> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-10.md).

# Retail and e-commerce compliance

Retail and e-commerce compliance — FTC Act, state UDAP, PCI DSS, COPPA, ADA, CCPA/GDPR, age-restricted goods.

Retail compliance is **consumer-protection-led** — FTC Act Section 5 plus state UDAP statutes form the backbone, layered with payment, privacy, age, and accessibility rules.

## Regulatory frame

| Regime                                            | Applies when                                    | Evaluation-evidence shape                   |
| ------------------------------------------------- | ----------------------------------------------- | ------------------------------------------- |
| **FTC Act § 5 (deceptive/unfair)**                | All consumer transactions                       | Truth-of-claims; substantiation evidence    |
| **State UDAP statutes**                           | Each state has analog                           | State-specific carve-outs; documented basis |
| **PCI DSS**                                       | Any cardholder data handling                    | Scope confined; tokenization preferred      |
| **COPPA**                                         | Services likely to be used by children under 13 | Age-band gating; parental consent flows     |
| **CAN-SPAM, TCPA**                                | Marketing emails / SMS / calls                  | Consent tracking; suppression-list match    |
| **CCPA / CPRA, state privacy laws**               | CA / WA / VA / CO / TX / others                 | DSR fulfillment; opt-out signals; retention |
| **GDPR / UK GDPR**                                | EU/UK customers                                 | Lawful basis; DPA; cross-border transfer    |
| **ADA Title III**                                 | Public accommodations / digital storefronts     | Accessibility scoring on outputs            |
| **State age-restricted-goods laws**               | Alcohol, tobacco, vape, firearms, cannabis      | Age-band gating; ID-verification flows      |
| **EU Digital Services Act / Digital Markets Act** | EU-active platforms above thresholds            | Recommender transparency; risk reporting    |
| **FTC Endorsement Guides**                        | Influencer / AI-generated reviews               | Material-connection disclosure              |
| **MAP / pricing-parity contracts**                | Where MAP applies                               | Realizability rule on promotions            |

## FTC Act and state UDAP

FTC Act § 5 prohibits "unfair or deceptive acts or practices in or affecting commerce." Modern enforcement focus areas:

* AI-generated product claims that aren't substantiated
* Dark patterns in checkout/cancellation flows
* Endorsement Guides apply to AI-generated reviews and influencer content
* Algorithmic personalized pricing increasingly scrutinized

**Stratix evaluation evidence:**

* Truth-of-claims judge against substantiation database
* Faithfulness judge for AI-generated product copy
* Dark-pattern checklist applied as deterministic rule

## State UDAP

Every state has a deceptive-practices analog. Texas DTPA, California CLRA, New York GBL § 349, Massachusetts c. 93A, and others. Class-action exposure varies; some states allow trebled damages.

## PCI DSS

For cardholder data:

* Stratix is **not** designed to be in PCI scope — do not put PAN, full track data, or CAV2/CVC2/CVV2/CID into traces
* Use tokenized references; merchant tokenization upstream
* DPA covers tokenized payment-related metadata only

## COPPA

If your service is "directed to children under 13" or you have actual knowledge of children using it:

* Verifiable parental consent before data collection
* Limited data minimization
* Strict retention and deletion

**Stratix evaluation evidence:**

* Age-band gating as a hard rule
* Audit log of consent state at the time of trace

## CAN-SPAM and TCPA

Marketing-content generation is a common AI use case. Compliance requirements:

* Consent / opt-out state must precede send
* Identification of sender; physical address present
* TCPA prior-express-written-consent rules for SMS / autodialed calls

**Stratix evaluation evidence:**

* Suppression-list-check rule; hard-fail any send without consent state verified

## CCPA / CPRA and state privacy

CA, VA, CO, CT, UT, NV, OR, IA, IN, TN, TX, MT, FL, DE, NH, NJ, MD, MN, RI, KY, NE, NH (varying coverage 2024-2026):

* DSR rights (access, delete, correct, opt-out of sale/share)
* Sensitive personal information (SPI) handling
* Universal opt-out preference signals (GPC) recognized in CA, CO

**Stratix evaluation evidence:**

* DSR-routing rule on customer-service traces
* SPI-redaction scorer ≥ 99% recall in trace bodies
* Consent-state metadata propagated through traces

## GDPR / UK GDPR

For EU/UK customer data:

* Lawful basis required (consent, contract, legitimate interest)
* DPIA for high-risk AI use cases
* Cross-border transfer mechanism (SCCs / UK IDTA)
* DPA with the customer

**Stratix supports:**

* DPA execution under Enterprise tier
* Tenant data residency options where contracted

## ADA Title III

Digital storefronts as public accommodations. Litigation has been heavy on screen-reader compatibility, alt text, and structured outputs.

**Stratix evaluation evidence:**

* Reading-level scorer
* Alt-text generation quality judge for image-description outputs

## Age-restricted goods

State-by-state, often county-level overlays:

* Alcohol: 21
* Tobacco/vape: 21 (federal floor since 2019)
* Cannabis: state-specific where legal
* Firearms: federal + state overlays

**Stratix evaluation evidence:**

* Hard age-gate rule before recommendation surfaces or chatbot serves info
* Fairness scorer to ensure age-gating doesn't proxy for protected class

## EU DSA / DMA

For EU-active platforms above DSA thresholds (Very Large Online Platforms / Search Engines):

* Recommender system transparency
* Risk assessments (system, content)
* Independent audits

**Stratix evaluation evidence:**

* Recommender drift dashboards retained for audit
* Bias/fairness scorers for systemic-risk reporting

## FTC Endorsement Guides

For AI-generated reviews, testimonials, or influencer-style copy:

* Material-connection disclosure required when present
* "Reviews" must be authentic; AI-generated should not impersonate real users

**Stratix evaluation evidence:**

* Disclosure-presence rule on any AI-generated review/testimonial output
* Authenticity judge for any user-impersonating content

## Recommended setup

1. Pro tier or higher with executed DPA
2. Tenant isolation; no cardholder PAN in traces
3. SPI/PII redaction scorer at ingress
4. Hard rules: catalog freshness, age gating, refund-promise limits
5. Fairness scorers on personalized pricing and returns-fraud denial
6. DSR-routing rule on customer-service traces
7. Audit retention matching state privacy law requirements (default 4 years)
8. EU DSA-tier reporting if VLOP-classified — talk to enterprise

## See also

* [Retail scenarios](/more-in-this-section-2/scenarios-10.md)
* [Retail eval patterns](/more-in-this-section-2/eval-patterns-10.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Enterprise](/4.2-industry-use-cases/retail-ecommerce.md)