> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-10.md). # Retail and e-commerce compliance Retail compliance is **consumer-protection-led** — FTC Act Section 5 plus state UDAP statutes form the backbone, layered with payment, privacy, age, and accessibility rules. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------------------- | ----------------------------------------------- | ------------------------------------------- | | **FTC Act § 5 (deceptive/unfair)** | All consumer transactions | Truth-of-claims; substantiation evidence | | **State UDAP statutes** | Each state has analog | State-specific carve-outs; documented basis | | **PCI DSS** | Any cardholder data handling | Scope confined; tokenization preferred | | **COPPA** | Services likely to be used by children under 13 | Age-band gating; parental consent flows | | **CAN-SPAM, TCPA** | Marketing emails / SMS / calls | Consent tracking; suppression-list match | | **CCPA / CPRA, state privacy laws** | CA / WA / VA / CO / TX / others | DSR fulfillment; opt-out signals; retention | | **GDPR / UK GDPR** | EU/UK customers | Lawful basis; DPA; cross-border transfer | | **ADA Title III** | Public accommodations / digital storefronts | Accessibility scoring on outputs | | **State age-restricted-goods laws** | Alcohol, tobacco, vape, firearms, cannabis | Age-band gating; ID-verification flows | | **EU Digital Services Act / Digital Markets Act** | EU-active platforms above thresholds | Recommender transparency; risk reporting | | **FTC Endorsement Guides** | Influencer / AI-generated reviews | Material-connection disclosure | | **MAP / pricing-parity contracts** | Where MAP applies | Realizability rule on promotions | ## FTC Act and state UDAP FTC Act § 5 prohibits "unfair or deceptive acts or practices in or affecting commerce." Modern enforcement focus areas: * AI-generated product claims that aren't substantiated * Dark patterns in checkout/cancellation flows * Endorsement Guides apply to AI-generated reviews and influencer content * Algorithmic personalized pricing increasingly scrutinized **Stratix evaluation evidence:** * Truth-of-claims judge against substantiation database * Faithfulness judge for AI-generated product copy * Dark-pattern checklist applied as deterministic rule ## State UDAP Every state has a deceptive-practices analog. Texas DTPA, California CLRA, New York GBL § 349, Massachusetts c. 93A, and others. Class-action exposure varies; some states allow trebled damages. ## PCI DSS For cardholder data: * Stratix is **not** designed to be in PCI scope — do not put PAN, full track data, or CAV2/CVC2/CVV2/CID into traces * Use tokenized references; merchant tokenization upstream * DPA covers tokenized payment-related metadata only ## COPPA If your service is "directed to children under 13" or you have actual knowledge of children using it: * Verifiable parental consent before data collection * Limited data minimization * Strict retention and deletion **Stratix evaluation evidence:** * Age-band gating as a hard rule * Audit log of consent state at the time of trace ## CAN-SPAM and TCPA Marketing-content generation is a common AI use case. Compliance requirements: * Consent / opt-out state must precede send * Identification of sender; physical address present * TCPA prior-express-written-consent rules for SMS / autodialed calls **Stratix evaluation evidence:** * Suppression-list-check rule; hard-fail any send without consent state verified ## CCPA / CPRA and state privacy CA, VA, CO, CT, UT, NV, OR, IA, IN, TN, TX, MT, FL, DE, NH, NJ, MD, MN, RI, KY, NE, NH (varying coverage 2024-2026): * DSR rights (access, delete, correct, opt-out of sale/share) * Sensitive personal information (SPI) handling * Universal opt-out preference signals (GPC) recognized in CA, CO **Stratix evaluation evidence:** * DSR-routing rule on customer-service traces * SPI-redaction scorer ≥ 99% recall in trace bodies * Consent-state metadata propagated through traces ## GDPR / UK GDPR For EU/UK customer data: * Lawful basis required (consent, contract, legitimate interest) * DPIA for high-risk AI use cases * Cross-border transfer mechanism (SCCs / UK IDTA) * DPA with the customer **Stratix supports:** * DPA execution under Enterprise tier * Tenant data residency options where contracted ## ADA Title III Digital storefronts as public accommodations. Litigation has been heavy on screen-reader compatibility, alt text, and structured outputs. **Stratix evaluation evidence:** * Reading-level scorer * Alt-text generation quality judge for image-description outputs ## Age-restricted goods State-by-state, often county-level overlays: * Alcohol: 21 * Tobacco/vape: 21 (federal floor since 2019) * Cannabis: state-specific where legal * Firearms: federal + state overlays **Stratix evaluation evidence:** * Hard age-gate rule before recommendation surfaces or chatbot serves info * Fairness scorer to ensure age-gating doesn't proxy for protected class ## EU DSA / DMA For EU-active platforms above DSA thresholds (Very Large Online Platforms / Search Engines): * Recommender system transparency * Risk assessments (system, content) * Independent audits **Stratix evaluation evidence:** * Recommender drift dashboards retained for audit * Bias/fairness scorers for systemic-risk reporting ## FTC Endorsement Guides For AI-generated reviews, testimonials, or influencer-style copy: * Material-connection disclosure required when present * "Reviews" must be authentic; AI-generated should not impersonate real users **Stratix evaluation evidence:** * Disclosure-presence rule on any AI-generated review/testimonial output * Authenticity judge for any user-impersonating content ## Recommended setup 1. Pro tier or higher with executed DPA 2. Tenant isolation; no cardholder PAN in traces 3. SPI/PII redaction scorer at ingress 4. Hard rules: catalog freshness, age gating, refund-promise limits 5. Fairness scorers on personalized pricing and returns-fraud denial 6. DSR-routing rule on customer-service traces 7. Audit retention matching state privacy law requirements (default 4 years) 8. EU DSA-tier reporting if VLOP-classified — talk to enterprise ## See also * [Retail scenarios](/more-in-this-section-2/scenarios-10.md) * [Retail eval patterns](/more-in-this-section-2/eval-patterns-10.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/retail-ecommerce.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-10.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.