Launching an online business in Australia is rarely blocked by the law, but it comes with a set of obligations you carry from day one. Whether you sell physical goods through an online store, run a subscription service, build a marketplace or offer services through a client portal, the same core duties attach: register the business properly, meet your tax obligations, comply with consumer law, handle personal information carefully, avoid illegal spam and protect your brand and content.
You do not need to be a lawyer to run a lawful website, and you do not need to do everything at once. But understanding which obligations apply to you, and which thresholds bring you within scope, lets you launch with confidence and avoids the messy compliance work that is far harder to fix after customers, regulators and partners get involved. This guide sets out the duties that Australian website businesses carry and what you need to do to meet them.
Who these obligations apply to
Most obligations in this area turn on a few clear thresholds rather than the size of your operation or the type of website you run. Working through them tells you where you stand.
- Trade or commerce: The consumer and advertising rules in the Competition and Consumer Act 2010 (Cth) and its Australian Consumer Law (ACL) apply to anyone selling goods or services to consumers, regardless of turnover. There is no small business carve-out for misleading conduct or the consumer guarantees.
- GST: You must register for GST once your GST turnover (gross business income, not profit) is $75,000 or more in a year, or $150,000 or more for most non-profits. You must register within 21 days of hitting the threshold, and also if you start a business expecting to cross it in the first year.
- Privacy: The Privacy Act 1988 (Cth) generally applies to businesses with an annual turnover above $3 million. Many smaller businesses are exempt, but important exceptions bring them within scope regardless of size.
- Spam: The Spam Act 2003 (Cth) applies to commercial electronic messages with an Australian link. It bites from the first marketing email or SMS, whatever your turnover.
- Directors' duties: If you incorporate a company, the directors take on duties under the Corporations Act 2001 (Cth) that a sole trader or partnership does not face.
Register the business and its entities
Before you trade, you need to be set up properly with the authorities that will hold you accountable.
Get an ABN
The Australian Business Number is the foundation for most other registrations, including GST. You can obtain one online through the Australian Business Register before or alongside your other registrations.
Register a business name
If you trade under a name that is not your own personal name or your company name, you must register that business name with ASIC. Registration is separate from owning a domain; registering the name does not stop someone else using a confusingly similar brand, which is a separate and important trade mark question discussed below.
Choose the right structure
Most new online businesses start as one of three structures:
- Sole trader: cheapest and simplest to run, but there is no separation between you and the business. You are personally liable for its debts and any claims against it.
- Partnership: two or more people trading together. The partners are personally liable unless the partnership is structured as a company.
- Company (Pty Ltd): a separate legal entity that limits personal liability and is usually preferred when you plan to raise capital, bring on co-founders or grow beyond a one-person operation.
If you incorporate, the company must be registered with ASIC and you must meet ongoing obligations, including annual statements, financial reporting and director duties. A sole trader can often move to a company later, so you do not have to get the structure perfect on day one, but it is cheaper to set it up right early.
Comply with the Australian Consumer Law
The ACL governs how you advertise, price, sell and handle refunds. The two obligations that most often catch online businesses out are misleading conduct and the consumer guarantees.
Avoid misleading or deceptive conduct
Section 18 of the ACL provides that a person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. This catches everything from claims on your landing page to pricing, feature promises for software, and statements about availability or delivery times. It is a broad, strict obligation; you do not need to have intended to mislead anyone.
Show total pricing and material terms
If you charge more than you advertised, add fees at checkout that were not disclosed, or bury subscription renewal terms, you risk breaching the ACL's pricing rules and section 18. Display total price including GST, state shipping and delivery costs before payment, and make any recurring fees and renewal dates conspicuous.
Honour the consumer guarantees
When you supply goods to a consumer, the ACL implies a series of guarantees, including a guarantee of acceptable quality under s 54. Goods must be fit for their common purposes, acceptable in appearance and finish, free from defects, safe and durable, as a reasonable consumer would regard as acceptable. If goods fail these guarantees, the consumer is entitled to a repair, replacement or refund. Your website terms and any change-of-mind or returns policy must not misrepresent these statutory rights. A "no refunds" statement is unlawful for goods that fail a consumer guarantee, however clearly you word it.
Handle personal information under the Privacy Act
If you collect personal information such as names, email addresses, account details or payment data, the Privacy Act 1988 (Cth) may govern how you collect, use, store and disclose it.
The small business threshold
The Act generally applies to businesses with an annual turnover of more than $3 million. Below that, many businesses are exempt. But the exemption does not protect you in every case. You are still covered if, among other things, you trade in personal information, provide health services, or opt in to be treated as an organisation. The turnover test is also assessed on the previous financial year, so a business that once crossed the threshold can remain within scope.
Even if you are exempt, behave as though you are covered
A clear, accurate privacy policy is now effectively a market expectation. Enterprise customers, payment gateways and many platforms will ask about your data practices regardless of whether the Act formally applies. The practical duty for any online business is to know what data you actually collect, tell users what you do with it, keep it secure and let people access and correct it.
Update your privacy documents as your practices change
If you add an analytics tool, an advertising pixel or a new marketing integration, that is a change to your data practices, and your policy should reflect it. Privacy regulators and counterparties compare what your policy claims against what the site actually does.
Send marketing messages only with consent
The Spam Act 2003 (Cth) sets the rules for commercial electronic messages, meaning emails, SMS and similar messages sent for advertising or marketing purposes.
Get consent
Under s 16, you must not send an unsolicited commercial electronic message with an Australian link unless the recipient has consented. That consent must be genuine; pre-ticked boxes do not amount to consent, so design your sign-up forms so the user actively opts in.
Identify yourself and provide a working unsubscribe
Section 18 requires every commercial electronic message to include a clear and conspicuous statement that the recipient can use an electronic address to unsubscribe, and that facility must work for at least 30 days after sending. When a recipient withdraws consent, the withdrawal takes effect within five business days.
Honour unsubscribes promptly
Keep your lists clean, act on unsubscribe requests quickly and do not send further marketing to someone who has opted out. These are not merely best-practice points; they are the core of the statutory scheme.
Protect your brand and content
Running a website creates valuable intellectual property, and your obligations in this area are about owning it and protecting it.
Register trade marks
A registered trade mark gives you the exclusive right to use your brand in the classes you register for, and is the strongest way to stop others using confusingly similar branding. Trade marks are registered with IP Australia, and you should apply early, before your brand builds goodwill you would struggle to unwind.
Make sure you own the IP you pay for
If you engage developers, designers or content creators, their work does not automatically belong to you unless the contract says so. Have a written agreement that assigns IP to your business from the outset, including code, content, logos and design assets. Without that clause you may hold only a licence, or nothing at all, which becomes painful if you part ways with the contractor.
Put the right contracts in place
Your website itself should carry clear, enforceable terms. The documents you need depend on your model, but most online businesses should have:
- Website terms and conditions: setting out acceptable use, IP ownership, disclaimers and limits on liability.
- Terms of sale: if you sell goods or services, covering pricing including GST, shipping, delivery, refunds and returns in a way consistent with the ACL.
- Saas or platform terms: if you run subscriptions or user accounts, dealing with fees, renewals, upgrades and termination.
- Contractor or employment agreements: if you work with others, each with IP assignment, confidentiality and termination clauses.
- A shareholders agreement: if you incorporate with co-founders, to cover ownership, decision-making and what happens if someone leaves.
Consequences of getting it wrong
The consequences of non-compliance vary by area but all are worth avoiding.
- ACL: The ACCC and state consumer regulators can investigate and seek civil pecuniary penalties, infringement notices and corrective advertising for misleading or deceptive conduct. Individual consumers can also seek remedies.
- Privacy: The OAIC can investigate complaints and, where the Act applies, can make determinations and seek civil penalties for serious or repeated interferences with privacy.
- Spam: The ACMA regulates the Spam Act 2003 (Cth) and can issue infringement notices and seek civil penalties for unsolicited commercial messages.
- GST: If you fail to register when required, the ATO can require you to pay GST on sales since the date you became liable, plus penalties and interest.
The common theme is that regulators tend to be more forgiving of businesses that were trying to comply than of those that ignored clear obligations. A documented, good-faith effort goes a long way if something does go wrong.
A practical compliance checklist
Before you go live, or when you next review an existing site, work through this list:
- Confirm your structure is registered, with an ABN and any required business name or company registration.
- Register for GST if your turnover is at or near $75,000, and within 21 days of crossing it.
- Set clear checkout disclosures: total price including GST, shipping, renewal terms and material limitations.
- Publish website terms, privacy and cookie policies that match what the site actually does.
- Use active, genuine consent for email and SMS, and honour unsubscribes within the required timeframe.
- Register trade marks for your brand and assign IP from contractors in writing.
- Review your change-of-mind and returns policy against the ACL consumer guarantees.
When a lawyer makes the difference
Most of these obligations are straightforward on their own, and the law is designed so a careful founder can handle the basics. Where an Artificer Legal practitioner adds real value is in the parts that are easy to get subtly wrong.
A lawyer will stress-test your structure choice against where the business is actually heading, rather than just ticking the box. They will draft or review your terms of sale and website terms so your refund and returns policy sits correctly alongside the ACL consumer guarantees instead of contradicting them. They will review your privacy and cookie practices against what your site actually collects, and your marketing lists against the consent requirements. And where you rely on developers or contractors, they will ensure your agreements assign IP to you, so the brand and code you paid for are actually yours. Getting these documents right early is far cheaper than untangling a dispute over ownership, liability or a regulator complaint after launch.
The obligation that catches most new website owners by surprise
For most founders the obligation they least expected is privacy, not consumer law or GST. They assume the small business exemption means they do not need to think about it, then discover the exceptions, or the expectations of their payment gateway, enterprise customers and platform partners, pull them back within scope. The strongest first step is simply to document, honestly, what data your site collects and what you do with it, then write your policies to match. That single habit protects you across privacy, marketing and general transparency, and it is the foundation every other obligation in this area builds on.