Internet Transactions Act Philippines: RA 11967 Guide

How Do Online Transactions Work Under Philippine Technology Law?

No single statute governs an online sale in the Philippines. Six layers stack on one purchase: RA 8792 makes the electronic contract, document and signature legally valid and provable; RA 11967 sets who must disclose what and who answers for loss; RA 7394 gives the buyer the remedy; RA 10173 governs the customer data collected along the way; RA 10175 covers fraud and intrusion; and the Rules on Electronic Evidence decide what a court accepts as proof. The map below pairs each layer with the obligation it creates.

This guide covers the second layer in depth. The Internet Transactions Act of 2023 (Republic Act No. 11967) governs business-to-consumer and business-to-business internet transactions where a party is in the Philippines or a platform serves the Philippine market. It covers e-marketplaces, e-retailers, online merchants and other digital platforms — not purely consumer-to-consumer selling. The statutory transition period has lapsed, so obligations are live now. Start by identifying which actor type you are under Section 4.

For the broader online-business compliance map covering privacy, tax, consumer, payments and cybersecurity, see the Business Compliance Philippines hub.

Key Takeaways

RA 11967 was approved on 5 December 2023 and its Implementing Rules and Regulations are dated 24 May 2024, per the DTI E-Commerce Bureau’s own laws and policy listing.
Section 32 gave affected businesses eighteen months from effectivity to comply. Counted from any defensible start date — the Act’s late-2023 effectivity or even the May 2024 IRR — that window closed before 2026, so no grace period remains.
RA 11967 is one layer of six. Validity and proof of the electronic transaction come from RA 8792, the buyer’s remedy from RA 7394, data duties from RA 10173, fraud and intrusion from RA 10175, and admissibility from the Rules on Electronic Evidence.
Your obligations depend entirely on which of four actor types you fall into: e-marketplace (Section 21), other digital platform (Section 22), e-retailer or online merchant (Section 23).
Liability is layered, not shared equally. The seller is primarily liable (Section 25); the platform is subsidiarily liable in defined circumstances (Section 26) and solidarily liable only where it ignores notice about prohibited or dangerous goods (Section 27).
A consumer must exhaust a business’s internal redress mechanism before going to court or arbitration, and that mechanism is deemed exhausted if the complaint is unresolved after seven calendar days (Section 24).
The DTI Secretary can issue ex parte takedown orders effective for up to thirty days, with the affected party heard within forty-eight hours (Section 15), and can blacklist non-compliant sites (Section 16).
The E-Commerce Philippine Trustmark is voluntary, not a licence to trade. DTI’s Trustmark guidelines describe application as voluntary and cite Department Administrative Order 25-07.

RA 11967 in 60 seconds

Question	Short answer
What is RA 11967?	The Internet Transactions Act of 2023, the Philippine law regulating covered internet transactions and creating the Electronic Commerce Bureau.
Who is generally covered?	E-marketplaces, other digital platforms, e-retailers and online merchants involved in covered B2C or B2B internet transactions.
Are ordinary consumer-to-consumer sales covered?	Generally no; consumer-to-consumer transactions are excluded from the Act’s scope.
What should an online seller check first?	Identify whether it is acting as an e-retailer, online merchant, marketplace or other digital platform because the statutory duties differ by actor type.
What are the recurring compliance themes?	Seller identity and disclosures, accurate listings, receipts or invoices, consumer redress, prohibited-goods controls, data protection and platform accountability.
Where is the primary law?	Republic Act No. 11967, with Republic Act No. 8792 underneath it.

Jump to a Section

Decision snapshot: are you covered?
How online transactions work: the six layers
Governing law and authorities
Scope and definitions
Compliance duties by actor type
Liability and safe harbour
Exceptions and overlapping laws
Worked scenarios
Records to maintain
Step-by-step compliance sequence
Penalties and enforcement
Common mistakes
Compliance obligations checklist
FAQs
Checks made on 16 October 2026
Official sources

Decision Snapshot: Are You Covered, and What Do You Owe?

Work out which row describes you before reading anything else. A single business can occupy more than one row — a brand that runs its own website and also sells on a marketplace is both an e-retailer and an online merchant, and owes both sets of duties.

Actor type	Covered by RA 11967?	Core obligations	Likely first next step
E-marketplace (connects consumers with merchants, facilitates shipment or logistics, retains oversight)	Yes — Section 21	Merchant identity collection and verification, updated merchant list, prohibited-goods controls, redress mechanism, listing disclosure standards, data protection	Audit your merchant onboarding file against the Section 21(d) identity list
Other digital platform (connects buyers and sellers but does not exercise transaction oversight, e.g. social commerce and classified-ad style services)	Yes — Section 22	Distinguish commercial from non-commercial accounts, prohibited-goods controls, require seller-side disclosures, redress mechanism, maintain a list of e-commerce accounts	Build the commercial-account flag and the seller disclosure fields
E-retailer (sells directly to consumers through its own website, page or app)	Yes — Section 23	Homepage publication of corporate or trade name, physical address and contact details; accurate pricing; conformity of goods; invoices or receipts; complaint handling	Publish the Section 23 identity block on your homepage today
Online merchant (sells through an e-marketplace or third-party platform)	Yes — Section 23	Truthful listing information, conformity of goods and digital content, invoices or receipts, complaint handling, permits for regulated goods	Fix listing disclosures and start issuing compliant receipts
Individual selling personal items to another individual (C2C)	Generally no — Section 3 excludes consumer-to-consumer transactions	None under RA 11967, but ordinary civil and criminal law still applies	Confirm you are genuinely not trading as a business
Online media content	No — excluded by Section 3	Not covered by this Act; other laws may apply	Check sector-specific regulation instead
Foreign seller or platform serving Philippine buyers	Yes if availing of the Philippine market with minimum contacts — Section 3	Same duties as the equivalent domestic actor type	Assess minimum contacts and appoint a Philippine contact point

How Online Transactions Work Under Philippine Technology Law: Six Layers on One Purchase

A single online order passes through six bodies of Philippine law, each answering a different question. A business that reads only RA 11967 is missing five of them, and most disputes turn on a layer other than the one being argued about.

Layer	Governing law	What it decides	What you must be able to show
Is the deal valid?	RA 8792, Secs. 6, 7, 8 and 16	An electronic contract, document or signature is not void for being electronic; offer and acceptance may be expressed by data message.	That the document stayed complete and unaltered, and that the signing method identified the party bound.
Who discloses, who answers?	RA 11967, Secs. 21 to 27	Identity and listing disclosures by actor type, the internal redress mechanism, and whether liability is primary, subsidiary or solidary.	Your actor type under Sec. 4, your disclosures, your merchant verification records and your complaint log.
What can the buyer demand?	RA 7394, Arts. 100, 101 and 106	Correction within thirty days, then replacement, reimbursement with monetary updating, or a price reduction, at the buyer’s option.	Your correction attempts and their dates. A no-return clause will not help you: Art. 106 prohibits it.
What happens to the data?	RA 10173 and NPC Circular No. 16-03	Lawful basis, security measures, and the duty to notify the Commission and the data subjects of a qualifying breach.	Your privacy notice, your security measures, and, after a breach, that you notified within 72 hours.
Was it fraud or intrusion?	RA 10175, Secs. 4, 13 and 14	Computer-related fraud and illegal access as offences, plus the preservation and disclosure duties that apply to traffic and subscriber data.	Logs, transaction records and timestamps, preserved before the provider’s six-month minimum runs out.
Will it stand up as proof?	RA 8792, Secs. 11 to 13, and the Rules on Electronic Evidence	Who bears the burden of authenticating an electronic record, and when it counts as the best evidence of the transaction.	That the record was kept in the ordinary course of business, is still accessible, and identifies originator, addressee and time.

Read the table from the top when something goes wrong. A buyer arguing about a refund is usually in layer three while the seller is arguing layer two; a platform facing a disputed order is in layers two and six at once.

The interaction businesses get wrong: RA 8792’s service-provider shield is narrower than it looks

Section 30 of RA 8792 says that a person or party acting as a service provider who “merely provides access” is not subject to civil or criminal liability for the electronic data message or electronic document passing through it, provided that it does not have actual knowledge of, or awareness of facts making apparent, the unlawfulness; does not knowingly receive a financial benefit directly attributable to the unlawful or infringing activity; and does not commit, induce or cause the act. The section then carves out, expressly, any obligation founded on contract, the obligation of a service provider under a licensing or other regulatory regime established under written law, and any obligation imposed under any written law.

That last carve-out is where RA 11967 lands. The Internet Transactions Act is written law imposing obligations on e-marketplaces and digital platforms, so Sec. 30 does not shield a platform from them. An e-marketplace that retains oversight of the transaction and takes a commission is also not merely providing access, and a platform earning from a listing is poorly placed to argue it received no financial benefit from it. The practical result is that a platform’s protection now comes from Sec. 26’s good-faith proviso and from acting expeditiously on notice under Sec. 27, not from RA 8792.

Where payments and tax sit

Two further layers sit alongside this statute rather than inside it. A payment dispute against a bank, e-money issuer or other institution supervised by the Bangko Sentral ng Pilipinas is raised with that institution first and is governed by banking regulation, not by RA 11967, so it runs separately from the Sec. 24 mechanism described below. Invoicing, receipting and registration duties come from the tax statutes rather than from the Internet Transactions Act, and are set out in our online business compliance checklist for the Philippines.

Governing Law and Authorities

RA 11967, styled the Internet Transactions Act of 2023, was approved on 5 December 2023. Section 38 provides that the Act takes effect fifteen days after completion of publication, which places effectivity in late December 2023.

The IRR. Implementing Rules and Regulations for the Act do exist. The DTI E-Commerce Bureau’s official Related Laws and Policy Issuances listing carries an entry “IRR – Internet Transactions Act of 2023” dated 24 May 2024, and DTI hosts the document on its Implementing Rules and Regulations page, which states that the ITA IRR “shall aid the effective implementation of Republic Act No. 11967.” As of 6 September 2026 we were not able to verify a department administrative order number for the IRR from an official page that renders reliably, so this guide cites the underlying statutory sections rather than IRR rule numbers, and readers should download the IRR itself from the DTI page before relying on a specific rule reference.

Where the Act sits. RA 11967 does not replace older law; it layers on top of it.

RA 8792, the Electronic Commerce Act of 2000, supplies the legal recognition of electronic data messages, documents and signatures. RA 11967 assumes that framework and regulates the commercial conduct built on top of it.
RA 7394, the Consumer Act of the Philippines (13 April 1992), supplies the substantive rules on deceptive, unfair and unconscionable sales acts. Section 29 of RA 11967 expressly attaches its fine schedule to acts penalised under the Consumer Act.
RA 10173, the Data Privacy Act of 2012, continues to govern customer data. Sections 21 to 23 of RA 11967 require platforms and sellers to protect consumer data consistently with it.
The DTI-DA-DOH-DENR-IPOPHL-NPC Joint Administrative Order No. 22-01 (4 March 2022), Guidelines for Online Businesses, remains on DTI’s list of operative e-commerce issuances.

Who enforces. Section 7 created the E-Commerce Bureau under DTI within six months of effectivity. Section 8 gives the Bureau policy formulation, compliance monitoring, complaint intake and referral, investigation, consumer education and inter-agency coordination functions. Section 12 gives DTI regulatory jurisdiction over the use of the internet for e-commerce by e-marketplaces, online merchants, e-retailers, digital platforms and third-party platforms — expressly ancillary to the regulatory jurisdiction of DICT, BSP and the National Privacy Commission, so RA 11967 does not displace those regulators.

Scope and Definitions: Which Box Are You In?

Section 3 states that the Act applies to all business-to-business and business-to-consumer internet transactions within the DTI’s mandate, “where one (1) of the parties is situated in the Philippines or where the digital platform, e-retailer, or online merchant is availing of the Philippine market and has minimum contacts therein.” Consumer-to-consumer transactions and online media content sit outside the Act.

Section 4 supplies the definitions that decide your obligations:

Digital platform

Information and communication technology-enabled mechanisms that connect and integrate producers and users in online environments. This is the umbrella term; e-marketplaces are a subset of it.

E-marketplace

A digital platform whose business is to connect online consumers with online merchants, facilitate the shipment of goods or provide logistics services, and which retains oversight of the transaction. The oversight element is what separates a Section 21 e-marketplace from a Section 22 platform. A service that runs the checkout, holds or routes payment, manages fulfilment and can suspend a listing is exercising oversight.

E-retailer

A natural or juridical person selling goods or services directly to online consumers through its own website, webpage or application. A Shopify or WooCommerce store under your own domain makes you an e-retailer.

Online merchant

A person selling non-financial goods or services to online consumers through an e-marketplace or third-party digital platform. Selling on Shopee, Lazada, TikTok Shop or a Facebook page as a business puts you here.

Online consumer and internet transaction

An online consumer is a natural or juridical person who purchases, leases, receives or subscribes to goods or services over the internet for a fee. An internet transaction is the sale or lease of digital or non-digital goods and services over the internet — digital goods are squarely inside the Act, not an afterthought.

Compliance Duties in Detail, by Actor Type

If you operate an e-marketplace (Section 21)

Section 21 obliges an e-marketplace to ensure transactions are clearly identifiable as e-commerce; to identify the person on whose behalf the transaction is made; to identify promotional offers with clear and unambiguous conditions; to require online merchants to submit name with identification, geographic address, contact details and professional credentials where applicable; to maintain an updated list of merchants with regular verification; to protect consumer data consistently with the Data Privacy Act and applicable security standards; to prohibit the sale of regulated goods without the necessary permits or licences; to provide an effective redress mechanism; and to require merchants to clearly indicate the product name, brand, price, description and condition. Practical translation: onboarding is a KYC exercise with a re-verification cycle, and your listing template is a compliance artefact.

If you run a digital platform without transaction oversight (Section 22)

Section 22 is lighter but real. You must enable a distinction between commercial and non-commercial accounts; prohibit regulated goods without permits or licences; require sellers to indicate name, brand, price, description, condition and contact information; provide a redress mechanism; maintain an updated list of e-commerce accounts; and protect consumer data. Social platforms and community selling groups used for business are the obvious target. See our guide to online marketplace liability in the Philippines for how these duties translate into litigation risk.

If you are an e-retailer or online merchant (Section 23)

Section 23 is the SME core. You must:

Indicate prices consistently with the Consumer Act.
Ensure goods are delivered in the same condition, type, quantity and quality as described.
Deliver accessories, manuals and instructions with the relevant information in Filipino or English.
Ensure the qualities and performance capabilities of goods are standard and normal for that type of good.
For digital goods, ensure functionality, compatibility, interoperability, accessibility, continuity and security.
For services, complete performance in accordance with the contract and as advertised.
If you are an e-retailer, publish on your homepage your corporate or trade name, physical address, contact details and professional credentials where applicable.
Protect consumer data consistently with the Data Privacy Act.
Issue paper or electronic invoices or receipts for sales.
Maintain an accessible and efficient complaint-handling mechanism.

The homepage identity block and the listing disclosures are the two items most often missing on Philippine SME sites. Our detailed walkthrough of online seller disclosure requirements sets out what to publish and where, and the online terms and conditions guide covers the contractual layer that sits behind it.

What consumers owe (Section 19)

Obligations run both ways. Section 19 requires online consumers to exercise ordinary diligence in any internet transaction and constrains cancellation of confirmed and paid orders: cancellation may be refused where payment was authorised despite the cancellation, unless the consumer reimburses the delivery service, unless cancellation is allowed for a fee, or unless the parties agree otherwise. That materially affects how you draft your cancellation policy. Pair it with our guide to e-commerce returns, refunds and consumer rights.

Solidary Liability and Safe Harbour: the Part Businesses Get Wrong

RA 11967 does not make platforms automatically liable for everything a merchant does. It builds a three-step ladder.

Step one: primary liability sits with the seller (Section 25)

The e-retailer or online merchant is primarily liable for indemnifying the online consumer in civil actions or administrative complaints arising from an internet transaction. If you sell, you carry the first loss.

Step two: subsidiary liability for platforms (Section 26)

An e-marketplace or digital platform becomes subsidiarily liable where it failed to exercise ordinary diligence in complying with its obligations and that failure resulted in consumer loss; where it failed, after notice, to expeditiously remove goods infringing intellectual property or subject to a takedown order; or where the online merchant has no legal presence in the Philippines and the platform failed to provide the merchant’s contact details despite notice. Liability is limited to the extent of damages suffered by the consumer as a direct result of the transaction.

The safe harbour

Section 26 carries a proviso protecting good-faith reliance. A platform is not liable for relying in good faith on a merchant’s representations, warranties or submitted registration documents that turn out to be inaccurate or false — provided the platform can show evidence of good faith and of reasonable effort to ascertain and maintain the accuracy, authenticity and veracity of that information. The safe harbour is therefore evidentiary. It is worth exactly as much as your verification records, which is why the Section 21 merchant list and re-verification cycle matter far beyond box-ticking.

Step three: solidary liability (Section 27)

An e-marketplace or digital platform is solidarily liable if it fails, after notice, to act expeditiously to remove or disable access to goods or services that are prohibited by law, imminently injurious, unsafe or dangerous. Solidary liability means the consumer can recover the whole amount from the platform. The trigger is notice plus inaction on a defined category of harmful goods — not ordinary product disputes.

Two operational conclusions follow. First, the moment a platform receives notice about a prohibited or dangerous listing, a clock starts running and the response must be logged. Second, the statute does not define “expeditiously” in hours; the safest reading is same-business-day triage with a documented decision trail.

Exceptions, Boundaries and Overlapping Laws

Four boundaries matter in practice.

C2C and online media content are outside the Act (Section 3). Someone selling a used phone once is not an online merchant. Someone selling twenty phones a month almost certainly is trading as a business and cannot shelter behind the C2C carve-out.
Financial goods and services are outside the online merchant definition. Section 4 defines an online merchant as selling non-financial goods or services. Lending, payments and investment offerings are regulated by BSP and SEC.
DTI’s jurisdiction is ancillary (Section 12). Data breaches remain an NPC matter; payment system issues remain a BSP matter; connectivity and ICT policy remain with DICT. RA 11967 does not consolidate them.
Tax obligations are entirely separate. Nothing in RA 11967 substitutes for BIR registration, invoicing and filing. DTI’s own e-commerce guidance reminds domestic online sellers of BIR registration, invoicing, bookkeeping, return filing and reportorial duties, referencing issuances including BIR RMC No. 60-2020 and RMC No. 4-2021. See our BIR registration guide for online sellers.

Section 34 adds an interpretive rule worth knowing: in case of doubt, the Act is construed in the manner that accords the highest respect for human dignity, consumer rights and individual privacy. Ambiguity tends to resolve against the business.

Four Philippine Scenarios (Hypothetical)

The following four situations are hypothetical illustrations constructed to show how the sections interact. They are not real cases and no decided case is cited for them.

Hypothetical 1: the home-baker who outgrew C2C

A Quezon City baker starts selling to friends via a personal Facebook account, then opens a business page taking sixty orders a week with delivery through a courier partner. She is now an online merchant under Section 4, not a C2C seller. She owes Section 23 duties: truthful listing information, conformity of the goods delivered, receipts, and a complaint route. The platform she sells on owes Section 22 duties, including the commercial-account distinction. Her exposure is primary under Section 25.

Hypothetical 2: the counterfeit listing that was reported and ignored

A brand owner notifies a marketplace that a merchant is selling counterfeit chargers that have caused two reported burn incidents. The marketplace leaves the listing up for three weeks. Under Section 26 the marketplace faces subsidiary liability for failing after notice to expeditiously remove infringing goods. Because the goods are also plausibly unsafe or dangerous, Section 27 solidary liability is in play, meaning an injured consumer could pursue the marketplace for the full amount. Our guide to marketplace liability covers the notice mechanics in more depth.

Hypothetical 3: the platform that verified and was still deceived

A marketplace collects a merchant’s DTI business name certificate, BIR Form 2303, government ID and geographic address, re-verifies annually, and logs each check. The merchant nonetheless used forged documents. Under the Section 26 proviso the platform can argue safe harbour — but only because it can produce the verification file. A platform with the same forged documents and no records has no safe harbour to argue.

Hypothetical 4: the seven-day clock

A consumer in Davao files a complaint through an e-retailer’s website form about a laptop delivered with a cracked screen. The seller does not respond. On the eighth calendar day the internal redress mechanism is deemed exhausted under Section 24, and the consumer may proceed to a court complaint or alternative dispute resolution, and may file with DTI. Section 28 gives the consumer two years from accrual of the cause of action to file for damages.

Records and Documentation to Maintain

The safe harbour, the diligence defence and any DTI investigation all turn on records. Keep, at minimum:

Business registration documents: DTI business name certificate, SEC or CDA registration, mayor’s permit, and BIR Certificate of Registration (Form 2303).
For platforms: the merchant identity file required by Section 21(d) — name with ID, geographic address, contact details, professional credentials — plus the date and result of every verification and re-verification.
Dated logs of every notice received about a listing and every action taken in response, including timestamps. This is the evidence base for “expeditiously” under Sections 26 and 27.
Complaint records: date filed, acknowledgment, resolution steps, resolution date. The seven-day rule in Section 24 is measured in calendar days, so a complaint log with dates is not optional.
Copies of listings as published, including product descriptions, prices, promotional conditions and images, retained for the period a claim can be brought.
Invoices and receipts issued, and the underlying books of account for BIR purposes.
Permits and licences for any regulated goods sold.
Privacy documentation: privacy notice versions, consent records and your data processing register.

Procedure: a Compliance Sequence an SME Can Execute

Do these in order. Steps 1 to 4 are the ones that close the largest exposure fastest.

Classify yourself. Read Section 4 and decide whether you are an e-marketplace, another digital platform, an e-retailer, an online merchant, or more than one. Write the answer down; every later step depends on it.
Fix your public identity disclosures. If you are an e-retailer, publish corporate or trade name, physical address, contact details and professional credentials on your homepage today. If you are an online merchant, populate the equivalent fields in your marketplace profile.
Fix your listings. Name, brand, price, description and condition on every item; promotional offers with clear and unambiguous conditions; prices stated consistently with the Consumer Act.
Stand up an internal redress mechanism. One published channel, an acknowledgment on receipt, and a resolution target inside seven calendar days. Log everything. Our online business compliance checklist covers the operational build.
Confirm registrations. DTI, SEC or CDA as applicable; local business permit; then BIR registration and invoicing.
Audit for regulated and prohibited goods. Remove anything you cannot support with the necessary permit or licence. Platforms must have a control that prevents such listings, not merely a policy that forbids them.
Align your data handling with the Data Privacy Act: privacy notice, lawful basis, retention, and a breach response plan.
Review your terms. Cancellation, delivery, returns and refunds must be consistent with Sections 19 and 23 and with the Consumer Act. See online terms and conditions and returns and refunds.
Decide on the Trustmark. Application through trustmark.dti.gov.ph is voluntary. It is a trust signal and an Online Business Database listing, not a trading licence. Our guide to the Philippine e-commerce Trustmark, requirements and fees sets out whether it is worth it for your size of business.
Diarise a review. Re-verify merchant records, listings and permits at least annually, and re-read the DTI IRR page for updated issuances.

The consumer’s route, for reference. Section 24 requires exhaustion of the business’s internal redress mechanism first, deemed exhausted after seven calendar days without resolution. Consumer complaints then go to DTI — the department operates an online complaint portal at consumercare.dti.gov.ph — and Section 8 tasks the E-Commerce Bureau with receiving and referring complaints from consumers and businesses. Section 17 also directed DTI to develop an online dispute resolution platform.

Penalties, Enforcement and Realistic Outcomes

Section 13 gives DTI the power to issue summons, subpoena ad testificandum and subpoena duces tecum, with contempt proceedings available on non-compliance. Section 14 allows the DTI Secretary to issue compliance orders requiring conformity with RA 11967, RA 7394 and other applicable trade and consumer protection issuances.

Section 15 allows an ex parte takedown order where there is sale of prohibited or regulated goods (the statute names examples including endangered animals, drugs, explosives and counterfeits), sale of items already subject to a cease-and-desist order, reposting of items previously taken down, or transactions threatening public or personal safety or compromising financial or personal information. The affected party is given the opportunity to be heard within forty-eight hours from issuance, and the order remains effective for a maximum of thirty days unless extended or made permanent by judicial order. Section 16 authorises a publicly accessible blacklist of non-compliant websites and platforms, with the entry removed without hearing once compliance is achieved.

Section 29 sets a graduated fine schedule. Confirm the exact bracket applicable to your facts against the statutory text before relying on a figure:

Violation category	First offence	Second offence	Third and subsequent
Deceptive, unfair or unconscionable sales acts penalised under the Consumer Act	₱20,000–₱100,000	₱100,000–₱500,000	₱500,000–₱1,000,000
Refusal to comply with a takedown order	₱20,000–₱100,000	₱100,000–₱500,000	Up to ₱1,000,000
Violations of the platform and seller duty provisions (Sections 21, 22 and 23 in part)	₱5,000–₱50,000	₱10,000–₱50,000	₱50,000–₱100,000

Section 29 also directs the DTI Secretary to increase the fine schedule every five years to maintain real value, and permanent takedown is available as a penalty where warranted. Separately, Section 28 lets a consumer claim damages before a court or DTI within two years from the time the cause of action arose, governed by the Civil Code, the Consumer Act and other existing laws.

Realistically, the most common outcomes for a compliant-but-imperfect SME are a DTI-mediated settlement or refund and a compliance order, not a maximum fine. The outcomes that escalate are ignoring a notice about dangerous or counterfeit goods, refusing a takedown order, and repeat offending — each of which moves you up a bracket or into solidary liability.

Common Mistakes

Assuming the Trustmark is the compliance requirement. It is voluntary. The mandatory duties are in Sections 21 to 23 and apply whether or not you hold a Trustmark.
Believing a grace period is still running. Section 32’s eighteen-month transitory period has lapsed on any reading; as of 6 September 2026 obligations are enforceable.
Treating social-media selling as informal. A business selling through a Facebook page is an online merchant. The platform’s lighter Section 22 duties do not reduce the seller’s Section 23 duties.
Relying on safe harbour without records. Section 26’s proviso requires evidence of good faith and reasonable effort. No verification file, no defence.
Ignoring the seven-day clock. Silence for seven calendar days hands the consumer an exhausted internal remedy and a clean route to DTI or court.
Missing the homepage identity block. Section 23 requires e-retailers to publish name, physical address and contact details on the homepage — a footer link buried three clicks deep is a weak position.
Conflating DTI compliance with BIR compliance. They are separate regimes with separate penalties.
Forgetting digital goods. Functionality, compatibility, interoperability, accessibility, continuity and security are express Section 23 obligations for digital products.

Compliance Obligations Checklist, Keyed to Actor Type

Tick the column that applies to you. “Yes” means the obligation applies directly; “Indirect” means you must impose or enable it through others.

Obligation	E-marketplace	Other digital platform	E-retailer	Online merchant
Publish business identity, address and contact details publicly	Yes	Yes	Yes (homepage)	Yes (profile and listings)
Collect and verify merchant identity documents	Yes	Indirect (account list)	N/A	N/A
Maintain an updated list of merchants or commercial accounts	Yes	Yes	N/A	N/A
Distinguish commercial from non-commercial accounts	Indirect	Yes	N/A	N/A
Listing content: name, brand, price, description, condition	Indirect (require it)	Indirect (require it)	Yes	Yes
Clear and unambiguous promotional offer conditions	Yes	Indirect	Yes	Yes
Block regulated goods sold without permits or licences	Yes	Yes	Yes	Yes
Conformity of goods, accessories, manuals in Filipino or English	N/A	N/A	Yes	Yes
Digital goods: functionality, compatibility, security, continuity	N/A	N/A	Yes	Yes
Issue invoices or receipts (paper or electronic)	Indirect	Indirect	Yes	Yes
Internal redress mechanism resolving within 7 calendar days	Yes	Yes	Yes	Yes
Act expeditiously on notice of prohibited or dangerous goods	Yes	Yes	Yes	Yes
Data protection consistent with the Data Privacy Act	Yes	Yes	Yes	Yes
Provide merchant contact details on notice where merchant has no Philippine presence	Yes	Yes	N/A	N/A
BIR registration, invoicing and filing	Yes	Yes	Yes	Yes
E-Commerce Philippine Trustmark	Voluntary	Voluntary	Voluntary	Voluntary

Frequently Asked Questions

How do online transactions work under Philippine technology law?

Six statutes and one set of court rules work together on a single online sale. RA 8792 makes the electronic contract, document and signature valid and provable. RA 11967 sets the disclosure duties by actor type and allocates liability between seller and platform. RA 7394 gives the buyer the remedy when the goods are wrong. RA 10173 governs the customer data collected on the way through. RA 10175 covers fraud and intrusion. The Rules on Electronic Evidence, with RA 8792 Secs. 11 to 13, decide what a court will accept as proof. Identify which layer your problem sits in before citing a provision.

Does the E-Commerce Act’s service-provider shield still protect an online marketplace?

Only in a narrow band. Section 30 of RA 8792 protects a service provider that merely provides access, and only where it has no actual knowledge of the unlawfulness, receives no financial benefit directly attributable to it, and does not commit or induce the act. Section 30 then expressly preserves any obligation imposed under any written law. RA 11967 is written law, so the duties it places on e-marketplaces and digital platforms survive Sec. 30 intact. A platform’s real protection is the good-faith proviso in Sec. 26 and expeditious action on notice under Sec. 27.

Is there still a grace period to comply with RA 11967?

No. Section 32 gave affected online merchants, e-retailers, e-marketplaces and digital platforms eighteen months from the effectivity of the Act to comply. RA 11967 was approved on 5 December 2023 and, under Section 38, took effect fifteen days after publication. Even measured generously from the 24 May 2024 IRR rather than from the Act’s own effectivity, the eighteen-month window closed during 2025. No transitory relief remains available.

Does the Act apply to someone selling on Facebook or TikTok?

Yes, if they are selling as a business rather than disposing of personal items. A person selling non-financial goods or services to online consumers through a third-party digital platform is an online merchant under Section 4 and owes the Section 23 duties. The platform itself owes the Section 22 duties, including enabling a distinction between commercial and non-commercial accounts. Only genuine consumer-to-consumer transactions fall outside the Act under Section 3.

Is the E-Commerce Philippine Trustmark mandatory?

No. DTI’s Trustmark guidelines describe the scheme in terms of encouraging broader adoption and voluntary compliance, and the Trustmark FAQ states that application is voluntary though strongly encouraged for businesses that want to build consumer trust. The guidelines reference Department Administrative Order 25-07. Section 11 of RA 11967 frames the Trustmark as something DTI encourages through an industry-led governance body, not a condition of trading. Approved holders are listed in the publicly searchable Online Business Database and receive a certificate with a unique security number and QR code, valid for one year.

When is a marketplace actually liable for a seller’s wrongdoing?

Three situations, under Sections 26 and 27. Subsidiary liability arises where the platform failed to exercise ordinary diligence in complying with its own obligations and that caused consumer loss; where it failed after notice to expeditiously remove IP-infringing goods or goods subject to a takedown order; or where the merchant has no Philippine legal presence and the platform failed to supply contact details despite notice. Solidary liability, meaning full exposure, arises only where the platform fails after notice to act expeditiously on goods prohibited by law, imminently injurious, unsafe or dangerous. Good-faith reliance on merchant documents is a defence, but only with evidence of reasonable verification effort.

Does RA 11967 replace the E-Commerce Act?

No. RA 8792 continues to supply the legal recognition of electronic documents, data messages and signatures; RA 11967 adds a conduct and accountability regime for internet transactions on top of it. Both appear on DTI’s current list of operative e-commerce laws. RA 7394, the Consumer Act, remains the source of the substantive unfair-practice rules that Section 29 penalises.

How long does a consumer have to sue?

Section 28 gives the consumer two years from the time the cause of action arose to file a case before a court or with DTI, with damages governed by the Civil Code, the Consumer Act and other existing laws. Before that, Section 24 requires the consumer to exhaust the business’s internal redress mechanism, which is deemed exhausted if the complaint remains unresolved after seven calendar days from filing.

Checks Made on 16 October 2026

Every load-bearing claim added or changed on this page on 16 October 2026 was checked against a primary government source. Where an earlier check on another page of this site already covered a provision, it was reused rather than re-fetched, and the table says so.

Source	What was done	Result
RA 8792, Electronic Commerce Act	Read in full today from the Bangko Sentral ng Pilipinas hosted copy; identity and 14 June 2000 approval confirmed.	Secs. 6 to 13, 16, 25 to 27, 30, 31, 33 and 42 confirmed. First reading of this Act from a government host for this site.
RA 11967, Internet Transactions Act	Reused from the 15 October 2026 reading of the enrolled Senate copy and the Supreme Court E-Library; not re-fetched.	Secs. 4, 19, 21 to 29, 32 and 38 unchanged. The E-Library copy was re-identified today for the citation link.
RA 7394, Consumer Act	Quoted from this project’s mirrored Supreme Court E-Library copy of the Act.	Arts. 100, 101 and 106 as cited, including the thirty-day correction window and the prohibition on exonerating clauses.
RA 10173 and NPC Circular No. 16-03	Reused from the 11 and 13 October 2026 readings on privacy.gov.ph; not re-fetched.	The 72-hour notification duty to the Commission and to affected data subjects.
RA 10175, Cybercrime Prevention Act	Reused from the 8 and 12 October 2026 readings of the Act; not re-fetched.	Secs. 4, 13 and 14, including the six-month minimum preservation period that binds service providers.
Rules on Electronic Evidence	Reused from the 12 October 2026 reading of A.M. No. 01-7-01-SC; named on this page, not quoted.	Named accurately as the court rules governing admissibility of electronic records.
Blocked citation sources	Searched the stored content for every blocked legal-marketing domain by name.	Three links to one blocked host were removed and replaced with the Supreme Court E-Library and Bangko Sentral copies. None remain.
Review claim in the opening	Removed the dated reviewed-by line carried at the top of the page since September 2026.	No person has reviewed this page, so the claim should never have been published. A dated sources line replaces it.
Official Gazette	Attempted on the 15 October run for the RA 11967 publication date; the page returned an error.	The exact effectivity date of RA 11967 is still unconfirmed. Nothing stated on this page depends on it.

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Sources rechecked as of: October 16, 2026

Related: for the buyer’s side of Sec. 20, see what to do when a marketplace order never arrives — the section’s reference to “loss” is what reaches an undelivered parcel, which Consumer Act Art. 100 does not.