Before your first sale, an online store needs four legal pages: shipping policy, refund and return policy, privacy policy, and terms of service. Publishing these pages sets buyer expectations, protects you during payment disputes, and satisfies federal rules. This guide outlines what to put on each page, what official rules require, and how to set them up this week.
Worked example: how return policies and dispute costs hit your bottom line
These two stores are hypothetical; the rules and fees are real.
Store A: a new home decor shop doing 30 orders a month ($1,200 in sales). Average order $40, product cost $24.
In month one, two buyers say their order never arrived. The products are gone either way, so the question is whether the buyer comes to you or to their bank. Under FTC consumer advice, card payers can dispute undelivered items within 60 days.
| What happens | What it costs | Total |
|---|---|---|
| Buyers file card disputes and you lose | 2 × $40 sale + 2 × $24 product + 2 × $15 dispute fee | $158 |
| Your policy tells them to email you, and you refund | 2 × $40 sale + 2 × $24 product | $128 |
The visible policy saves $30 in dispute fees here ($158 − $128). The bigger cost is your dispute rate: Stripe notes that a store with fewer than 100 payments a month can see a large impact from just one or two disputes. A fully refunded payment cannot be disputed, so a quick refund ends the problem.
Store B: a growing apparel brand doing 150 orders a month ($6,000 in sales). Average order $40, product cost $15. Five buyers a month want to send something back.
| What happens | What it costs | Total |
|---|---|---|
| A clear 30-day return policy: 5 refunds, 4 items come back resellable, 1 is damaged | 5 × $40 refunded + 1 × $15 damaged product | $215 |
| No clear policy: the 5 buyers dispute instead, and keep the items | 5 × $40 + 5 × $15 product + 5 × $15 dispute fee | $350 |
A written returns process costs this store $135 a month less ($350 − $215), before counting return postage.
Run it with your own numbers: track your monthly order count, average order value, and return rate. Use the profit per order calculator to test how return shipping and product costs change your margin. For wider monthly overhead, see the monthly cost guide.
The decision path: business setup before policies
- Business structure (sole proprietorship vs LLC): Under SBA guidelines, if you do business under your own legal name, you do not need formal registration to operate as a sole proprietorship. If you use a separate trade name, most states require a DBA (Doing Business As) registration. An LLC provides personal liability separation, but you can launch as an unincorporated sole proprietor while testing demand. See business basics for a US online store.
- Tax registration: Set up your platform’s built-in tax settings before launch. For sales tax collection thresholds and software needs, see sales tax software for online stores.
- Core store policies: Publish your core policies before opening checkout. Shopify’s launch checklist lists entering your address, setting up shipping, taxes, and payment providers, and adding store policies before taking off the storefront password.
Shipping policy and the FTC 30-day rule
In the US, the FTC Mail, Internet, or Telephone Order Merchandise Rule governs online orders. A seller must have a reasonable basis for any shipment claim, whether express or implied. The FTC defines a reasonable basis as information that would satisfy a reasonable and prudent businessperson.
If your site states no shipping timeline, federal law requires you to ship within 30 days of receiving a properly completed order.
When delays happen, the FTC rule requires this procedure:
- Send a delay notice promptly with a revised shipping date (or state that you cannot give one) and inform the buyer of their right to cancel.
- Offer an option either to consent to the delay or cancel for a prompt refund, with a free reply method.
- For delays of 30 days or less, the buyer is treated as consenting unless they reject the delay.
- Cancelled orders must be refunded within 7 working days (or within one billing cycle for credit cards).
State your processing time (such as 2 to 3 business days) on your shipping page. For carrier choices, see shipping basics for a new online store and label tools comparison.
Returns and refund policy
Under FTC consumer advice, shoppers are urged to review return windows and refund rules before purchasing. Stripe advises describing refund and cancellation terms clearly and showing the full policy at checkout, because card issuers may reject a link-only checkbox as dispute evidence.
Example returns clause (fill-in template)
You can adapt this plain-language clause for your returns page (labelled as a practical example, not legal advice):
Returns & Refunds clause: We accept returns on unused items in original packaging within 30 days of delivery. To start a return, email [[email protected]] with your order number. Customers pay return shipping unless the item arrived damaged. Approved refunds are credited to the original payment method within 5 to 7 business days.
Overseas customer protections
If you ship internationally, foreign consumer laws override your written store policies:
- United Kingdom: Under GOV.UK distance selling rules, online shoppers have 14 days after delivery to cancel an order without giving a reason, and sellers must deliver within 30 days unless agreed otherwise.
- Australia: The ACCC notes that while stores need not refund change-of-mind purchases, any advertised change-of-mind policy must be honored. For major faults, customers are entitled to a refund or replacement. The ACCC states that it is illegal to display terms like “no refunds” that deny these rights.
Learn how to manage daily return operations in our returns and refunds process guide.
Privacy policy requirements
A privacy policy explains what personal data your store collects and why. The FTC reminds businesses to honor their privacy pledges and recommends five fundamentals: take stock, scale down, lock it, pitch it, and plan ahead.
California (CalOPPA and CCPA)
Under CalOPPA, commercial websites collecting personally identifiable information from California residents must conspicuously post a privacy policy covering data categories and third-party sharing. Failing to post a policy within 30 days of receiving a noncompliance notice is a violation.
The CCPA applies only to for-profit businesses meeting specific thresholds:
- Over $25 million in annual gross revenue;
- Handling data of 100,000 or more California residents; or
- Deriving 50% or more of annual gross revenue from selling personal information.
CalOPPA applies to small stores collecting data from California visitors, whereas the CCPA applies only once you cross those thresholds.
UK, European Union, and Canada
- European Union (GDPR): The European Commission confirms that GDPR applies to any business processing personal data of people in the EU, regardless of company size. Firms under 250 employees have reduced record-keeping duties.
- United Kingdom: The ICO requires clear disclosure about cookies and tracking tools.
- Canada (PIPEDA): Applies to commercial data collection across Canada, based on consent and openness.
Terms of service and checkout disclosure
Terms of service establish your sales contract. Wix notes that its articles are not legal advice, and Squarespace describes its policy guide as a resource rather than legal counsel.
Make sure policies appear during checkout:
- Shopify: Generates policy pages under Settings > Policies and links them in checkout footers.
- Wix: Displays policies in the checkout footer with an optional agreement checkbox.
- Squarespace: Shows return policies, terms, and privacy notices on checkout pages.
- Stripe: Recommends using a recognizable statement descriptor (5 to 22 characters) on card charges, and suggests holding physical shipments 24 to 48 hours to give cardholders time to flag stolen card fraud.
Cookie consent rules
If your store uses tracking pixels or analytics, check regional cookie rules:
- UK ICO guidelines: You must inform users about cookies and obtain consent before storing non-essential cookies via an unambiguous positive action.
- Strictly necessary exemption: Essential cookies (shopping baskets, security, load balancing) require no consent.
- Analytics: The ICO notes analytics cookies are not strictly necessary, so UK visitors need consent controls. On BigCommerce, the storefront cookie consent tracking banner is disabled by default.
Platform policy generators
Major store builders provide starter templates:
- Shopify: Go to Settings > Policies, select a policy, and click “Create from template”. Shopify notes templates are generated only in English and for English checkouts.
- Squarespace: Provides sample messages to mix and match for your privacy policy.
- Wix: Add policy text in Checkout Settings to show links in the footer.
Shopify notes: “Although Shopify can generate templates, you’re responsible for following your published policies.” Edit every template to remove unneeded clauses and insert your actual terms.
Common mistakes to avoid
- Copying another store’s policies: Another brand may operate under different state laws or third-party fulfillment rules.
- Leaving template placeholders: Launching with bracketed placeholder text confuses shoppers and looks unprofessional.
- Promising unrealistic delivery times: Claiming fast dispatch when fulfillment takes days creates FTC compliance issues.
- Hiding policies from checkout: If shoppers cannot find terms before paying, banks are less likely to support you in disputes.
- Ignoring overseas rules: UK and Australian statutory consumer rights apply regardless of your US policy terms.
What to do this week
- Confirm business details: Choose sole proprietorship or DBA name, and enter your business address in your store settings.
- Generate policy drafts: In your platform admin (such as Shopify Settings > Policies), generate draft text for shipping, return, privacy, and terms pages.
- Customize terms: Set a realistic return window (such as 30 days) and your dispatch schedule.
- Publish footer links: Link all four pages in your primary footer navigation.
- Verify checkout display: Ensure policy links and your statement descriptor appear in checkout.
- Enable cookie banner: If marketing to the UK or EU, enable cookie consent before firing tracking scripts.
This guide provides general information for online retailers. It is not legal or tax advice. For specific questions regarding corporate structure or custom agreements, consult a qualified attorney.
Sources (checked 2026-10-03)
- FTC: Mail, Internet, or Telephone Order Merchandise Rule, shipping timelines, delay notices, and refund rules
- FTC consumer advice: online shopping, 30-day default and return window advice
- FTC: consumer privacy, honoring privacy representations
- FTC: Protecting Personal Information, data security fundamentals
- California AG: privacy policy (CalOPPA), conspicuous privacy policy mandates
- California AG: CCPA, revenue thresholds and consumer rights
- European Commission: who GDPR applies to, GDPR scope and organization size
- Office of the Privacy Commissioner of Canada: PIPEDA, fair information principles and commercial scope
- ICO: cookies and similar technologies, UK cookie consent and necessary cookie exemptions
- GOV.UK: online and distance selling, 14-day cancellation and 30-day delivery standards
- ACCC: repair, replace, refund, Australian consumer guarantees and refund rules
- SBA: register your business, DBA registration rules
- SBA: choose business structure, sole proprietorship filing basics
- Shopify: general checklist, store setup sequence
- Shopify: policy templates, template generation and merchant responsibility
- Squarespace: share your policies and terms, policy disclosure
- Squarespace: sample privacy messages, sample clauses and checkout integration
- Wix: terms and conditions, legal disclaimer
- Wix: store policies in the footer, checkout footer display and agreement box
- BigCommerce: security and privacy settings, cookie banner settings
- Stripe: dispute prevention best practices, dispute mitigation and checkout policy placement
