Add to Preferred Sources
ECT Act ecommerce compliance is mandatory for every South African online store without exception: the Electronic Communications and Transactions Act 25 of 2002 imposes five core obligations — mandatory website disclosures, a structured checkout review step, a 7-day consumer cooling-off right, an opt-out rule for commercial messages, and a 30-day delivery deadline.
Missing any one of them can invalidate your sales agreements and trigger cancellation rights that go beyond the standard cooling-off period most operators know about. For a complete picture of how ECTA sits within your legal framework, see the website compliance guide for South African businesses.
The gap most store owners miss: the standard 7-day cooling-off and the 14-day cancellation right triggered by missing disclosures are two entirely separate consumer remedies. A store without a compliant section 43 disclosure is not merely breaking a rule — it is handing every customer a 14-day no-questions return window on top of the cooling-off period they already have by default.
Quick Answer
ECT Act ecommerce compliance requires every South African online store to: (1) display a prescribed set of business and transaction details on the website; (2) give buyers a structured opportunity to review, correct and withdraw before confirming an order; (3) honour a 7-day no-penalty cooling-off period, with defined exclusions; (4) include opt-out mechanisms in all commercial messages; and (5) fulfil orders within 30 days.
Failing to meet the section 43 disclosure requirements hands consumers a separate 14-day cancellation right on top of the standard cooling-off. The standard section 44 cooling-off carries its own refund obligation: the supplier must process the refund within 30 days of cancellation.
Jump to a Section
Does Your Website Tick Every Legal Box?
Share your store URL and we will identify which ECT Act disclosures are missing before they give a customer grounds to cancel.
Get a Free Website ReviewWho Must Comply With SA's Online Trading Legislation
The Electronic Communications and Transactions Act 25 of 2002 applies to any person who operates a website for the purpose of electronic transactions in South Africa — sole traders, private companies, close corporations, and foreign companies selling to South African consumers online. There is no turnover floor and no minimum transaction volume. A part-time store selling handmade goods faces the same ECT Act ecommerce requirements as a high-volume retailer, because the Act defines "supplier" broadly as any person who offers goods or services online.
The Act does carve out transactions that cannot be concluded electronically. Schedule 2 lists exclusions: sales of immovable property, wills, bills of exchange, and long-term leases exceeding 20 years must still be executed on paper. For the vast majority of online retail — physical goods, digital goods, services, subscriptions — ECTA applies in full, and has done since commencement on 30 August 2002.
No Turnover Exemption Exists
The ECT Act requirements South Africa imposes on online stores apply regardless of revenue or trading entity type. If your website accepts orders from South African consumers, section 43 compliance is not optional — it is a legal prerequisite for your sales agreements to be enforceable.
ECT Act Ecommerce Compliance: The Section 43 Mandatory Website Disclosures
Section 43(1) of the ECT Act requires any online store to display a defined list of information on its website so that consumers can make informed purchasing decisions before transacting. This is not a general transparency recommendation: failure to provide this information is a specific legal defect that triggers a separate 14-day cancellation right — on top of the 7-day cooling-off period under section 44.
Section 43(1) lists 17 specific items in total. The table below groups those that apply to most retail stores. Businesses in regulated sectors or running subscription and recurring billing models must also disclose self-regulatory or accreditation memberships, applicable codes of conduct and their electronic access method, and the minimum duration of any ongoing agreement — items (d), (e) and (q) in the Act's numbering.
| Category | What Must Be Disclosed | Where to Put It |
|---|---|---|
| Business identity | Full legal name and legal status; registration number; names of directors or members; place of registration; physical address for service of legal documents | Site footer or dedicated Legal Information page |
| Contact details | Physical address, telephone number, website URL, and email address | Site footer and Contact page |
| Product and pricing | Sufficient description of goods or services; full price including transport, taxes and all fees; payment methods accepted | Product pages and checkout summary |
| Transaction terms | Terms of agreement and guarantees; delivery or performance timeframe; how transaction records are accessed and maintained; return, exchange and refund policy; alternative dispute resolution information; consumer rights under section 44 | Terms & Conditions page; Returns policy page |
| Privacy and security | Security procedures and privacy policy covering payment data and personal information | Privacy Policy page; footer link |
One item consistently missed: the Act specifically requires you to inform customers of their rights under section 44 — the cooling-off right — as part of the section 43(1) disclosures. If your terms and conditions do not include this, you are non-compliant with section 43(1), not only section 44. The disclaimer and legal notice requirements for SA online stores cover the practical page and footer structure in more detail.
Compliant ECT Act footer: Legal entity name (Pty Ltd), registration number, physical address, telephone number, email address, and footer links to Privacy Policy, Terms & Conditions, and Returns Policy — plus a sentence referencing consumer cooling-off rights under the ECT Act. Visible from every page without requiring a user to search for it.
Non-compliant approach: A store that shows only a trading name, an email address, and a generic postal address. No registration number, no director names, no physical address for legal service, and no reference to cooling-off rights. Section 43(1) is not satisfied — every sale is technically subject to the separate 14-day cancellation right, not just the standard cooling-off.
What the Checkout Flow Must Include Before a Customer Can Pay
Section 43(2) of ECTA requires suppliers to provide consumers with an explicit opportunity to review the full transaction, correct any mistakes, and withdraw — before the order is finally placed. This is a process requirement, not just a disclosure requirement.
In practice, it means your checkout must have an order review step where the customer can see the complete order summary — items, quantities, shipping cost, taxes, and total — and make changes before a final "Place Order" or "Pay Now" button commits the transaction. One-click purchase flows that bypass this review step may not satisfy section 43(2).
The legal consequence is significant: a consumer can cancel the transaction with retrospective effect if the review step is missing, meaning the sale unwinds as if it never happened. This is a different remedy from a standard return, and it does not require the consumer to show fault on the supplier's part.
Practical check: Walk through your checkout on a mobile device. Is there a dedicated order summary page before payment is processed, showing the full item list, shipping cost, and total? Platforms such as Shopify include this review step by default. Custom WooCommerce builds and older theme configurations may not — worth verifying with your developer before your next significant traffic period.
Not Sure if Your Store's Checkout Is Legally Sound?
Tell us which platform you are on and we will walk through the compliance requirements specific to your setup — no obligation, no commitment required.
Book a Free Compliance ConversationThe 7-Day Cooling-Off Period Every SA Seller Must Know
The ECT Act cooling-off period gives consumers the right to cancel an electronic transaction without reason and without penalty within seven days of receiving goods, or within seven days of concluding a service agreement. This statutory right under section 44 applies automatically — it cannot be contracted out of, and your terms of sale cannot reduce or exclude it.
When a consumer exercises the section 44 right:
- No cancellation fee or restocking charge is permitted.
- The only amount the supplier may recover is the direct cost of returning the goods.
- The full refund must be processed within 30 days of the cancellation.
- The right applies to natural persons only — not businesses purchasing as legal entities.
The section 44 exclusions are specific. The 7-day cooling-off right does not apply to:
- Financial services
- Auctions
- Everyday foodstuffs and perishable goods
- Personalised or custom-made goods
- Unsealed computer software, audio recordings and video recordings
- Newspapers and magazines
- Gaming and lottery services
- Services where performance began with the consumer's consent before the cooling-off period expired
- Accommodation, transport, catering or leisure services booked for specific dates
- Transactions where price depends on financial market movements outside the supplier's control
Digital downloads fall under the unsealed media exclusion once a consumer has downloaded or accessed them — but your returns policy should state this explicitly and link to your refund terms. The rules on refunds for digital purchases in SA cover this in detail, including the less clear position on digital goods that have been purchased but not yet accessed.
ECT Act Cooling-Off vs CPA Cooling-Off: Not Interchangeable
The 7-day cooling-off under section 44 of the ECT Act applies to standard online purchase transactions. The Consumer Protection Act has its own cooling-off provision — 5 business days — but that applies specifically to direct-marketing sales (unsolicited phone calls, door-to-door, and similar approaches), not to customers who found you through a search or ad and bought on your website. Both could apply if your store also runs direct-marketing campaigns, but they are triggered by different sales methods and cannot be used interchangeably.
Marketing Messages and the 30-Day Delivery Rule
Section 45 of the ECT Act establishes an opt-out regime for unsolicited commercial communications. Any SA business that sends commercial emails or SMS messages must include a clear mechanism to opt out of future messages, and must disclose the source of the recipient's contact details if asked. Sending a commercial message after a valid opt-out request — or failing to include an opt-out option at all — is a criminal offence under section 89(1) of the Act.
This section 45 obligation runs alongside POPIA's section 69 for direct electronic marketing. POPIA permits direct marketing to existing customers under the existing-customer exception and to new contacts only with explicit consent. Meeting POPIA does not automatically satisfy section 45 — the opt-out link must function and you must be able to name your data source on request. Both frameworks apply simultaneously; the POPIA compliance guide for SA businesses covers the section 69 requirements in detail.
Section 46 adds a delivery obligation. Unless a different delivery period was explicitly agreed at checkout, suppliers must fulfil orders within 30 days of the transaction date. If goods become unavailable after purchase, the supplier must notify the consumer immediately and refund in full within 30 days. If delivery is delayed rather than impossible, the consumer may give written notice requesting fulfilment within 7 days, and is entitled to cancel with a full refund if that deadline passes without delivery.
Section 45 in Practice
Every marketing email your store sends must contain a functional one-click unsubscribe link — not a "manage your preferences" flow requiring login. If a customer asks where you got their email address, you must be able to answer. Both are section 45 obligations, independent of POPIA, and both are criminal offences if ignored under section 89(1) of the Act.
How POPIA and Consumer Law Layer On Top
POPIA and the Consumer Protection Act both impose obligations that overlap with the ECT Act — an SA online store must simultaneously satisfy all three frameworks, and a privacy policy or returns clause drafted for only one will typically leave compliance gaps in the others. For ECT Act ecommerce South Africa requirements, understanding where each framework starts and stops is what prevents a store from being technically compliant with one and unknowingly in breach of another.
POPIA: Section 43(1) of ECTA requires a security procedure and privacy policy covering payment data and personal information. POPIA requires a separate, conditions-compliant privacy policy that satisfies the eight conditions of lawful processing. A POPIA-compliant privacy policy will satisfy the ECT Act's disclosure requirement — but a policy drafted only with the ECT Act in mind may leave POPIA gaps. If your privacy policy has not been reviewed against both frameworks, it probably needs updating.
The Consumer Protection Act: The CPA adds product liability obligations (goods must be suitable, safe, durable, and standards-compliant), plain language requirements, and a prohibition on bundling unwanted goods or services. CPA section 49 requires liability limitations to be prominently disclosed — not buried in terms. The CPA's own cooling-off right applies to direct-marketing sales and does not replace the ECT Act's 7-day right for standard online purchases.
For stores running competitions or promotions, South African competition and promotion rules sit on top of all three frameworks. Building legal compliance into a store's structure from the start — rather than retrofitting it — is how Growth Pulse Media approaches website design for South African businesses: the disclosure architecture, checkout flow review step, and policy pages are scoped before a line of code is written, not added after a legal query forces the issue.
Building a New Store or Redesigning an Existing One?
We scope ECT Act and POPIA compliance into every web design project from day one — send us your brief and we will show you how legal structure and conversion performance work together.
Start the ConversationWhy South African Businesses Choose Growth Pulse Media
Dirk van Greuning built and scaled a large South African ecommerce business before founding Growth Pulse Media, which means ECT Act ecommerce obligations — disclosure pages, checkout review steps, cooling-off handling — were something he navigated as an operator before he designed them for other businesses. That background shapes how GPM approaches web design projects for SA businesses: compliance requirements are scoped into the information architecture and page structure before build begins, not added as an afterthought when a dispute surfaces.
GPM keeps a limited client load so that every project receives senior-level attention rather than being handed to a junior team following a template. All work is executed in-house, without outsourcing, and integrations are selected for the South African market specifically: Shopify, PayFast, Peach Payments, Yoco, The Courier Guy, Aramex, and the local regulatory environment that operators like yours operate under every day.
Who This Post Is Not For
You operate cross-border and need international compliance. The ECT Act's consumer protections apply to South African consumers. If your store sells to buyers in the EU, UK, or the US, those jurisdictions impose their own requirements — GDPR, the UK Consumer Contracts Regulations, US state consumer laws — and this post does not address them.
You are looking for legal advice on a specific dispute. This post explains what the ECT Act requires in practical terms for store operators. It is not legal advice and does not substitute for consulting a commercial attorney about your specific terms of sale, a consumer complaint you have received, or a CGSO complaint in progress.
You run a B2B-only store with no individual consumer customers. Section 44's cooling-off right applies to natural persons, not to companies purchasing as legal entities. If every buyer on your platform is a registered business, the cooling-off provisions do not apply — though your section 43 disclosure obligations still do, in full.
You are building a marketplace platform connecting third-party sellers to buyers. Platform operator liability under the ECT Act — distinct from the obligations on individual sellers — is a separate and more complex topic not covered in this post.
Frequently Asked Questions
Does the ECT Act apply to my small Shopify store?
Yes. ECT Act ecommerce obligations apply to any person who operates a website for the purpose of electronic transactions in South Africa — there is no revenue threshold, no minimum order volume, and no exemption for sole traders or part-time stores. The Electronic Communications and Transactions Act 25 of 2002 defines "supplier" broadly, so if your Shopify store accepts orders from South African consumers, section 43 compliance applies immediately and in full.
What is the 14-day cancellation right, and how does it differ from the 7-day cooling-off?
The 7-day cooling-off right under section 44 of the ECT Act applies to all qualifying electronic transactions automatically — it is the standard consumer right. The 14-day cancellation right under section 43(3) is a separate remedy triggered specifically when a supplier fails to provide the required section 43(1) disclosures or the section 43(2) checkout review opportunity. A consumer who qualifies for both can choose either. The 14-day right requires no reason — it exists purely because the supplier failed a statutory disclosure obligation.
Does the cooling-off period under the ECT Act apply to digital downloads?
Generally no. Once a consumer downloads or accesses unsealed digital media — software, music, video recordings, ebooks that have been opened — the section 44 exclusion applies and the ECT Act cooling-off period falls away. For digital goods purchased but not yet accessed, the position is less settled — state the exclusion clearly in your returns policy and consider permitting a refund window regardless. See the digital goods refund guide for SA stores for the full breakdown.
How does the ECT Act section 45 opt-out rule interact with POPIA for email marketing?
They are parallel, not interchangeable, obligations. Section 45 of the ECT Act requires every commercial message to include a working opt-out mechanism and requires disclosure of your data source on request; POPIA section 69 requires consent or the existing-customer exception before you send direct marketing at all. Satisfying POPIA does not automatically satisfy section 45 — the unsubscribe link must actually work — and section 45 compliance does not replace POPIA consent management. Both frameworks must be met simultaneously.
What happens if I cannot deliver within the 30-day window?
Under section 46, if the goods are unavailable, you must notify the consumer immediately and refund in full within 30 days of cancellation. If delivery is delayed but possible, the consumer may give written notice requesting delivery within 7 days. If delivery does not occur within that 7-day window, the consumer is entitled to cancel and receive a full refund. Failing to notify or refund constitutes a further breach of the Act, compounding the original non-performance.
Is a terms and conditions page enough to satisfy section 43?
Not on its own. Section 43(1) requires information to be accessible on the website — a T&Cs page covers some requirements (agreement terms, returns policy, dispute resolution, consumer rights under section 44), but registration numbers, director names, physical address for legal service, and contact details typically need to be in your site footer so they are visible from every page. A T&Cs page buried in a navigation menu is less legally defensible than footer disclosure combined with a dedicated Legal Information page.
Build a Store That Is Compliant by Design, Not by Afterthought
Growth Pulse Media designs South African online stores where ECT Act disclosure requirements, POPIA-compliant privacy pages, and checkout flows built for local payment gateways — PayFast, Peach Payments, Yoco — are scoped from the project brief, not patched in after the first legal complaint. All work executed in-house. Senior-level attention on every project. No obligation — we will get back to you within 24 hours.
Talk to Us About Your Store