cookie banner, and data sharing opt-out settings, then check how advertising pixels, email tools, and other apps read the customer’s choice. Do not assume that manually added scripts or third-party tools are already controlled by the native banner.
Test the actual pages for your target regions in four states: no choice made, rejected, accepted, and consent withdrawn. Observe whether the relevant tracking behaves as intended, while confirming that the cart, login, and checkout still work. Check server-side data transfers separately; counting fewer requests in the browser is not a complete test.
Sources: Shopify customer privacy settings and third-party tool boundaries · Shopify pixel privacy behavior
Tax and duty arrangements need to work beyond checkout
The customer’s immediate question is simple: “Will I have to pay anything else before this arrives?” The merchant needs to check whether the promise on the page, the amount collected at checkout, and the customs and delivery arrangements all tell the same story.
For EU orders in particular, “taxes included,” “IOSS,” and “duties and taxes prepaid” are not interchangeable terms. Understanding the differences helps you work out both the cost of an order and what the customer will experience.
- VAT: the EU’s former low-value import VAT exemption was abolished in 2021. The amount due, when it is collected, and how it is reported depend on the country, the goods, and the arrangement used.
- Customs duties: the EU’s former EUR 150 low-value customs duty relief was abolished on 1 July 2026. Relevant low-value distance-sale imports are subject to a transitional EUR 3 customs duty arrangement, currently scheduled to run until 1 July 2028. How it is charged depends on the declared items, their customs classification, and the applicable rules; it should not be described as a flat EUR 3 charge per parcel.
- IOSS: this is an optional VAT reporting simplification for eligible distance sales of imported goods. It generally covers consignments with an intrinsic value of no more than EUR 150 and excludes excise goods. Businesses established in mainland China generally also need an EU intermediary to use it. Shipments above the value limit and local dispatches from an EU warehouse cannot simply be put through the same arrangement.
Sources: European Commission: current customs duty and VAT guidance · European Commission: IOSS scope and optional use · IOSS intermediary requirements
Using IOSS therefore does not make an order tax-free or establish that customs duties have been dealt with. If you do not use IOSS, you still need an arrangement for collecting any applicable import VAT. The latest EU announcement also plans a separate EUR 2 handling fee from 1 November. As of the date checked for this article, that fee is not yet being charged. Recheck the final scope and logistics quotes as the implementation date approaches.
Sources: European Commission update, October 2026
Connect three parts of the process in Shopify
- Product data: verify HS codes, country of origin, prices, and dispatch location so checkout calculations and customs declarations use the correct information.
- Checkout collection: configure the applicable rules through the Taxes and duties features available to your store. Check how product pages, the cart, checkout, and order notifications explain taxes and duties.
- Actual fulfillment: if you promise prepaid taxes and duties, confirm that the carrier and the specific shipping route support the corresponding DDP arrangement, and pass on the required declaration information correctly. Writing taxes and duties included on a page does not complete customs clearance for your logistics provider.
Sources: Shopify: requirements for collecting duties and import taxes at checkout
US sales tax requires a separate assessment of each state’s physical nexus, economic nexus, and measurement rules. California and New York both have economic nexus thresholds involving more than USD 500,000 in sales, for example, but New York also requires more than 100 transactions. California looks at the preceding or current calendar year; New York looks at the immediately preceding four sales tax quarters. Your total US revenue cannot simply be compared with one nationwide threshold.
Sources: California Department of Tax and Fee Administration rules · New York State Department of Taxation and Finance rules
For orders through your own store, first establish your obligations and complete any required registrations, then configure tax collection and arrange filing and payment. Shopify being able to calculate a tax amount does not mean the merchant has registered or filed the required returns.
Sources: Shopify: US tax registration and configuration sequence
Make returns accessible, not just written into a policy
When a purchase turns out to be unsuitable, the customer’s first question is usually how to return it. If the policy allows requests but the order page offers no way to make one, there is a gap. If customer service approves a return but the warehouse has no clear receiving arrangement, the process is still incomplete.
Keep three situations separate: withdrawing from a purchase because the customer has changed their mind, seeking a remedy because the product has a problem, and using an additional commercial guarantee offered by the brand. The conditions and responsibilities differ. A blanket “final sale” or “customer always pays shipping” statement cannot resolve all three.
For EU consumer orders, check the rights, the request process, and the acknowledgment
- Rights and costs: applicable distance contracts for goods usually include a 14-day right of withdrawal without giving a reason, generally counted from receipt of the goods. After notifying the merchant of withdrawal, the customer normally has another 14 days to send the goods back. Statutory exceptions, such as personalized or perishable goods, have specific conditions. A store’s Final sale label cannot remove statutory rights on its own. Whether the customer can be charged the direct cost of returning goods also depends on conditions such as prior disclosure; defective goods need separate treatment.
- The online function: new EU requirements applicable from 19 June 2026 include a clearly visible electronic withdrawal function that remains available throughout the withdrawal period, a confirmation step, and an acknowledgment sent without delay that the customer can retain. It must include the details of the withdrawal and the date and time it was submitted. Check the destination’s implementing rules and the contract; changing the policy wording alone is insufficient.
- The legal guarantee notice: new requirements applicable from 27 September 2026 also concern a harmonized notice about the legal guarantee of conformity. This is separate from the right to withdraw. Display the applicable official notice as required rather than replacing it with a brand-designed guarantee icon. It also does not mean that every product must carry the GARAN commercial guarantee of durability label.
Sources: EU consumer return rights · Shopify: electronic withdrawal requirements · EU legal guarantee notice guidance
Shopify provides native tools for self-serve return and cancellation requests, along with return and cancellation rules. Start by checking the configuration under Settings → Policies, then verify the actual entry points in customer accounts or on order pages. Rules configured separately by market are currently available only to some merchants, so do not assume every store has the same options.
Then complete a test request. Does the customer receive a confirmation? Can customer service and the warehouse process it? How do the refund amount, taxes, duties, shipping charges, and order status line up? Use native features where they already meet the need, and add app integrations or development where a real gap remains.
Sources: Shopify: return and cancellation rules and feature limitations · Shopify: handling self-serve requests
Design and development should put the requirements into practice
For WESWOO’s Shopify design and development work, compliance requirements lead to concrete deliverables: where product information appears, how customer choices reach connected tools, when taxes and duties are explained, and how after-sales requests enter the processing workflow.
That work needs confirmed rules and accurate information first. Tax and legal professionals identify the applicable obligations, the merchant supplies the facts about products and fulfillment, and the design and development team implements them in the store with results that can be checked.
For example, a product’s warnings and manufacturer details need to appear correctly for the target market. Privacy choices need to control the relevant tools. Taxes and duties shown at checkout need to match the delivery arrangements. Return entry points, emails, and back-office handling need to stay connected to the same order. Those are more useful acceptance criteria for a merchant than a review of a few page designs on their own.
A practical sequence for a smaller team
- First, establish whether the goods can be sold. List the markets, product models, and responsible entities involved, and obtain the documents required for the applicable rules. If essential conditions are missing, restrict sales of the affected products or into the affected markets first.
- Next, implement the rules in settings and pages. Connect the confirmed information, policies, and rules to products, privacy controls, checkout, and after-sales handling. Assign someone to maintain each part.
- Finally, test the complete order flow and keep reviewing it. Choose representative products and destinations, complete the process, and retain the pages, settings, consent records, and processing evidence. When you change a product, enter a market, install an app, or change logistics providers, recheck the affected parts.
This is a way to organize the work, not a reason to postpone other mandatory obligations. Packaging and environmental responsibilities, labels for specific product categories, and other requirements also need to be included according to the product and market. A general checklist cannot establish that every compliance obligation has been met.
For the long-term operation of an independent store, the useful capability to build is a repeatable one: knowing what you sell, what the customer sees, what the system actually does, and who handles a problem when it occurs.
#Shopify #CrossBorderEcommerce #EcommerceCompliance
Sources checked: 16 October 2026. This article explains rules and implementation approaches; it does not confirm that any particular store is compliant. Before implementation, recheck the destination's rules, the product, and the features currently available.