Your store generates several million in annual revenue. You have terms and conditions, a privacy policy, and checkboxes in the order form. Everything looks professional, until you take a closer look. The promotional price on the product page does not match the promotion terms and conditions. The checkout collects consents that no one in the company can link to a specific data processing activity. And the returns policy promises something that the customer care team handles differently in practice.
This is not a hypothetical scenario. In 2024, the President of UOKiK imposed fines totaling more than PLN 937 million, including nearly PLN 263 million for infringements of consumers’ collective interests (UOKiK, 2024 activity report). Those fined included Zalando (nearly PLN 31 million), Amazon (nearly PLN 32 million), and Temu (nearly PLN 6 million). All for the same reason: inconsistencies between what the store communicates to customers and what the law requires.
An e-commerce legal audit is not just another legal opinion to file away in a drawer. It means reviewing the entire customer journey, from the product page through the cart, checkout, and user account to the return process, and comparing what the customer sees with what your documents promise. In this article, I will explain what such an audit involves, which risks it most commonly uncovers, and how to conduct one without disrupting sales.
Key concepts before we move on
Before we get into the specifics, it is worth clarifying several terms that will appear later in the article.
| Term | What it means for your business |
|---|---|
| Omnibus Directive | An EU regulation applicable in Poland since 1 January 2023, it requires businesses to display the lowest price of a product during the 30 days preceding each price reduction. It applies to anyone advertising a discount. |
| DSA (Digital Services Act) | An EU regulation directly applicable since 17 February 2024. It requires online marketplaces to verify sellers, prohibits manipulative interfaces (dark patterns), and imposes transparency requirements. |
| Dark patterns | Design practices that manipulate user decisions, such as automatically selecting the most expensive option, using fake countdown timers, or hiding costs until the final stage of the purchase. UOKiK actively identifies them, in a global study conducted in 2024, 75.7% of the websites examined used at least one such pattern (ICPEN/UOKiK sweep 2024). |
| DPIA (data protection impact assessment) | A requirement under the GDPR, if your data processing activities (e.g. customer profiling or marketing automation) involve a high level of risk, you must conduct a formal impact assessment. |
| KYBC (Know Your Business Customer) | A requirement under Article 30 of the DSA, an online marketplace must verify sellers’ details (name, address, telephone number, e-mail address, registration number) before allowing them to sell. |
Why your terms and conditions do not protect you as well as you think
Most e-commerce businesses have terms and conditions. Many also have a privacy policy and a returns policy. The problem is not a lack of documents, it is their inconsistency with how the store actually operates.
Documents vs. reality, where inconsistencies arise
Inconsistencies accumulate gradually. A company implements a new platform, changes its payment provider, adds a subscription feature, or launches a loyalty program. Each of these changes affects the customer journey, but the terms and conditions and policies remain unchanged from two years ago.
The most common areas of inconsistency include:
- Presentation of prices and promotions. The product page displays a “-30%” discount but does not show the lowest price during the 30 days preceding the reduction. The promotion terms and conditions specify different conditions from those shown on the product page. The result: a risk of allegations of unfair commercial practices.
- Checkout and information requirements. The consumer does not receive clear confirmation that placing the order entails an obligation to pay. Delivery costs only appear on the final screen. The result: a breach of the information requirements under the Consumer Rights Act.
- Checkboxes and consents. The form collects three consents through a single checkbox, for the terms and conditions, the newsletter, and profiling. The lack of granularity means that none of these consents meets the GDPR requirements.
- Handling returns and complaints. The returns policy promises a “hassle-free return within 30 days,” but the customer care team requires customers to complete a separate form, pay for return shipping themselves, and wait 21 days for a response. The result: consumer claims and intervention by a consumer ombudsman.
- User account. The data in the customer profile does not match what the privacy policy states, for example, there is no option to delete the account or export data.
Who sees the whole picture?
Responsibility for these elements is usually fragmented. The e-commerce department is responsible for the platform, marketing for campaigns, IT for checkboxes, and customer care for returns. No one sees the entire customer journey from a compliance perspective.
This is precisely why an e-commerce legal audit cannot be limited to reviewing the terms and conditions. It must cover the entire process, from the customer’s first contact with the offer to the final post-purchase message.
Risks that scale with your revenue
The faster your e-commerce business grows, the faster your legal debt grows, the sum of inconsistencies, shortcomings, and unresolved issues that accumulate with every new campaign, feature, or market. Below are specific risks and their consequences.
a) Financial risk: fines imposed by UOKiK and UODO
The President of UOKiK may impose a fine of up to 10% of a company’s annual turnover for infringing consumers’ collective interests. In addition, a fine of up to PLN 2 million may be imposed on each executive responsible for the infringement.
Examples from 2024:
| Company | Fine | Reason |
|---|---|---|
| Zalando SE | PLN 30,945,000 | Failure to display the lowest price during the 30 days preceding the reduction on the platform and in advertisements |
| Amazon | ~PLN 32,000,000 | Infringement of consumers’ collective interests |
| Temu (Whaleco) | PLN 5,910,900 | Failure to provide, or incorrectly providing, the lowest price during the preceding 30 days |
There are also fines imposed by the Trade Inspectorate, up to PLN 20,000 for breaching pricing regulations (or up to PLN 40,000 for three breaches within one year), as well as fines imposed by UODO for GDPR infringements: up to EUR 20 million or 4% of annual global turnover.
b) Operational risk: rising service costs
Inconsistent post-purchase communication generates more complaints, returns, and customer inquiries. Every discrepancy between what the website promises and what the team actually delivers places an additional burden on your customer care team, and costs time, money, and staff capacity.
c) Reputational risk: escalation on social media
A widely publicized issue involving the returns policy, hidden costs, or inconsistent promotions can trigger a reputational crisis. Intervention by a consumer ombudsman, negative reviews, and escalation on online forums, these scenarios can all begin with a minor inconsistency in the documentation.
d) Legal risk: pending proceedings
UOKiK is conducting proceedings against Media Markt, Sephora, Glovo, Shell Polska, AzaGroup (the Renee and Born2Be stores), and Jeronimo Martins Polska, all concerning how the lowest price during the preceding 30 days is presented and how discounts are calculated (UOKiK, 2024 proceedings). If your company uses similar promotional mechanisms, the risk of comparable proceedings is real.
New requirements already in force (and those taking effect in 2026)
E-commerce regulations are constantly evolving. Below is an overview of the rules already in force and those that will take effect in the coming months.
Rules currently in force
| Regulation | Effective since | What it affects |
|---|---|---|
| Omnibus Directive (Polish implementation) | 1 January 2023 | Presentation of prices and promotions, verification of reviews |
| DSA (Digital Services Act) | 17 February 2024 | Seller verification, dark patterns, advertising transparency, post-purchase obligations |
| GDPR | 25 May 2018 | Consents, checkboxes, privacy policies, DPIAs, data subject rights |
Rules taking effect in 2026
| Regulation | Implementation deadline | What it affects |
|---|---|---|
| Directive 2023/2673 | By mid-2026 | Requirement to include a “withdraw from the contract here” function in the online interface |
| Directive 2024/825 | Implementation by 27 March 2026, application from 27 September 2026 | Ban on greenwashing, new information requirements concerning product durability and software updates |
Polish draft legislation implementing these directives has not yet been published. Draft Act UC21, designating the President of UKE as the Digital Services Coordinator under the DSA, was only adopted on 23 September 2025, which means that the national supervisory infrastructure is still being developed.
What this means for your audit
If you are planning to scale sales, increase your marketing budget, or enter a new market in 2026, your store should be prepared for these changes before they take effect. Conducting an audit now will allow you to include the upcoming requirements in your implementation plan rather than introducing them reactively under time pressure.
What an e-commerce legal audit looks like, step by step
An e-commerce legal audit is not simply a review of the terms and conditions. It is a systematic examination of the entire customer journey, from the customer’s first contact with the offer to the final post-purchase message, and a comparison of what the consumer sees with what the law requires and what your documents promise.
Stage 1: go through the customer journey as a customer
Start with what your customer sees. Go through the entire ordering process, from the product page through the cart, checkout, order confirmation, and user account to the returns form. Compare each screen with the content of your terms and conditions and policies.
What to check at this stage:
- Does every page showing a reduced price display the lowest price during the 30 days preceding the reduction?
- Do the promotion conditions on the product page match the promotion terms and conditions?
- Does the checkout clearly confirm that placing the order entails an obligation to pay?
- Are all costs (delivery, packaging, additional charges) visible before the order is finalized?
- Does the user account allow customers to exercise their GDPR rights (access, deletion, data export)?
Stage 2: audit checkboxes, consents, and forms
Map all checkboxes and consent forms in the store. Make sure that:
- Each consent is granular, separate consents for the terms and conditions, newsletter, profiling, and sharing data with partners.
- No consent is preselected (a GDPR requirement, consent must be given through an affirmative action and be freely given).
- Each consent is linked to a specific processing purpose and has a legal basis.
- The privacy policy reflects the actual processing activities, it is not a copy of a template from three years ago.
If your data processing involves customer profiling, marketing automation, or tracking user behavior on the website, check whether you should conduct a data protection impact assessment (DPIA). Failure to respond quickly to a data breach may result in loss of control over customer data, identity theft, and financial losses.
Stage 3: compare the documentation with operational processes
Compare the content of the terms and conditions and returns policy with how your customer care team actually operates:
- Do the return and complaint deadlines in the documents match the deadlines applied by the team?
- Does the return procedure described in the policy reflect what the customer must actually do (form, shipping cost, waiting time)?
- Is post-purchase communication (transactional e-mails, notifications) consistent with what the terms and conditions promise?
Stage 4: verify DSA compliance (for platforms and marketplaces)
If you operate a marketplace or allow third parties to sell through your platform, also check:
- Does your interface allow sellers to provide complete identification details (name, address, telephone number, e-mail address, registration number), as required by Article 30 of the DSA.
- Do you verify sellers’ details before allowing them to sell.
- Do you have a procedure for informing consumers about illegal products purchased within the previous 6 months (Article 32 of the DSA).
- Does your interface avoid dark patterns, preselected options, fake countdown timers, and hidden costs.
Stage 5: risk report and action plan
Based on the audit, prepare a risk matrix divided into three categories:
| Priority | Description | Example |
|---|---|---|
| Critical | Infringements requiring immediate correction | Failure to display the Omnibus price, consents collected through a single checkbox |
| Quick fixes | Inconsistencies creating a risk of disputes | Inconsistent returns policy, outdated privacy policy |
| Phased implementation | Changes requiring coordination between departments | Redesigning checkboxes, conducting a DPIA, preparing for new directives |
Present the matrix to the management board as a basis for decision-making, together with an estimate of the costs of potential consequences and a recommended order of action.
How to avoid disrupting sales while implementing changes
An audit is a diagnosis. Implementing changes is a separate stage that requires coordination between departments and careful planning.
Rules for implementing changes after the audit
- Do not do everything at once. Start with critical risks, those that could result in fines or disputes. Implement the rest in stages.
- Appoint one person responsible for legal and operational consistency in e-commerce. Someone who sees the entire process, from the offer to post-purchase support, from a compliance perspective. This may be an e-commerce manager, COO, or external adviser.
- Prepare a legal checklist for new campaigns and features. Every new promotion, checkout change, or consent form should undergo a brief compliance review before publication.
- Schedule regular reviews. An audit is not a one-off exercise. Conduct a review every 6-12 months or after every change of platform or sales model, or whenever you enter a new market. Constant changes in the law, GDPR, e-commerce directives, and AI regulations, mean that documentation becomes outdated faster than you might think.
- Communicate changes to your team. New rules concerning checkboxes, price presentation, or returns handling must be clear to the people who work with them every day, not only to the lawyer.
How we can help
In our approach, an e-commerce legal audit is not a 50-page legal opinion. It is a step-by-step review of your store, from the product page through checkout to post-purchase support, and the preparation of an implementation plan that you can carry out without disrupting sales.
We work with e-commerce, D2C, and marketplace businesses that are growing faster than their documentation. We understand how e-commerce, marketing, and customer care teams operate, and we know that legal compliance must work in the background rather than hold back growth.
Our support includes:
- An audit of the entire customer journey, going through the process as a customer and comparing it with the documentation and applicable law.
- A prioritized risk report, a matrix divided into critical risks, quick fixes, and phased implementation, including an estimate of the consequences.
- Corrections to documents and processes, updating the terms and conditions, policies, checkboxes, and post-purchase communication so that they are consistent with how the store actually operates.
- Preparation for upcoming regulations, incorporating the requirements of the DSA, the new 2026 directives, and planned changes to consumer law.
- Ongoing compliance monitoring, reviews every 6-12 months, alerts about regulatory changes, and support with new campaigns and features.
If you want to find out whether your e-commerce business is accumulating legal debt, and where to start addressing it, contact us.
Before you grow, put your existing foundations in order
Documents offer no protection if they do not match how the store actually operates. The faster your e-commerce business grows, the faster the financial, operational, and reputational risks increase.
An e-commerce legal audit is an opportunity to pause, review the entire customer journey, and address the issues that have accumulated with successive implementations, campaigns, and platform changes. It does not require you to stop selling. It requires a decision to get started.
If you are planning to scale, increase your marketing budget, or enter a new market, do so on solid foundations. Contact us so that we can assess where you should start.
Frequently asked questions
I have terms and conditions and a privacy policy, is that not enough? Terms and conditions alone will not protect you if they do not match how your store operates. An e-commerce legal audit compares the documents with the actual customer journey, from the product page through checkout to returns handling. The most common problems are inconsistencies between documents and operational processes, which create a risk of consumer disputes and UOKiK proceedings.
Does an e-commerce legal audit require sales to be suspended? No. An audit is an analysis, it involves going through the customer journey, reviewing documents, and comparing them with the law. Implementing changes after the audit also does not require the store to be taken offline, the changes are introduced in stages, starting with the highest-priority risks.
How much can an inconsistency between the terms and conditions and actual practice cost? The costs depend on the scale of the infringement. The President of UOKiK may impose a fine of up to 10% of the company’s annual turnover, while the Trade Inspectorate may impose a fine of up to PLN 20,000 for breaching pricing regulations (up to PLN 40,000 for three breaches within one year). There are also consumer claims, complaint handling costs, and reputational risks. The cost of a proactive audit is many times lower than the consequences of reactively putting out fires.
Who in the company should be responsible for e-commerce legal compliance? It is worth appointing one person who sees the entire process, from the offer to post-purchase support, from a compliance perspective. This may be an e-commerce manager, COO, or external adviser. Without such a person, responsibility is fragmented across departments (e-commerce, marketing, IT, customer care), and no one sees the full risk picture.
How often should I review my store’s compliance? Every 6-12 months or after every change of platform or sales model, entry into a new market, or launch of a new type of promotional campaign. E-commerce regulations are changing rapidly, two further EU directives affecting store interfaces and information requirements will take effect in 2026.
Does the DSA apply to my online store? The DSA has applied directly since 17 February 2024. If you operate a marketplace or allow third parties to sell through your platform, you are required to verify sellers (KYBC), refrain from using dark patterns, and comply with post-purchase obligations towards consumers. If you operate only your own store rather than a marketplace, the DSA applies to you to a more limited extent, but the ban on manipulative interfaces applies to all providers of intermediary services.
