E-commerce marketing · Industry brief

Alibaba Group and its U.S. payment processor AUS Merchant Services agreed to pay $600 million in a non-prosecution agreement to resolve Justice Department allegations that they failed to prevent merchants from selling illegal pharmaceuticals, controlled substances, and counterfeiting equipment through Alibaba.com and AliExpress.com platforms between 2016 and 2024. The settlement, reached in July 2026 and described as the largest monetary settlement in Rhode Island's history, includes $125 million in criminal penalties and $200 million in forfeiture from Alibaba, plus $85 million in penalties and $190 million in forfeiture from AUS, along with enhanced compliance program requirements. Federal investigations documented approximately 80,000 illegal product sales with gross merchandise value exceeding $200 million, with law enforcement conducting over 40 undercover purchases, and revealed that both companies' compliance controls were inadequate—Alibaba's messaging service facilitated unlawful transactions while AUS's anti-money laundering program failed to systematically restrict merchants selling prohibited merchandise. Source: IRS Criminal Investigation, U.S. Department of Justice press release.

The Spanish Data Protection Agency (AEPD) imposed a record €33.9 million in fines during 2025, with enforcement actions increasingly targeting e-commerce platforms and websites. Internet services accounted for 15% of AEPD's highest-sanctioned areas, with six notable e-commerce enforcement decisions in 2025 including: MaxPower (€1,600 for non-consensual cookies), Amor Ideal (€600 for incomplete privacy policy), Trueba Sport (€1,200 for failing to identify data controller), Wallapop (€3,000 for ineffective cookie rejection), El Debate (€3,000 for installing non-essential cookies without consent), and Inmo-master (€1,000 for privacy policy deficiencies). The AEPD's enforcement priorities center on cookie consent mechanisms, granular user controls, complete privacy policies, and proper data controller identification—with particular scrutiny on whether "Reject All" buttons function effectively and whether consent can be easily withdrawn during browsing.

The Vietnam Competition Commission issued penalties on 2 June 2026 against a foreign-invested digital platform for failing to provide opt-out mechanisms for personal data use in advertising, failing to disclose sponsored influencer content, and including prohibited clauses in standard terms. This enforcement action followed January 2026 decisions against other major online platforms under the 2023 Law on Protection of Consumer Rights, signalling systematic regulatory focus on consumer data protection, marketing transparency, and fair contract terms. Further enforcement actions are expected from multiple Vietnamese regulators, including the Department of Cybersecurity and High-Tech Crime Prevention under new data protection frameworks, as part of broader APAC regional tightening of digital platform regulation targeting consent practices, influencer marketing disclosure, and algorithmic transparency.

The FCC released a draft Third Report and Order scheduled for a July 22 vote that would expand equipment authorization rules affecting e-commerce platforms. The order would prohibit authorization of radio frequency devices containing logic-bearing components produced by covered entities and require online marketplaces displaying such devices to show FCC ID and compliance information at the point of sale. The FCC clarified that online marketplaces engaged in consignment, warehousing, inventory management, order processing, labeling, packaging, billing or fulfillment services are subject to FCC enforcement if they market unauthorized devices. An accompanying Further Notice seeks comment on additional measures including Software Bill of Materials and Hardware Bill of Materials disclosures, bifurcating the Covered List, and potentially banning all components produced by covered entities.