Launching an online store takes a weekend. Download a theme, add some products, copy a refund policy from a competitor’s site, and the orders can start. Nothing during that process warns you that Ontario has specific rules on what must appear before the customer clicks “buy,” or that some statements in that borrowed policy may be unenforceable or even illegal.
Most of these rules are easy to follow once you know they exist. The trouble usually comes from not knowing, then discovering it when a customer asks for a refund months after a sale, or when a platform or regulator asks questions about your marketing emails.
This article gives general information about Ontario and federal rules for online sellers, and it isn’t legal advice. Consumer law is under active revision in Ontario: the Consumer Protection Act, 2023 has passed but takes effect only when proclaimed, and it would replace the 2002 Act described here. Check which rules apply when you read this.
When the Internet Agreement Rules Apply
Under the Consumer Protection Act, 2002 and its regulation, O. Reg. 17/05, special rules apply to an internet agreement where the total payable by a consumer is over $50 and the consumer or the supplier is in Ontario when the transaction occurs. A Brampton seller is therefore likely to be caught on most sales, and so is an out-of-province seller selling to Ontario consumers.
A “consumer” here means an individual acting for personal, family or household purposes. Sales to businesses fall outside these provisions. If you sell to both, your terms need to be able to handle that.
What You Must Disclose Before Purchase
Before a customer enters an internet agreement, the supplier has to disclose prescribed information. Generally that includes:
- Your name, and any other name you do business under
- Your telephone number, address and, where applicable, your email and fax
- A fair and accurate description of the goods or services, with technical requirements where relevant
- An itemized list of the price, with shipping, handling, taxes and any other charges
- Total amount payable, the currency and terms of payment
- Delivery date and, for services, start date
- Your cancellation, return, exchange and refund policies
The consumer must also have an express opportunity to accept or decline the agreement and to correct errors immediately before entering it, and the disclosure has to be clear, prominent and accessible so it can be retained and printed. A checkout page with a final review screen handles this much more safely than a one-click purchase.
You also need to give a written copy of the agreement within 15 days of the sale, typically in a detailed order confirmation email. It should contain everything above, plus the customer’s name and the date of the agreement. A plain “thanks for your order” message won’t be sufficient.
What Happens if You Get It Wrong
The consequences give these rules their force. A consumer may cancel an internet agreement until seven days after receiving a copy of it if the supplier didn’t make the required disclosure or didn’t provide the required opportunity to accept or decline and correct errors. If the supplier fails to deliver the required copy within 15 days, or the copy lacks the required information, the consumer may cancel within 30 days from the date of the agreement.
Delivery matters too. If you promised delivery on a stated date and fail to deliver within 30 days of it, or within 30 days of the agreement if no date was given, the consumer may be able to cancel, unless the consumer accepted the late delivery.
After a valid cancellation, the supplier generally has 15 days to refund. The consumer generally must return the goods within 15 days, in the manner the rules allow.
There’s a credit-card angle as well. Consumers who properly cancel and don’t receive their refund may be able to ask their card issuer to reverse the charge. Keep that in mind when you are handling disputes, along with your processor’s own rules.
Terms That Won’t Protect You
Plenty of template terms make promises the law won’t honour against an Ontario consumer.
“All sales final.” A no-refund store policy is generally allowed for change-of-mind returns, as Ontario doesn’t impose a general right to return a product you simply don’t like. Yet that policy can’t remove statutory cancellation rights or the protections for defective or misdescribed goods. Say clearly what your policy is, and don’t imply that the customer has no rights at all.
Warranty disclaimers. Section 9 of the Consumer Protection Act, 2002 deems certain implied conditions and warranties under the Sale of Goods Act to apply to consumer goods, and any attempt to negate them is void. “Sold as is” doesn’t work the way sellers often assume, particularly for new goods.
Mandatory arbitration and class action waivers. Section 7 of the Act gives consumers access to the courts, including class proceedings, despite any term in the agreement. An arbitration clause copied from a U.S. website may therefore be ineffective for Ontario consumers.
“These terms are governed by Delaware law.” A clause choosing the law of somewhere else generally won’t take away Ontario consumer rights. Those rights apply despite an agreement to the contrary.
Waivers in general. The Act’s protections apply despite any agreement or waiver to the contrary. Stuffing more language into your terms won’t change this.
Gift cards are another detail: Ontario’s rules generally prohibit expiry dates on most gift cards, with limited exceptions, along with restricting certain fees. Make sure your platform’s default settings don’t conflict with this.
Pricing and Advertising
The federal Competition Act prohibits false or misleading representations to promote a product or business interest. For an online shop, the areas to watch are these.
Drip pricing. Advertising a price that can’t be obtained because mandatory fixed fees are added at checkout is expressly covered by sections 52(1.3) and 74.01(1.1) of the Act, unless the additional charges are imposed by a government, such as sales tax. A low headline price followed by a mandatory “processing fee” on the final screen is exactly what those rules target. Show a price the customer can actually pay.
Fake sales. “Regular price” and “50% off” claims have rules of their own, based on genuine price history and sales volumes.
Reviews and endorsements. Reviews posted by friends or staff, or undisclosed payments for endorsements, may mislead. Canadian regulators have paid attention to this.
Environmental claims and “Made in Canada.” Claims such as “eco-friendly,” or claims about origin, should be backed by proper evidence.
Ontario’s own Consumer Protection Act also prohibits unfair practices, including false, misleading or deceptive representations. A consumer may be able to rescind an agreement within one year, and in some situations seek additional damages.
Email and Text Marketing
Canada’s Anti-Spam Legislation (CASL) is one of the most important rules to learn before you start sending promotions. Commercial electronic messages generally require consent, must identify the sender and must contain a working unsubscribe.
Consent can be express, as when a person ticks an unchecked box, and it doesn’t expire unless the person withdraws it. Consent can also be implied by an existing business relationship: generally two years after a purchase, and six months after an inquiry. Abandoned carts do not count as purchases. Under CASL, it’s the sender who bears the burden of proving consent, so you should keep records of when and how each address was collected.
Pre-checked boxes aren’t a safe way to get express consent. Buying a mailing list isn’t either. Penalties can be substantial, although they are aimed mostly at serious conduct. A clean list also tends to perform better.
Privacy
Businesses collecting personal information in commercial activity in Ontario are generally subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). In practice, that means knowing what you collect, getting meaningful consent, using data only for stated purposes, keeping it secure and letting people access their information.
Your privacy policy should accurately describe what your site actually does. It should cover analytics, advertising pixels, payment processors, shipping partners and any servers outside Canada. A policy copied from another shop may be untrue for yours.
PIPEDA also requires organizations to report to the Privacy Commissioner, and notify affected individuals, when a breach creates a real risk of significant harm, and to keep breach records. Your privacy obligations are worth examining before an incident and not after. Don’t store card numbers yourself when a compliant processor can do that.
Accessibility, Tax and Business Basics
The Accessibility for Ontarians with Disabilities Act imposes website rules on larger private organizations. Those with 50 or more employees in Ontario must have public websites and web content meet WCAG 2.0 Level AA, with some exceptions. Many small stores fall below that threshold, though accessible design still helps sales and reduces complaints, including potential human rights concerns. If your business is growing, include this in your plans.
Tax comes next. If your sales pass the $30,000 small supplier threshold for a period of four consecutive calendar quarters, or a single quarter, you generally must register for and collect GST/HST, with rules that vary according to where customers are. Keep sale and shipping records.
Be clear on who the seller is. If you are trading under a name other than your own or your corporation’s, the Business Names Act generally requires registration, and the legal entity should be disclosed. Our business formation page outlines those decisions, including whether to incorporate before you start selling. Your brand needs separate attention, and a domain doesn’t give you trademark rights.
Selling into the United States or Europe brings its own consumer, tax and privacy rules. Don’t assume Ontario compliance solves everything.
Making Your Terms Enforceable
Terms are only helpful if they’re part of the deal. Courts look at whether the customer had reasonable notice and showed agreement. A link buried in a website footer is much weaker than an active step at checkout, where the customer clicks a box or a button next to clear wording and a link. Save a dated version of your terms each time you change them, so you can prove what applied to a given order.
Your terms should be readable, tailored and consistent with what your checkout, confirmation emails and customer service staff actually say. Address items such as order acceptance, pricing errors, shipping risk, returns, limitation of liability with appropriate consumer carve-outs, intellectual property and how the terms can change.
To test all of this, set aside a few hours on a weekend and go through your site as a customer would. Can you see the seller’s legal name and contact details? Is the full price visible up front? Is there a final review and correction step? Does the confirmation email have all the required details? Does your email signup have an unticked box? Does your privacy policy match the tools you use? Do your terms contain any clauses copied from another country?
Our contracts page describes help with website terms and related agreements, and it is usually a modest job compared to a chargeback dispute or regulator’s inquiry. Fix what you find and date your changes. An online store that tells customers the truth up front generally spends less of its time arguing with them afterward.