Going global

Compliance pages and filings you need before launch: privacy policies, cookies, seller information pages and local representatives, and what a small seller abroad must do in each market

Being abroad with no local company does not put you out of reach of local law: Japan's Act on Specified Commercial Transactions, the EU and UK GDPR and China's Personal Information Protection Law all state that they cover foreign sellers, and Indonesia's PSE registration is required of operators abroad too; in 2022 PayPal and Steam were blocked there for not registering. Below, market by market: the pages to put up, the filings to make and the representatives to appoint before launching to local users, and the thresholds at which each applies. Tax registration is covered in the guide on tax for digital products, and ICP filing in the domain guide.

Compiled from official pages, checked on 2026-11-07. Rules change, so go by the latest official page behind each link before you act.

⚠️ This page summarises the laws of each country and what their regulators say. It is general information, not legal advice; for your own product and users, ask a local lawyer.

United States: privacy policies have no threshold, and auto-renewal is regulated by state

California's CalOPPA: every commercial website that collects personal information from California residents must post a privacy policy conspicuously. It must say what is collected, which categories of third parties it is shared with, how users can review and change it, how users are told about changes to the policy, and how the site responds to "Do Not Track". This rule has no revenue or user threshold.California Business and Professions Code
The CCPA only covers businesses that meet any one of three tests: revenue above US$26,625,000 in the previous year (the figure since 2025); buying, selling or sharing the personal information of 100,000 or more California residents; or getting half or more of their revenue from selling or sharing personal information. Most small sites meet none of them.California Privacy Protection Agency
Sites directed at children under 13 are covered by COPPA. The amended rule took effect on 23 June 2025, and compliance with most provisions is required from 22 April 2026; for example, sharing children's data with third parties for advertising needs separate parental consent.Federal Register (2025-04-22)
Amendments to California's Automatic Renewal Law apply from 1 July 2025: automatic renewal needs the user's separate, express consent, and a free trial that turns into a paid plan counts too; cancelling must be as easy as signing up.DWT law firm briefing (2024-10-01)
The FTC's "click to cancel" rule was vacated in full by the Eighth Circuit Court of Appeals on 8 July 2025, but the federal ROSCA and the states' automatic renewal laws still apply; in March 2026 the FTC began seeking public comment again.Latham & Watkins (2025-07-11), FTC (2026-03-11)
Accessibility: Department of Justice guidance says the ADA applies to the goods and services businesses offer online, but it sets no technical standard for private websites; 3,117 website accessibility lawsuits were filed in federal courts in 2025.US Department of Justice, Seyfarth figures (2026-03)

Indonesia: operators abroad must register as a PSE too, or be blocked

Anyone offering goods or services in Indonesia through a website or app, whether based in Indonesia or abroad, must register with Komdigi as a private electronic system operator (PSE). The registration portal states that every private PSE must register.DLA Piper Indonesia (2026-02-13), PSE registration portal
Examples of enforcement: on 30 July 2022, Yahoo, Steam, PayPal, Epic Games and others were blocked for not registering; in June 2025, eBay, KLM and others were blocked in Indonesia; in September 2026, Komdigi wrote to 25 operators requiring them to register by a deadline, two of them based abroad.Jakarta Post (2022-07-30), Hukumonline (2025-06-30), Komdigi press release (2026-09-17)
The two-year transition period of the Personal Data Protection Law (UU 27/2022) ended on 17 October 2024, and full compliance is now required: a data breach must be notified in writing to the individuals concerned and the regulator within 72 hours, and administrative fines go up to 2% of annual revenue. The implementing regulation has not been issued yet.DLA Piper Indonesia (2026-02-13)

Vietnam: a new Personal Data Protection Law in force since January 2026

The Personal Data Protection Law (No. 91/2025/QH15) took effect on 1 January 2026, and its accompanying Decree No. 356/2025 took effect the same day, replacing Decree No. 13 of 2023.DLA Piper Vietnam (2026-02-15)
If you process personal data of Vietnamese citizens, you must submit an impact assessment to the Ministry of Public Security within 60 days of starting. If you transfer the data abroad (including storing it on servers or clouds outside Vietnam), you must also submit a transfer impact assessment within 60 days, then review it every six months. Consent must be obtained for each purpose separately, and silence is not consent.DLA Piper Vietnam (2026-02-15)
Small businesses and start-ups that meet the conditions are exempt for five years from both assessments and from appointing a data protection officer. Unlawful cross-border transfers can be fined up to 5% of the previous year's revenue.DLA Piper Vietnam (2026-02-15)

Japan: sellers abroad also need the notice under the Act on Specified Commercial Transactions

The Consumer Affairs Agency states that selling to consumers in Japan through a website from abroad is also covered by the Act on Specified Commercial Transactions, whatever your nationality and wherever your server is; no licence or registration is needed, though.Consumer Affairs Agency: selling to Japan from abroad
The address in the notice (headed "特定商取引法に基づく表記") must be where you actually run the business. An address abroad is fine, but you may not borrow the address of a friend or relative in Japan.Consumer Affairs Agency: selling to Japan from abroad
You can leave out your name, address and phone number by writing "provided in writing or by email immediately on request", as long as you really can do that; the return and cancellation conditions cannot be left out.Consumer Affairs Agency: online selling rules
Since June 2022, the final confirmation screen of an online order must show the quantity, the price, when and how to pay, the delivery time, and the conditions for withdrawal and cancellation. Between September 2023 and April 2024 the Consumer Affairs Agency penalised three businesses selling subscriptions, all involving their final confirmation screens.Consumer Affairs Agency (2024-04-25)
The Act on the Protection of Personal Information covers foreign businesses too: it applies when you handle the personal information of people in Japan in order to provide them with services. Users must be able to find out the business's name, address and representative, the purposes of use, how to make requests, the security measures and where to complain; this usually goes in the site's privacy policy.Personal Information Protection Commission FAQ, Personal Information Protection Commission guidelines
In Japan, cookies rely on public notice, not consent: news, social media, search and curation sites must publish in Japanese what information is sent, to whom and for what purpose; online shops that only sell their own products are out of scope.Ministry of Internal Affairs and Communications: external transmission rule

South Korea: business details go on the home page, and the domestic agent rules have thresholds

Article 10 of the E-Commerce Act: an online shop must show on its home page its trade name and the name of its representative, business address, phone number and email, business registration number, terms of use and so on.Korea Fair Trade Commission decision
Under the amended E-Commerce Act, a foreign business with no address or place of business in Korea must appoint a domestic agent and show it on its home page if its revenue in the previous year was ₩1 trillion or more, if it averages 1 million or more visits a month from Korean consumers, or if the Fair Trade Commission requires it. This takes effect on 21 January 2027. Small sellers are generally below these thresholds.Korea Fair Trade Commission (2026-07-14)
The domestic agent rule in the Personal Information Protection Act also has thresholds (for example, revenue of ₩1 trillion or more in the previous year). Since October 2025, a foreign company with a legal entity in Korea must appoint that entity as its agent. A 2026 amendment raised the maximum fine for repeat violations to 10% of revenue.Prighter translation of the article, Asia Economy (2025-05-30), DLA Piper South Korea (2026-03-20)

Russia: notify the regulator first, and keep the data in Russia

You must notify Roskomnadzor in writing before processing personal data; most of the earlier exemptions were removed in September 2022. Companies that fail to notify are fined 100,000 to 300,000 rubles.152-FZ Art. 22, Code of Administrative Offences Art. 13.11
When collecting personal data of Russian citizens, you may not use databases outside Russia to record, organise, store or update it (Article 18, part 5, as amended in 2025). Companies in breach are fined 1 million to 6 million rubles, and 6 million to 18 million for a repeat offence.152-FZ Art. 18, Code of Administrative Offences Art. 13.11
Cross-border transfers need a separate notification beforehand. If you collect personal data online, you must publish your personal data processing policy and protection measures on the page where you collect it.152-FZ Art. 12, 152-FZ Art. 18.1

Mainland China: the Personal Information Protection Law reaches abroad, and paid information services need an operating licence

For ICP filing, see the domain guide. The filing number must be shown at the bottom centre of the home page; operating without a filing is fined CNY 10,000.MIIT filing rules
Providing information services to users in China for a fee is a commercial internet information service: you need an operating licence first, and must show the licence number prominently on the home page. Operating without a licence is fined up to CNY 1 million, and in serious cases the site is shut down.Measures for the Administration of Internet Information Services
The Personal Information Protection Law reaches abroad: it also applies when you process the personal information of people in China in order to provide them with products or services, and you must then set up a dedicated office or appoint a representative in China and report it to the regulators (Article 53).Personal Information Protection Law
The privacy notice must at least give the processor's name and contact details, the purposes, the methods, the types of information, the retention period and how users can exercise their rights. In serious cases, fines go up to CNY 50 million or 5% of the previous year's revenue.Personal Information Protection Law
Data export: transfers that are genuinely necessary to conclude or perform a contract with the individual (cross-border shopping, for example), and transfers of non-sensitive personal information of fewer than 100,000 people in total in a year, are exempt from the security assessment, the standard contract and certification.CAC (2024-03-22)
Auto-renewal: since July 2024, users must be reminded prominently before the service starts and before each automatic renewal. Generative AI services for the public in China have their own measures, and since September 2025 AI-generated content must be labelled.Implementing Regulations of the Consumer Rights Protection Law, Measures for Generative AI Services, Measures for Labelling AI-Generated Content

EU: GDPR representative, cookies, 14-day withdrawal, accessibility and the DSA

The privacy notice (GDPR Article 13) must give the contact details of the controller and its EU representative, the purposes and legal basis, the recipients, transfers abroad, the retention period, the user's rights and the right to complain. Breaches can be fined up to €20 million or 4% of global turnover.GDPR Art. 13, GDPR Art. 83
A company outside the EU that offers goods or services to people in the EU must designate an EU representative in writing (Article 27). The exemption only covers occasional processing that does not include large-scale processing of sensitive data, and a site that runs continuously can hardly count as occasional. In 2021 the Dutch regulator fined Locatefamily.com €525,000 for not designating one.EDPB guidelines on territorial scope, Hunton (2021-05-19)
Cookies need consent before they are set; just informing users, or telling them how to turn cookies off, does not count. Only cookies needed for the transmission, or strictly necessary for a service the user explicitly asked for (such as a shopping basket), are exempt from consent. The EU is discussing a relaxation, which is not expected to take effect before 2027.Your Europe (EU), Heuking law firm (2026-10-23)
14-day withdrawal: for online digital content to lose the right of withdrawal, you need all three of these: the user's prior express consent to start immediately, their acknowledgement that they lose the right of withdrawal as a result, and your confirmation on a durable medium such as email. If one is missing, a user who withdraws pays nothing at all. For services such as SaaS that start early at the user's request, the user pays a proportionate amount on withdrawal.Consumer Rights Directive, Your Europe (EU)
From 19 June 2026, contracts concluded online must offer a withdrawal function: labelled "withdraw from contract here" or with equally clear wording, available throughout the withdrawal period, with a further confirmation step; you must then send an acknowledgement of receipt promptly.Directive 2023/2673
The European Accessibility Act (EAA) has applied to e-commerce services for consumers since 28 June 2025. Microenterprises with fewer than 10 staff and an annual turnover or balance sheet of no more than €2 million are exempt when providing services.Directive 2019/882
Digital Services Act (DSA): a provider with no establishment in the EU that offers intermediary services such as hosting in the EU (storing content users upload, for example) must appoint a legal representative in one member state, and micro and small enterprises are not exempt; the terms of use must set out the content moderation policy. A site merely being reachable does not count as offering services in the EU; what matters is the number of users or whether it targets the EU.DSA Regulation, Belgian regulator (2026-09-22)
Germany's Impressum: now based on section 5 of the German Digital Services Act (DDG), commercial digital services must list their name and business address, legal representative, a way to contact them quickly (including email), commercial register number, VAT number and so on. Missing details can be fined up to €50,000.DDG § 5, DDG § 33

UK: appoint a UK representative; the cookie rules were partly relaxed in 2026

UK GDPR Article 27 still stands: a foreign company subject to the UK GDPR must designate a UK representative in writing, and the exemption conditions are the same as in the EU.UK GDPR Art. 27
The cookie changes in the Data (Use and Access) Act took effect on 5 February 2026: cookies used only for statistics to improve your own service, or only to adapt the site's appearance and functions, can be used without consent, but you must tell users clearly and give them a free, simple way to refuse. Advertising tracking still needs consent.Commencement regulations SI 2026/82, Data (Use and Access) Act, Schedule 12
From the same day, the maximum fine for cookie breaches rose from £500,000 to £17.5 million or 4% of global turnover.Mishcon de Reya (2026-02-12)
Consumers who buy online can cancel within 14 days, and refunds must be made within 14 days.GOV.UK

Common beginner mistakes

Assuming local law does not apply because you are abroad with no local company: Japan's Act on Specified Commercial Transactions, the representative clauses of the GDPR and UK GDPR, and Article 53 of China's Personal Information Protection Law all specifically cover foreign sellers, and in Indonesia a site that does not register as a PSE gets blocked.Consumer Affairs Agency: selling to Japan from abroad, Jakarta Post (2022-07-30)
Selling online digital content in the EU without the "agree to start immediately and give up the right of withdrawal" checkbox at checkout and the confirmation email: users who withdraw within 14 days can pay nothing, and from 19 June 2026 a withdrawal button is also required.Consumer Rights Directive, Directive 2023/2673
Thinking the UK's new rules let you drop the cookie banner: only two kinds were relaxed (statistics, and appearance and functions); you still have to tell users and give them a way to refuse, and the maximum fine has actually risen to £17.5 million.Data (Use and Access) Act, Schedule 12
Using a Japanese friend's address in the notice under the Act on Specified Commercial Transactions, or not posting the notice at all: the address must be where you actually do business; you can write "provided on request", but the return rules cannot be left out.Consumer Affairs Agency: selling to Japan from abroad
Assuming in the US that falling below the CCPA thresholds means you need to post nothing: CalOPPA has no threshold, and collecting information from California users is enough to require a privacy policy.California Business and Professions Code
Keeping Russian users' data on a cloud abroad by default: collecting and storing Russian citizens' data in a database abroad is illegal in itself, and a company is fined 1 million to 6 million rubles even for a first offence.152-FZ Art. 18

What the official pages leave unclear, and we could not confirm

The e-commerce registration conditions that Vietnam's Decree No. 85/2021 sets for foreign merchants, and whether the new E-Commerce Law has taken effect.
The threshold at which Indonesia's PP 80/2019 requires foreign e-commerce businesses to appoint a local representative, and whether Komdigi actually enforces the rules against small foreign SaaS businesses.
How Russia's 152-FZ decides that a foreign site is "aimed at Russia" (Russian language, a .ru domain, payment in rubles and so on); the regulator has not published its position.
Korea: how a small foreign seller with no business licence should fill in the business details on its home page, and whether it must file a mail-order business report.
Whether Japan's external transmission rule covers operators abroad, and whether the "returnable within 8 days" rule applies to digital content and online services.
How exactly section 5 of Germany's DDG applies to sellers outside the EU.
Whether the UK ICO's annual data protection fee applies to controllers based abroad.
China: whether a site on a server abroad that charges users in China counts as providing services "within China" and whether it needs an operating licence; and whether a foreign site collecting personal information directly from people in China counts as data export.

Related pages in this guide

← Back to Going global

📬

Subscribe to Newsletter, get the full playbook free

Subscribe to get the complete "AIP Overseas Social Media Playbook" (we email you the download link), plus weekly AI curated content