Retail and e-commerce compliance

Retail and e-commerce compliance — FTC Act, state UDAP, PCI DSS, COPPA, ADA, CCPA/GDPR, age-restricted goods.

Retail compliance is consumer-protection-led — FTC Act Section 5 plus state UDAP statutes form the backbone, layered with payment, privacy, age, and accessibility rules.

Regulatory frame

Regime	Applies when	Evaluation-evidence shape
FTC Act § 5 (deceptive/unfair)	All consumer transactions	Truth-of-claims; substantiation evidence
State UDAP statutes	Each state has analog	State-specific carve-outs; documented basis
PCI DSS	Any cardholder data handling	Scope confined; tokenization preferred
COPPA	Services likely to be used by children under 13	Age-band gating; parental consent flows
CAN-SPAM, TCPA	Marketing emails / SMS / calls	Consent tracking; suppression-list match
CCPA / CPRA, state privacy laws	CA / WA / VA / CO / TX / others	DSR fulfillment; opt-out signals; retention
GDPR / UK GDPR	EU/UK customers	Lawful basis; DPA; cross-border transfer
ADA Title III	Public accommodations / digital storefronts	Accessibility scoring on outputs
State age-restricted-goods laws	Alcohol, tobacco, vape, firearms, cannabis	Age-band gating; ID-verification flows
EU Digital Services Act / Digital Markets Act	EU-active platforms above thresholds	Recommender transparency; risk reporting
FTC Endorsement Guides	Influencer / AI-generated reviews	Material-connection disclosure
MAP / pricing-parity contracts	Where MAP applies	Realizability rule on promotions

FTC Act and state UDAP

FTC Act § 5 prohibits "unfair or deceptive acts or practices in or affecting commerce." Modern enforcement focus areas:

• AI-generated product claims that aren't substantiated
• Dark patterns in checkout/cancellation flows
• Endorsement Guides apply to AI-generated reviews and influencer content
• Algorithmic personalized pricing increasingly scrutinized

Stratix evaluation evidence:

• Truth-of-claims judge against substantiation database
• Faithfulness judge for AI-generated product copy
• Dark-pattern checklist applied as deterministic rule

State UDAP

Every state has a deceptive-practices analog. Texas DTPA, California CLRA, New York GBL § 349, Massachusetts c. 93A, and others. Class-action exposure varies; some states allow trebled damages.

PCI DSS

For cardholder data:

• Stratix is not designed to be in PCI scope — do not put PAN, full track data, or CAV2/CVC2/CVV2/CID into traces
• Use tokenized references; merchant tokenization upstream
• DPA covers tokenized payment-related metadata only

COPPA

If your service is "directed to children under 13" or you have actual knowledge of children using it:

• Verifiable parental consent before data collection
• Limited data minimization
• Strict retention and deletion

Stratix evaluation evidence:

• Age-band gating as a hard rule
• Audit log of consent state at the time of trace

CAN-SPAM and TCPA

Marketing-content generation is a common AI use case. Compliance requirements:

• Consent / opt-out state must precede send
• Identification of sender; physical address present
• TCPA prior-express-written-consent rules for SMS / autodialed calls

Stratix evaluation evidence:

• Suppression-list-check rule; hard-fail any send without consent state verified

CCPA / CPRA and state privacy

CA, VA, CO, CT, UT, NV, OR, IA, IN, TN, TX, MT, FL, DE, NH, NJ, MD, MN, RI, KY, NE, NH (varying coverage 2024-2026):

• DSR rights (access, delete, correct, opt-out of sale/share)
• Sensitive personal information (SPI) handling
• Universal opt-out preference signals (GPC) recognized in CA, CO

Stratix evaluation evidence:

• DSR-routing rule on customer-service traces
• SPI-redaction scorer ≥ 99% recall in trace bodies
• Consent-state metadata propagated through traces

GDPR / UK GDPR

For EU/UK customer data:

• Lawful basis required (consent, contract, legitimate interest)
• DPIA for high-risk AI use cases
• Cross-border transfer mechanism (SCCs / UK IDTA)
• DPA with the customer

Stratix supports:

• DPA execution under Enterprise tier
• Tenant data residency options where contracted

ADA Title III

Digital storefronts as public accommodations. Litigation has been heavy on screen-reader compatibility, alt text, and structured outputs.

Stratix evaluation evidence:

• Reading-level scorer
• Alt-text generation quality judge for image-description outputs

Age-restricted goods

State-by-state, often county-level overlays:

• Alcohol: 21
• Tobacco/vape: 21 (federal floor since 2019)
• Cannabis: state-specific where legal
• Firearms: federal + state overlays

Stratix evaluation evidence:

• Hard age-gate rule before recommendation surfaces or chatbot serves info
• Fairness scorer to ensure age-gating doesn't proxy for protected class

EU DSA / DMA

For EU-active platforms above DSA thresholds (Very Large Online Platforms / Search Engines):

• Recommender system transparency
• Risk assessments (system, content)
• Independent audits

Stratix evaluation evidence:

• Recommender drift dashboards retained for audit
• Bias/fairness scorers for systemic-risk reporting

FTC Endorsement Guides

For AI-generated reviews, testimonials, or influencer-style copy:

• Material-connection disclosure required when present
• "Reviews" must be authentic; AI-generated should not impersonate real users

Stratix evaluation evidence:

• Disclosure-presence rule on any AI-generated review/testimonial output
• Authenticity judge for any user-impersonating content

Recommended setup

1. Pro tier or higher with executed DPA
2. Tenant isolation; no cardholder PAN in traces
3. SPI/PII redaction scorer at ingress
4. Hard rules: catalog freshness, age gating, refund-promise limits
5. Fairness scorers on personalized pricing and returns-fraud denial
6. DSR-routing rule on customer-service traces
7. Audit retention matching state privacy law requirements (default 4 years)
8. EU DSA-tier reporting if VLOP-classified — talk to enterprise

See also

• Retail scenarios
• Retail eval patterns
• Concept: Multi-tenancy
• Enterprise