Organizations conducting e-commerce in the United States face an increasingly complex patchwork of laws and regulations governing (1) data privacy; (2) automatic renewal disclosures; (3) accessibility; and (4) the enforceability of arbitration clauses and class waivers. Below we discuss each.

• Data Privacy There is no omnibus and uniform federal data privacy law in the US. Data privacy in the US is instead governed some federal laws and a larger swatch of state laws. In fact, since at least 2013, a number of states have adopted online privacy laws that require certain disclosures for e-commerce organizations. In 2018, California became the first state in the US to adopt a comprehensive data privacy law known as the California Consumer Privacy Act (CCPA). The CCPA, as amended, provides most California residents with broad rights to control how their personal information (as broadly defined under the CCPA) is collected, used, and shared. An amendment to the CCPA that takes effect on January 1, 2023 will add even more compliance requirements on e-commerce organizations conducting business in California, including imposing new restrictions on how businesses collect, use, share, and retain California resident personal information. Other states have followed suit, with Virginia, Colorado, Utah, and Connecticut all having passed comprehensive data privacy laws that take effect in 2023. In short, any business conducting e-commerce in the US must ensure compliance with the growing number of states that have adopted comprehensive data privacy laws, as they directly impact how information is collected, used, shared in the course of e-commerce. This is especially true as it relates to the use of cookies, tracking pixels, and other related technologies to serve advertising and provide other functionality in the e-commerce ecosystem.
• Automatic Renewal Many e-commerce organizations doing business in the US have a recurring or automatic renewing subscription model. A growing number of US states have adopted laws that govern how businesses may operate these programs, including how disclosures must be made to the consumer. These laws, often referred to as automatic renewal laws (“ARLs”) provide requirements for how and when an organization may sign up a customer for an automatic subscription. In California, for example, the ARL requires businesses to provide clear and conspicuous notice of the subscription terms, methods for cancelling, and to provide certain information via confirmation messages. A July 1, 2022 amendment to the California ARL further complicates compliance. And other states have similar laws relating to automatic subscriptions.
• Accessibility In recent years, more and more organizations that operate a website are being sued on the basis that the website is not accessible within the meaning of the Americans with Disabilities Act (ADA). Moreover, statutory regimes such as the CCPA are increasingly mandating that certain disclosures on websites and other digital platforms be accessible, as defined by the Web Content Accessibility Guidelines. As these areas of liability grow, organizations must be thinking about accessibility at all stages in the digital platform design process.
• Arbitration / Class Waiver It is commonplace in the US to include a terms and conditions or terms of service as part of an e-commerce offering. Those terms often contain arbitration provisions and a class waiver, requiring any claim be brought against the organization in an individual capacity (and not as a class proceeding), and in individual arbitration. If enforceable, these terms can significantly mitigate risk and minimize exposure. Whether those terms are enforceable, however, is becoming more complex to address in the US. To enforce a set of terms, courts in the US generally look to state law to determine whether a contract has been formed with the user. Whether the terms are accepted through a browse wrap, scroll wrap, or click wrap style agreement may impact the enforceability of the agreement. And whether an organization utilizes a checkbox, or a sign-in function may impact how protected the organization is in the event of litigation. Thus, thinking through the design of how a terms of use will be delivered can be just as important as the text of the agreement itself.