The legal basics of running an online store

Selling online turns a handshake business into a paper business. Every promise you make now lives in the text on your site, and a handful of federal and New York rules decide what that text has to say. Here is what actually comes up for a kosher grocery, a butcher, a caterer, or a seforim store.

The documents your store needs

Terms of sale

This is the contract with the buyer. It should cover who you are (legal name, address, phone, email — not a contact form alone), when the order is actually accepted, how prices are set including anything sold by weight, delivery areas and windows, substitutions, cancellations, and limits on your liability.

Two clauses earn their keep. Say that checkout is an acknowledgment and the sale is final only when you accept and charge it, so you can cancel cleanly when an item is out of stock. And add a pricing-error clause: if a $189 case of wine posts as $18.90, a term letting you cancel and refund obvious errors usually ends the argument.

The refund policy

No general federal law forces an online retailer to accept returns. The FTC's Cooling-Off Rule — the three-day cancellation right most people have heard of — is about door-to-door and off-premises selling: it covers sales of $25 or more made at the buyer's home or workplace, and (since a 2015 amendment) $130 or more at a seller's temporary location such as a hotel room or rented hall. It does not apply to internet orders. The terms are largely yours to write — though whatever you write, you are held to.

That freedom is why silence hurts. A stated policy the customer saw before paying is generally enforceable as part of the contract, and it is the most useful document you can produce in a card dispute. With no policy, the gap gets filled by whatever the customer assumed and by the issuer's default sympathy for the cardholder.

New York makes this concrete. General Business Law § 218-a has long required retail stores to post their refund policy conspicuously, and a 2025 amendment extended Article 12-B expressly to online retailers as of August 7, 2025 — so for a New York store this is no longer an open question. Online, the policy has to be displayed or reachable by hyperlink either near the item itself or before you request billing information, and it has to state whether you give refunds and on what conditions: how you treat "sale" and "as is" merchandise, purchases with no proof of purchase, any time limit, whether the refund is cash or credit only, and any restocking fee and its amount. Post nothing conforming and the statutory default fills the gap — the buyer can return unused, undamaged merchandise within 30 days with proof of purchase, taking a refund or a credit at their option. Other states set this up differently, so the habit that travels is simply: post the policy, and write it around reality:

• Perishables (meat, fish, dairy, produce, cooked food) are not returnable, but report a quality problem within 24 hours with a photo and we refund or replace.
• Sealed shelf-stable groceries: returnable in original condition within 14 days.
• Seforim: returnable within 30 days if unused and unmarked; personalized or custom-bound items are final sale.
• Catering deposits: fully refundable until a stated date, partially after, non-refundable inside the last week — with the actual dates written out.

Then make it stick. Courts generally enforce a checkbox or button with the terms linked right beside it ("clickwrap"), and frequently decline to enforce a footer link nobody had to interact with ("browsewrap"). The result turns on the facts of the screen — whether a reasonable customer would have noticed the terms and understood that clicking meant agreeing — which is why that one screen is doing legal work. Put the line immediately above Place Order, and keep a dated copy of every version so you can prove what it said the day the order came in.

Shipping timeframes: the rule most stores have never heard of

The FTC's Mail, Internet, or Telephone Order Merchandise Rule (16 CFR Part 435, the "30-Day Rule") applies to merchandise ordered online, with a short list of carve-outs — serial-delivery subscriptions after the first shipment, seeds and growing plants, C.O.D. orders, and prenotification negative-option plans. For an ordinary store it applies. It requires three things:

1. A reasonable basis for your promise. When you write "ships in 2–3 days," you must genuinely expect to meet it. With no stated timeframe, the default is 30 days from a properly completed order (50 if the customer is applying for credit to pay).
2. A delay notice when you cannot make it. Notify the buyer promptly, give a revised date, and offer cancellation with a full refund. If the new date is 30 days or less past the original, you may say that hearing nothing back means they accept the delay — but they can still cancel before shipment. If the delay is longer than 30 days, or you cannot name a date, you need their affirmative agreement; no response means you must cancel and refund.
3. Prompt refunds. Credit card orders: credited within one billing cycle. Cash, check, money order, and other methods: within seven working days. Store credit is not a substitute unless the customer chose it.

The cheap fix is automation: an email that fires when an order sits unshipped past your promised window, carrying a revised date and a one-click cancel link.

Subscriptions and standing orders

A weekly Shabbos package, a monthly cholent club, a seforim standing order — anything that charges the card again without the customer doing anything is a "negative option," and negative option billing is among the most heavily regulated corners of e-commerce. The governing federal statute is the Restore Online Shoppers' Confidence Act (ROSCA): disclose all material terms clearly and conspicuously before taking billing information, obtain express informed consent to the recurring charge, and provide a simple way to stop it.

The FTC finalized a broader Negative Option Rule in 2024 — the "click to cancel" rule — but the Eighth Circuit vacated it in July 2025 on procedural grounds, days before the compliance date for most of its provisions. That is not permission to make cancellation hard. ROSCA is untouched, the FTC still brings deception cases under Section 5, and the states have moved into the space: California's Automatic Renewal Law (Business and Professions Code § 17600 and following), and New York's automatic renewal provisions, which were broadened effective November 5, 2025 to require clear up-front disclosure, cancellation at least as easy as sign-up, and notice before a price increase. So on the same screen as the card fields, state the amount, the frequency, the first and next charge dates, and how to cancel. Email before each charge, not after. Put a working Cancel button in the customer's account.

Price transparency and checkout surprises

The FTC's Rule on Unfair or Deceptive Fees (16 CFR Part 464), effective in May 2025, is narrower than the headlines suggested: it covers live-event tickets and short-term lodging, not groceries. But Section 5 of the FTC Act's prohibition on deception reaches everyone, and the commercial consequence is worse than the legal one. A fee the customer did not see coming is the most reliable way to produce a chargeback, which costs you the sale, the goods, a processor fee, and eventually your rate.

• Card surcharges. New York's General Business Law § 518, as amended effective February 11, 2024, requires that if you charge more for card payment you clearly and conspicuously post the highest total price a card customer will pay, inclusive of the surcharge — not merely a sign reading "3% added" — and the final charge may not exceed that posted price. The surcharge itself may not exceed what your processor charges you for that card, and violations carry a penalty of up to $500 each. Separately: do not surcharge debit or prepaid cards at all — every major card network forbids it (the point is often attributed to the Durbin Amendment, which is really aimed at interchange fees; either way it is off the table); the networks also cap credit surcharges and require advance notice to them and to your processor before you begin; and a few states — Connecticut, Massachusetts, and Maine among them — bar credit card surcharges outright, though offering a cash discount instead is generally allowed.
• Delivery and service fees. Show them in the cart, not on the confirm screen. If the minimum is $75 and delivery below that costs $12, say so before the customer spends twenty minutes filling a cart.
• Items sold by weight. "Brisket, $12.99/lb, approx. 5 lb" is an estimate, not a price. Say the final charge follows actual weight, give a range, and never silently capture more than the customer approved — authorize a stated maximum and charge the lower actual figure, or ask first.
• Gift certificates. Under the federal CARD Act funds generally cannot expire for at least five years and inactivity fees are restricted. New York is stricter on both: General Business Law § 396-i sets a nine-year floor on expiration and broadly prohibits fees on gift cards. Print the terms on the card and on the page selling it.

Sales tax and selling across state lines

Before 2018 you generally collected sales tax only where you had a physical presence. The Supreme Court's decision in South Dakota v. Wayfair changed that: a state can now require collection based on economic nexus — a threshold of sales into that state. New Jersey and Pennsylvania sit around $100,000 in sales (New Jersey also counts 200 separate transactions). New York's is higher, and unusual in requiring both prongs: more than $500,000 in receipts from tangible personal property delivered into New York and more than 100 sales, measured over the immediately preceding four sales tax quarters. A Brooklyn seforim store shipping a few hundred books a year to Lakewood is nowhere near this. A store that goes viral before Pesach might be.

What is taxable differs by category, and the categories matter here:

Marketplace facilitator laws generally make Amazon or Etsy collect and remit for sales made there, but your own website is not a marketplace, so those sales are yours — and in New York, sales made through a platform still count toward your own thresholds even though the platform does the collecting. Nexus is also not only about volume: inventory stored in another state, or an employee working there, can create an obligation on its own. Practically — have the store calculate tax by address from day one rather than hard-coding one rate, and hand a report to an accountant annually. A developer builds the plumbing; a developer should not be giving tax advice.

Accessibility

The Americans with Disabilities Act (ADA) Title III covers places of public accommodation. Whether a website alone is one remains unsettled — some federal circuits read the term broadly, others require a connection to a physical location. For a grocery or caterer with a storefront that debate is largely academic, since the physical location exists, and New York's State and City Human Rights Laws are generally construed more broadly than the ADA and are routinely pleaded alongside it in the accessibility suits filed here. No federal regulation sets a technical standard for private business sites — the Justice Department's 2024 web rule adopting WCAG 2.1 Level AA binds state and local government under Title II, not your store — but that same standard is the benchmark courts, settlements, and DOJ keep pointing to, covered in the accessibility guide. Two habits matter most for a food store: never publish your ingredient list or delivery-zone chart as a photograph, and make sure Place Order is reachable without a mouse.

Card payments: let someone else carry the risk

PCI DSS — the Payment Card Industry Data Security Standard, version 4.0.1 as of this writing — is not a statute. It is a contract term imposed by the card brands through your processor; a handful of states reference it in their own laws, but for most merchants it arrives as a contract, not a regulation. It still bites: a merchant breached while non-compliant can face fines passed down by the acquiring bank, forced forensic review, and loss of card acceptance.

The burden scales with what you touch. If card data never reaches your server — because Stripe, Square, PayPal, or your processor's hosted checkout collects it in their own embedded field — you fall into the lightest self-assessment category, SAQ A, a short questionnaire rather than an audit. Eligibility depends on exactly how that field is implemented and the criteria have tightened in recent versions of the standard, so confirm it with your processor rather than assuming it. Most small stores are also Level 4 merchants — under roughly 20,000 e-commerce card transactions a year on the definition Visa uses, though each card brand sets its own and your acquirer is the one who tells you where you land. Newer versions of the standard do push some responsibility back onto you for the security of the page hosting that payment field, which is one more reason to keep stray third-party scripts off checkout.

Allergens, ingredients, and kosher certification

Federal labeling law is built around the package. The Food Allergen Labeling and Consumer Protection Act (FALCPA) requires major allergens to be declared on FDA-regulated packaged food, and the FASTER Act added sesame as the ninth major allergen effective January 1, 2023, joining milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, and soybeans. Meat and poultry products fall under USDA rather than FDA and follow a separate labeling regime, and food you package and sell in your own store can be treated differently again — worth confirming which set actually applies to you. Claims are regulated too: "gluten-free" has a specific FDA meaning — less than 20 parts per million — so using it loosely on a bakery site is a labeling violation, not a marketing choice.

The law says less about the website, and that is where owners get careless. FDA menu-labeling rules requiring calorie counts apply to chains with 20 or more locations, so a single caterer is not covered by them — though local rules can reach further down, and New York City's calorie and sodium labeling rules use a 15-location threshold. But "call us for ingredients" fails for reasons unrelated to any regulation. The customer with a nut allergy is shopping at 11pm; the mother buying for a child with celiac is choosing between you and a competitor. Nobody calls — they buy elsewhere. And if a listing implies a product is safe when it is not, you have a product-liability problem no disclaimer erases. Publish, as real selectable text on each product page: the ingredient list, a bolded allergen line, a cross-contact statement where it applies ("produced in a facility that also processes wheat and tree nuts"), and a last-updated date.

On kosher status, New York has a specific regime. After a federal appeals court struck down the state's earlier kosher-labeling law in 2002 on constitutional grounds, New York replaced it with the Kosher Law Protection Act of 2004, which does not define kosher but requires sellers of kosher food to disclose who certifies them and to register with the Department of Agriculture and Markets, which maintains a public registry. That replacement statute survived its own constitutional challenge in the Second Circuit in 2012, so it is settled law rather than an experiment. On a website: name the certifying agency on the product page, note whether an item is cholov yisroel, pas yisroel, yoshon, or bishul yisroel where relevant, and say plainly when one item carries different supervision from the rest.

Perishables and delivery windows

• State cutoffs before checkout. "Orders for Thursday delivery close Wednesday at 2pm" belongs on the product page and in the cart. Erev Shabbos and yom tov cutoffs deserve their own treatment; see the guide on Shabbos and yom tov ordering.
• Define the window honestly. A four-hour window you keep beats a one-hour window you miss.
• Say what happens if nobody is home. Left in a cooler bag at the customer's risk, returned to the store, or redelivered for a fee — pick one and have the customer accept it at checkout. Without that term an "item not received" dispute is hard to win; issuers want proof of delivery, and a photo of a bag on a porch is weak evidence.
• Have a cold-chain answer. For meat and fish, describe the packaging and how many hours it holds, and set a reporting window for quality problems. Twenty-four hours with a photo is a reasonable ask, and customers generally accept it.
• Substitutions in writing. Offer three choices at checkout — substitute freely, call me first, or do not substitute — and honor the choice. Substitution is the top source of "this is not what I ordered."

Where to start

In order: write the refund policy and delivery terms and put a checkbox beside Place Order; make sure a card number never lands on your own system; publish ingredient and allergen text on every food page; set up the automatic delay-notice email; then talk to an accountant about tax and a lawyer about the terms. The first four are about a day of work and remove most of the practical risk. The privacy policy guide covers the data side of the same question, or you can start a project and have this built in from the beginning.

The short version

• A refund policy the customer accepted at checkout is generally enforceable and is your best evidence in a card dispute. In New York, posting one online is now expressly required, and a 30-day return default applies if you do not. Silence hands the argument to the customer.
• The FTC's 30-Day Rule requires a reasonable basis for your shipping promise, a delay notice with a cancel option when you miss it, and refunds within one billing cycle for cards or seven working days otherwise.
• Recurring charges need clear disclosure before you take the card, express consent, and cancellation as easy as sign-up — ROSCA applies regardless of what happened to the click-to-cancel rule.
• Show every fee, surcharge, and weight-based estimate in the cart, and follow New York's rule on posting the total price a card customer pays.
• Let Stripe or a hosted checkout hold card numbers so you never do, and treat WCAG 2.1 Level AA as the accessibility benchmark.
• For food, publish ingredients, allergens, and the certifying agency as real text. "Call us" costs you the sale and does not limit your exposure.