Add to Preferred Sources
Ecommerce disclaimers are the legal notices, disclosures and policy statements that South African online stores must publish to trade lawfully — and getting them wrong is not just a reputational risk. Under South Africa's website compliance framework, a missing or non-compliant disclosure gives consumers a statutory right to cancel transactions after the fact, independent of anything your terms and conditions say. South Africa's online retail market is growing at pace, and regulators are paying closer attention to how stores document their obligations.
Three separate pieces of legislation govern what you must publish: the Electronic Communications and Transactions Act (ECTA), the Consumer Protection Act (CPA), and the Protection of Personal Information Act (POPIA). The rules overlap but are not interchangeable. A returns policy, for example, is one item inside a larger ECTA section 43 disclosure list — not a standalone obligation. Understanding which law requires which notice, and what makes each one legally effective, is where most template-based approaches fall short.
This post maps the five ecommerce disclaimers South Africa stores are legally required to publish — covering their legal source, the consequence for non-compliance, and the specific condition that makes each clause enforceable — so you can self-audit your existing legal pages against SA law rather than foreign-market templates. A gap in any of the five categories carries real financial exposure on every order.
Quick Answer
South African ecommerce stores must publish five categories of legal notice: the 17-item mandatory disclosure set under ECTA section 43, a cooling-off notice (7 days, not 5) under ECTA section 44, any limitation of liability clauses structured to satisfy CPA sections 48, 49 and 51, a POPIA section 18 privacy notice, and a VAT-inclusive price disclosure. Missing the section 43 set gives consumers a 14-day cancellation right. A "no refunds" clause cannot override the section 44 cooling-off right — that right cannot be contracted away.
Jump To
Is your store's legal setup costing you customer trust?
Send us your store URL and we will check whether your current legal pages meet ECTA and POPIA requirements — no obligation.
Get a free compliance checkWhat ecommerce disclaimers South African law requires under ECTA section 43
ECTA section 43 is the primary legal source for ecommerce disclaimers in South Africa. It requires any supplier conducting electronic transactions with consumers to publish 17 categories of information on the web pages where goods or services are offered — not buried in a PDF, not available only at checkout. The Act's intention is that a buyer can review all of this before committing to a purchase.
These 17 mandatory items group into five practical categories:
| Category | What ECTA section 43 requires |
|---|---|
| Identity | Full legal name, legal status, registration number, names of office-bearers, place of registration, physical address for legal service of documents |
| Contact | Physical address, telephone number, website URL, email address |
| Product and price | Main characteristics of goods/services; full price including transport, taxes and all other fees; available payment methods; dispatch or delivery timeframe |
| Consumer rights | Return, exchange and refund policy; terms of agreement, guarantees and access methods; minimum contract duration where applicable; alternative dispute resolution details; method and period for accessing transaction records |
| Security and privacy | Security procedures for payment and personal information; privacy policy; any self-regulatory or accreditation body memberships; code of conduct information and access method |
The enforcement mechanism is direct. ECTA section 43(3) provides that absent or incomplete disclosures entitle the consumer to cancel within 14 days of receiving the goods or services and receive a full refund, minus the direct cost of return. This statutory entitlement operates independently of anything your terms say — a compliant T&C page does not save you if the underlying disclosures are absent.
Practical note: The full 17-item disclosure does not need to appear on a single page. Many stores satisfy it across a combination of their About page (identity and contact), product pages (characteristics and pricing), footer links (returns policy, privacy policy) and checkout flow (payment methods, delivery timeframe). What matters is that every item is accessible on the website where the goods or services are offered — not locked behind a purchase.
ECTA Section 43 — Bottom Line
Missing any of the 17 mandatory items gives a consumer the right to cancel up to 14 days after receiving their order. The fix is not a new disclaimer clause — it is publishing the specific information the Act lists, in a format your customer can access before they buy.
The 7-day cooling-off notice you cannot contract away
ECTA section 44 gives every South African online shopper the right to cancel an electronic transaction within seven days of receiving goods or concluding the agreement — without giving a reason, and without paying a cancellation penalty. This is a statutory floor, not a policy choice: no clause in your terms and conditions can remove it.
The seven-day period applies under ECTA. The CPA has its own cooling-off provision (five business days) but that one applies specifically to direct-marketing transactions — where the supplier initiates contact — not to all online sales. For standard ecommerce purchases, ECTA section 44 is the operative rule. Do not attribute the seven-day period to the CPA; they are separate legal mechanisms.
The Regulations made under ECTA recognise several categories of goods and services as cooling-off exceptions:
- Perishable goods (food, flowers, fresh products)
- Custom-made or personalised items
- Audio recordings, video recordings or software where the packaging has been unsealed
- Newspapers, periodicals and similar publications
- Services that were fully performed with the consumer's consent before the cooling-off period ended
For stores selling in any of these categories, the notice needs to do two things: confirm that the statutory seven-day right exists generally, and explicitly state which products in your range fall into an exception category — and why. A blanket "no refunds" policy without these distinctions does not eliminate your exposure; it just leaves you unable to demonstrate that you disclosed the exception properly. For digital goods specifically, the SA law on digital purchase refunds adds another layer of nuance worth reviewing.
The 7-day Rule — Bottom Line
Publish the seven-day cooling-off right as a positive statement in your returns and refunds policy. List any exception categories you stock. State who bears the return shipping cost (the consumer, unless the goods are defective). A clause that simply says "no refunds" is void on this point — it does not override a statutory right.
Which limitation clauses survive the CPA
Limitation of liability clauses — "we accept no responsibility for…", "our liability is limited to…", "the site is provided as is…" — are not automatically void in South Africa, but the CPA sets strict conditions for them to hold against a consumer.
CPA section 48(1) prohibits a supplier from entering an agreement on terms that are unfair, unreasonable or unjust, or that require a consumer to waive their rights on such terms. Section 51 voids any term whose general purpose or effect is to defeat the purpose of the CPA or to strip a consumer of a CPA right.
Section 49 adds a procedural requirement: notices that limit the supplier's liability, impose risk on the consumer, or require the consumer to indemnify a third party must be written in plain language, and the consumer must have been given an adequate opportunity in the circumstances to read and comprehend them before the transaction is concluded.
In practice this means:
Clause that will not hold: "This website is provided 'as is'. To the fullest extent permitted by law, [Store Name] excludes all liability for any loss or damage, including consequential loss, arising from your use of this site or purchase of any products." — This is a blanket exclusion. Under CPA s48 and s51, the broadest versions of these clauses are unenforceable against SA consumers. A court may sever, alter, or void the term entirely.
Clause better positioned to hold: A specific, narrowly worded limitation — linked to an identifiable risk, written in plain English, displayed at a point where the buyer has a genuine opportunity to read it before committing (e.g., on the checkout page with an explicit acknowledgement tick). Even then, it cannot exclude liability for gross negligence against a consumer.
The CPA's approach is principles-based, not a list of banned phrases. The questions a court applies are: Is this term fair, reasonable and just? Was the consumer given proper notice? Is the effect to strip a CPA right? If the answer to any of those is unfavourable to the supplier, the clause loses. Running your limitation language past a qualified SA attorney before publishing is more useful than any template. The MJ Kotze SA technology law analysis provides additional background on how ECTA and the CPA interact in practice.
Not sure which of your current disclaimer clauses will hold up in SA?
Share your existing T&Cs with us and we will flag the three types of clause most commonly challenged under the CPA — and how your site design can surface them more effectively.
Talk to us about compliance-ready designWhat a POPIA privacy notice must cover
POPIA section 18 requires every "responsible party" — which includes any SA ecommerce store that collects personal information — to notify the data subject at the time of collection. For an online store, this means a published privacy notice that is accessible before a customer submits any personal information (account creation, checkout, newsletter sign-up, or even cookie tracking).
A POPIA-compliant privacy notice for an SA ecommerce store should address at minimum:
- Who is collecting — the store's full legal name, registration details, and the name of the registered Information Officer
- What is being collected — the categories of personal information (name, email, delivery address, payment data, browsing behaviour if tracked)
- Why it is collected — the specific purpose of processing (fulfilment, marketing, analytics, fraud prevention)
- Who it is shared with — any operators (courier partners, payment gateways, email platforms like Klaviyo or Omnisend) and whether they are in SA or cross-border
- Data subject rights — the right to access, correct, or request deletion of personal information, and how to exercise those rights
- Cookie use — disclosure of what tracking cookies are deployed and a functioning consent mechanism
- Security measures — a statement of the technical and organisational measures in place to protect data
- Complaints — how to lodge a complaint with the Information Regulator
There is no small-business exemption under POPIA. The POPIA regulations were amended in April 2025 with stricter data subject rights and compliance obligations. Separately — and as a distinct instrument from those regulation changes — the Information Regulator now requires data breach notifications to be submitted through its eServices portal. The POPIA operator agreement guide covers the specific obligations that arise when you share customer data with third-party processors — a gap many ecommerce stores only discover when they audit their app stack.
On cookies specifically: if your store uses Google Analytics 4, Meta Pixel, or any retargeting tag, you need a functioning cookie consent mechanism — not just a banner that dismisses automatically. The cookie consent and analytics guide has the technical implementation detail.
SA ecommerce disclaimer decision table
The SA ecommerce disclaimer decision table maps each legally required notice to its statutory source, whether it is mandatory, the consequence of absence, and the specific condition that makes it enforceable — use it to test your store's existing legal pages against SA law.
| Notice type | Legal source | Mandatory? | Penalty for absence | Enforcement condition |
|---|---|---|---|---|
| 17-item mandatory disclosure set | ECTA s43 | Yes | Consumer may cancel within 14 days of receiving goods/services | Published on the pages where goods/services are offered, before purchase |
| Cooling-off notice (7 days) | ECTA s44 | Yes — cannot be contracted away | Clause purporting to remove the right is void; consumer retains the 7-day right regardless | State the right positively; name any exception categories you stock; state who bears return cost |
| Limitation of liability clause | CPA s48, s49, s51 | Optional; conditional on CPA compliance | Clause may be severed, altered, or voided by a court | Plain language; prominently displayed; consumer had adequate opportunity to read before committing; cannot exclude gross negligence against consumers |
| Privacy notice | POPIA s18 | Yes — for any store collecting personal information | Regulatory enforcement by Information Regulator; complaints process available to data subjects | Names responsible party and Information Officer; states collection purposes and data subject rights; includes cookie disclosure and consent mechanism |
| Price disclosure (VAT-inclusive, all-in) | ECTA s43 item 9 | Yes | Treated as incomplete s43 disclosure; 14-day cancel risk applies | Full price including delivery fee, VAT and any other charges must be visible before checkout confirmation |
Why South African Businesses Choose Growth Pulse Media for Compliance-Ready Store Design
Getting SA ecommerce disclaimers right means more than legal copy — it requires design decisions. Where disclosures appear in the customer journey, how the cooling-off notice surfaces at checkout, how the cookie consent mechanism connects to your analytics tags: each of these affects whether your legal notices are actually enforceable or merely decorative. Operators who have run the business end of an SA online store know this from the inside; it is not something you learn from a platform's help documentation.
Growth Pulse Media's ecommerce web design service is built around this operational reality. Dirk van Greuning, who scaled a large South African ecommerce business before founding the agency, brings a practitioner's understanding of what regulators look for and what customers expect to see at each stage of the buying journey. All work is executed in-house, with a deliberately limited client load so every project receives senior attention — not a junior developer working from a checklist. As a registered Shopify Partner, we handle Shopify stores as standard, including the POPIA and ECTA disclosure structures that SA-specific compliance requires.
If your store's legal pages need a structural rethink alongside a design update, this is the conversation to start before you rebuild — not after.
Who This Post Is Not For
Businesses operating exclusively in a B2B context. Many CPA and ECTA consumer protection provisions — including the section 44 cooling-off right — apply specifically to transactions with consumers, not to business-to-business contracts. Reading this post as your sole compliance guide for a pure wholesale or B2B-only operation may lead to misapplied requirements. The competition and promotions rules guide covers additional considerations for B2B contexts.
Stores needing verbatim legal text to paste onto their website. This post explains what each SA ecommerce disclaimer category must cover and what makes each one enforceable. It is not a substitute for a qualified South African attorney drafting or reviewing your actual Terms and Conditions, Privacy Policy and Returns Policy. The wording matters in court — a blog post cannot replace legal advice tailored to your specific business model.
Stores in regulated sectors. If your store sells financial products, medical devices, health supplements, alcohol, food, or other regulated categories, sector-specific disclosure obligations apply on top of ECTA, CPA and POPIA. The Financial Sector Conduct Authority, National Department of Health and CIPC each impose additional requirements that this post does not cover.
Stores using a global platform's default legal templates without SA review. Shopify, WooCommerce and other platforms often provide starter legal pages written for US, EU or UK law. There is no off-the-shelf ecommerce disclaimers template that satisfies ECTA's 17-item set, the s44 cooling-off disclosure, and POPIA s18's naming requirements simultaneously — each element needs SA-specific drafting. Using a foreign-law starter without SA review exposes your store to the 14-day cancellation risk under ECTA s43(3).
Ready to build SA compliance into your store from day one?
Book a no-obligation call and we will outline how a properly structured ecommerce design protects your revenue and meets the ECTA, CPA and POPIA requirements specific to South African online retail.
Book a free consultationFrequently Asked Questions
What does ECTA section 43 require an online store to disclose in South Africa?
ECTA section 43 requires any supplier conducting electronic transactions to publish 17 categories of information on the web pages where goods or services are offered. These cover the supplier's full legal identity, contact details, physical address for service of documents, product or service characteristics, full pricing including delivery and VAT, payment methods, delivery timeframe, returns and refund policy, security and privacy procedures, and how consumers can access their transaction records. If any of these are missing, consumers may cancel the transaction within 14 days of receiving goods or services and receive a full refund.
Can a South African ecommerce store legally say "no refunds"?
Not on purchases covered by ECTA section 44. All South African online shoppers have a statutory seven-day cooling-off right for electronic transactions — this right cannot be removed by a store's own terms and conditions. A blanket "no refunds" policy is void to the extent it purports to cancel this right. Stores may limit returns beyond the seven-day window, and the seven-day right itself does not apply to perishables, custom-made items, or unsealed digital media. Those exceptions must be explicitly stated in your returns policy, not assumed.
What happens if my online store is missing required legal disclosures under ECTA?
ECTA section 43(3) entitles a consumer to cancel within 14 days of receiving goods or services when the mandatory disclosures were absent at the time of purchase. The consumer returns the goods; the store refunds all amounts paid, minus the direct cost of return shipping. This statutory entitlement operates independently of what the store's Terms and Conditions say — a compliant T&C page does not save a store whose underlying disclosures are missing. Any customer who knows about this provision can act on it directly, without involving a regulator.
What must a POPIA-compliant privacy notice include for an SA ecommerce store?
A POPIA section 18-compliant privacy notice must identify the responsible party (the store) and its registered Information Officer, list the categories of personal information being collected, explain the specific purpose of processing, disclose any third parties that receive the data, state data subjects' rights to access, correct and delete their information, describe the security measures in place, and provide details for lodging a complaint with the Information Regulator. It must also address cookie usage and link to a functioning cookie consent mechanism. There is no small-business exemption from these requirements.
Is a limitation of liability disclaimer enforceable against South African consumers?
Only conditionally. CPA sections 48, 49 and 51 set strict requirements: limitation clauses must be written in plain language, displayed at a point where the consumer has a genuine opportunity to read them before committing to a purchase, and they cannot be so broad as to defeat the purpose of the CPA or strip a consumer of a CPA right. Courts can sever, alter or void a clause that fails these tests. Blanket "as is" exclusions and total liability waivers are particularly vulnerable. A narrow, specific, prominently displayed limitation tied to an identifiable risk has a stronger chance of holding — but even then, liability for gross negligence against a consumer cannot be excluded.
Build an SA-Compliant Ecommerce Store
Growth Pulse Media designs and builds ecommerce stores that incorporate ECTA, CPA and POPIA requirements structurally — not as an afterthought. Dirk van Greuning brings direct experience scaling a South African ecommerce business to every build, with Shopify Partner credentials, in-house execution, and a limited client load that means senior attention throughout. No obligation — we will get back to you within 24 hours.
Start the conversation