Online Platforms and Consumer Protection in the Philippines: What to Do Now

1Enforcement has replaced transition

For most of 2024 and the first half of 2025, Philippine online sellers and platforms lived under a grace period. That period is over. The Internet Transactions Act of 2023 (Republic Act No. 11967) gave covered businesses eighteen months from its effectivity to comply, and the Department of Trade and Industry (DTI) announced that the transitory window closed on 20 June 2025, after which the law's liability rules became fully enforceable. Since then, the DTI's E-Commerce Bureau has been building the machinery the statute promised: a searchable Online Business Database, an Online Dispute Resolution system, and the E-Commerce Philippine Trustmark, all of which were consolidated into a single One DTI Portal launched on 26 March 2026.

At the same time, the policy conversation has widened. The Anti-Financial Account Scamming Act (RA 12010) handed the Bangko Sentral ng Pilipinas (BSP) new tools against money mules and social-engineering fraud, with a hard upgrade deadline for banks and e-wallets that passed on 25 June 2026. Congress is debating platform-accountability measures aimed at minors' access and false information. For a marketplace operator, a brand with its own web store, or a seller running a business through social-media live-selling, the question is no longer whether these rules apply but how to evidence compliance when a complaint or a DTI notice arrives.

This article maps the current state of Philippine government policy on online platforms, digital commerce and consumer protection as of 29 October 2026, distinguishing enacted law, implementing rules, department orders and pending bills, and closes with a practical checklist for marketplaces and social-commerce sellers.

• RA 11967 has been fully enforceable since 20 June 2025; the DTI Secretary can issue subpoenas, compliance orders, ex parte takedown orders and a public blacklist.
• Liability runs on a ladder: merchants are primarily liable, platforms are subsidiarily liable for diligence failures, and solidarily liable if they ignore notices about unsafe or prohibited goods.
• The E-Commerce Philippine Trustmark remains voluntary until 31 December 2026 under the DTI's 22 December 2025 announcement; the agency said it would review the policy by year-end.
• The Online Business Database, Online Dispute Resolution system and Trustmark now sit on the One DTI Portal launched in March 2026.
• Platform-accountability bills (SB 2424 on minors, the House's anti-false-information bill) are not yet law and should be tracked, not assumed.

2The legal architecture: statute, joint rules and department orders

Philippine e-commerce regulation now rests on three layers that carry different legal weight. Understanding which layer a requirement comes from determines how firmly it binds and how easily it can change.

Enacted law. RA 11967 was signed by President Ferdinand R. Marcos Jr. on 5 December 2023 and, by its own terms, took effect fifteen days after publication. It created the E-Commerce Bureau within the DTI, mandated the Online Business Database, encouraged an industry-supported Trustmark, defined the duties of e-marketplaces, digital platforms, e-retailers and online merchants, set a liability framework, and gave the DTI Secretary quasi-judicial enforcement powers. Its Section 32 granted the eighteen-month transitory period.

Implementing rules. The IRR was issued as Joint Administrative Order No. 24-03, Series of 2024, signed on 24 May 2024 by the DTI together with the Department of Information and Communications Technology, the Department of Agriculture, the Department of Health, the BSP and the National Privacy Commission, according to the DTI's enforcement announcement. The joint signature matters: it signals that food, medicine, payments and personal-data questions arising in online sales are meant to be handled through inter-agency referral rather than by the DTI alone. A Quisumbing Torres summary of the IRR notes that only the DTI Secretary may issue summons, subpoenas, compliance, takedown and blacklist orders, with the Bureau and other agencies limited to recommending them.

Department administrative orders. Beneath the IRR sit DTI-level orders that can be issued, amended or deferred quickly. The clearest example is Department Administrative Order No. 25-12, reported as issued on 4 September 2025, which sought to make Trustmark registration mandatory. Within six weeks it had been walked back to a voluntary scheme, and the voluntary period was later extended through the end of 2026. That episode is a useful reminder that DTI orders are policy instruments that respond to stakeholder pressure, whereas the statute's disclosure and liability provisions do not move.

3Who is covered, including sellers without a Philippine entity

The Act applies to business-to-business and business-to-consumer internet transactions within the DTI's mandate where one party is in the Philippines, or where a digital platform, e-retailer or online merchant "avails of the Philippine market" and has minimum contacts here. Consumer-to-consumer sales and purely offline transactions are excluded. Online media content is excluded as well, but the IRR treats live-selling as advertising that falls within scope, as the Quisumbing Torres note explains.

The IRR's definitions reach further than many foreign sellers expect. Availment of the Philippine market includes advertising directed at the Philippines, soliciting or receiving orders, payments or deliveries here, contracting local fulfilment partners, offering local customer support, or procuring Philippine telecommunications or infrastructure services. Minimum contacts exist wherever Philippine users can access a platform and exchange information, goods or services, regardless of the user's citizenship. A cross-border seller shipping into Metro Manila through a marketplace is therefore within the DTI's regulatory jurisdiction even without a registered local company.

Four regulated roles

The statute distinguishes roles rather than company types, and a single business can occupy more than one.

• E-marketplace: a platform that oversees the consummation of transactions between merchants and consumers. Section 21 of RA 11967 requires it to collect each merchant's name, government ID or business registration, address, contact details and any relevant professional registration before listing, keep and verify a merchant list, bar regulated goods that lack permits, protect personal data and operate a redress mechanism.
• Digital platform: a platform that connects parties but does not oversee consummation. Section 22 imposes lighter duties, including distinguishing commercial accounts and providing required merchant and product information.
• E-retailer: a business selling through its own website or app. Section 23 requires its business identity, address and contact details on the homepage, a complaint mechanism and the issuance of receipts.
• Online merchant: any seller using a marketplace, platform or social-media account for commerce, bound by the same disclosure, delivery and quality standards.

A seller running a Facebook page with live-selling sessions and payment through an e-wallet is an online merchant. A brand with a Shopify store is an e-retailer. A company doing both must meet both sets of obligations. The classification drives everything from disclosure duties to where liability lands when a buyer is harmed.

4Disclosure, delivery and returns: what buyers can now demand

The most visible compliance changes are on the listing page. Section 23 of the Act requires every e-retailer and online merchant to display prices in the manner the Consumer Act prescribes, to state the name and brand, description and condition of goods, and to deliver items that match the listing in type, quantity, quality and condition. Manuals and accessories must be provided in Filipino and/or English. Marketplaces must require these core product details from their merchants and must give consumers a working way to reach the seller.

Sections 19 and 20 then define the consumer's remedies. For defective goods, loss not caused by the buyer, or breach of warranty, the consumer may choose repair, replacement, refund or other remedies under the Consumer Act. When a refund or replacement is chosen, the merchant recovers the original item at no cost to the buyer within a reasonable period. If a refund has been paid but the buyer's own fault prevents the return, the buyer must reimburse the refund, subject to a proportionate reduction where appropriate.

The Act also protects sellers from arbitrary cancellation. Once an order is paid, perishable, already handed to the delivery provider or in transit, the consumer generally cannot cancel unless they authorise payment to the seller, reimburse delivery costs, pay a cancellation fee or reach an agreement with the merchant. Platforms that have historically allowed one-click cancellation at any stage have had to redesign their flows, and sellers have a statutory basis to resist chargeback-style abuse.

Large marketplaces adjusted their seller policies around the June 2025 enforcement date, tightening prohibited-item lists and permit requirements for regulated categories. Smaller platforms and independent stores should expect the DTI to measure them against the same standard.

5The liability ladder: primary, subsidiary and solidary

The Act's most consequential innovation is its allocation of civil and administrative liability across the supply chain. Sections 25 to 27 establish three tiers.

1. Primary liability (Section 25). The e-retailer or online merchant is primarily liable to indemnify the consumer for harm arising from the transaction. This is the default position and does not depend on fault by any platform.
2. Subsidiary liability (Section 26). An e-marketplace or digital platform becomes subsidiarily liable, meaning it answers when the merchant cannot, if it failed its Section 21 or 22 duties, failed to act promptly on notice of infringing goods or a takedown order, or failed to disclose the contact details of a merchant with no Philippine presence after notice. Liability is capped at the consumer's direct damages, and good-faith reliance on merchant documents offers a defence.
3. Solidary liability (Section 27). A platform becomes solidarily liable with the merchant, so the consumer may recover the whole loss from either, if after notice it fails to promptly remove goods or services that are prohibited, imminently injurious, unsafe or dangerous.

The practical lesson for platforms is that notice handling is the hinge. A platform that verifies merchant identity at onboarding, keeps an audit trail of takedown notices and acts on them within documented service levels can usually keep its exposure at the subsidiary tier or avoid it altogether. A platform with no notice intake process, or one that lets flagged listings linger, risks solidary liability for the full value of consumer harm. The DTI itself summarised the rule in June 2025: platforms can be held liable alongside sellers if they fail to act on illicit activity on their sites.

6The E-Commerce Bureau's toolkit: database, Trustmark, dispute resolution and sanctions

The E-Commerce Bureau was created under Sections 7 to 9 of the Act to formulate policy, drive registration, investigate violations and coordinate with other agencies. Its instruments are now operational, though the Trustmark remains in flux.

Online Business Database

Section 10 required a database of online businesses, accessible to government and consumers, within one year of effectivity. The IRR obliges all covered platforms, e-marketplaces, e-retailers and merchants to submit required information once the database is established. The database is now one of the services on the One DTI Portal launched on 26 March 2026, according to BusinessWorld. The portal also hosts the Online Dispute Resolution System required by Section 17, the Consumer Complaints Assistance and Resolution System, and the Trustmark application. Entering false or misleading information in the database is itself a punishable act.

The Trustmark saga

Section 11 merely encourages a Trustmark that may be run by an industry-led body. The DTI's attempt to convert it into a registration requirement produced the most contested e-commerce policy episode of 2025.

1. 2025-07-07
   Trustmark launched as a voluntary digital badge for platforms and merchants that follow fair e-commerce practices.
2. 2025-09-04
   DAO 25-12 reported, making registration with the E-Commerce Bureau mandatory with a 30 September deadline; the DTI cited more than 13,000 online-transaction complaints logged between January and August 2025.
3. 2025-09-19
   Deadline moved to 31 December 2025; fee structure disclosed as a ₱1,000 registration fee plus ₱100 web administration fee and ₱30 documentary stamp tax, with reductions for smaller enterprises.
4. 2025-10-15
   Mandatory requirement deferred. Trade Secretary Cristina Roque announced at a town hall that the Trustmark would stay voluntary through year-end after sellers called it an added burden.
5. 2025-12-22
   Voluntary period extended to 31 December 2026, with the DTI reporting 18,405 applications and promising a review by end-2026.
6. 2026-03-26
   One DTI Portal launched; E-Commerce Bureau Director Eryl Royce R. Nagtalon put registered Trustmarks at around 4,000.

The DTI framed the October 2025 reversal as a response to stakeholder feedback, saying it wanted the badge to be more “useful, fair, and helpful for both businesses and consumers”, while stressing that all existing e-commerce laws continued to be strictly enforced. Secretary Roque later told reporters the scheme was “voluntary until Dec. 31, 2026”. The gap between the 18,405 applications reported in December 2025 and the roughly 4,000 registrations cited in March 2026 appears to reflect the difference between applications filed and badges issued, but the DTI has not published a reconciliation.

• 20 Jun 2025
  End of the 18-month transitory period under RA 11967
• 13,000+
  Online-transaction complaints logged by the DTI, January to August 2025
• ₱1,130
  Full Trustmark registration cost reported for larger enterprises
• 31 Dec 2026
  Current end of the voluntary Trustmark period

Enforcement powers and fines

Sections 13 to 16 give the DTI Secretary the power to issue subpoenas, compliance orders, ex parte takedown orders and a public blacklist. Takedown orders may issue after investigation against prohibited goods, goods subject to cease-and-desist orders, reposted listings and threats to safety or finances; the affected party may be heard within 48 hours, and orders last up to 30 days unless extended or made permanent by a court. The blacklist covers businesses that fail to comply with a compliance order or are subject to a takedown order, and entries are removed without hearing once the violation is corrected.

Section 29 sets administrative fines by offence and repetition. Deceptive or unfair online sales practices attract ₱20,000 to ₱100,000 for a first offence, ₱100,000 to ₱500,000 for a second and up to ₱1,000,000 thereafter; refusing a takedown order follows a similar ladder. Specified platform and merchant violations start at ₱5,000. The DTI has summarised the overall range as ₱5,000 to ₱1 million depending on the violation and the value involved, and the Secretary may add takedown as a penalty. Fines are without prejudice to civil and criminal liability.

7Scams, payments and the wider policy mix: BSP, SEC and pending bills

Consumer protection in digital commerce does not stop at the DTI. Three adjacent developments shape what platforms and sellers face in 2026.

Anti-Financial Account Scamming Act

Republic Act No. 12010, approved on 20 July 2024, criminalises money muling (lending, selling or renting a financial account to move illicit proceeds), social engineering (obtaining sensitive identifying information by deception) and, when committed by organised groups or against multiple victims, economic sabotage. It authorises the BSP to inquire into financial accounts suspected of involvement and allows institutions to temporarily hold disputed funds for up to 30 days. Its implementing rules required BSP-supervised institutions to upgrade fraud-management systems and limit SMS and email one-time passwords by 25 June 2026. By July 2026 the PNP had filed more than 500 AFASA cases, and the BSP's general counsel warned that non-compliant banks would be ordered to reimburse defrauded customers. For e-commerce, the practical effect is that payment partners now demand more from merchants on identity verification and transaction monitoring, and that scam proceeds routed through seller accounts can be frozen. Our analysis of SIM-swap fraud liability covers the allocation of loss between banks and telcos in detail.

Regulatory boundaries

The DTI has been explicit that its authority under the ITA is ancillary to the primary jurisdiction of other regulators over specific goods or services. Investment solicitations dressed up as online "products" remain a Securities and Exchange Commission matter under the Securities Regulation Code; payment and e-wallet conduct sits with the BSP; personal-data handling with the National Privacy Commission. The joint signature of the IRR by six agencies is meant to make referral routine. In practice, a complaint about an online seller may be split across agencies, and a business should expect to deal with more than one.

Platform-accountability bills

Two measures were moving through Congress as of the research date. On 8 October 2026 the Senate approved on third reading Senate Bill No. 2424, the SMART KIDS Act, sponsored by Senator Robinhood Padilla, by a vote of 16 to 1. It would require "high-risk" digital services to adopt age-assurance mechanisms, bar under-18 accounts and face fines of ₱5 million to ₱20 million per violation plus ₱100,000 per day of continued non-compliance, with the DICT as implementing agency, as Newsbytes reported. Separately, the House of Representatives has been advancing a Digital Media Anti-False Information Act that would require platforms to maintain a Philippine legal entity, coordinate takedowns with the DICT and submit to audits, with fines of ₱1 million to ₱10 million and, for designated very large platforms, up to 6 percent of annual gross revenue; Human Rights Watch criticised the bill in June 2026 as vague and open to abuse. Neither bill is law. Both would, if enacted, add platform-level obligations that sit on top of the ITA rather than replace it, and both should be confirmed against the official Senate and House records before any compliance planning relies on them.

8A compliance checklist for marketplaces and social-commerce sellers

The following items translate the statute and IRR into operational controls. They are not exhaustive and should be adapted to the business's role and product categories.

For e-marketplaces and digital platforms

• Onboarding file for every merchant: name, government ID or SEC/DTI registration, address, contact details, BIR Certificate of Registration and any professional licence, with periodic re-verification.
• Written notice-and-takedown procedure with intake channel, triage categories (prohibited, unsafe, infringing, deceptive), service levels and an immutable log of actions taken.
• Category gating that blocks regulated goods (medicines, food, alcohol, nicotine products) unless the merchant uploads the relevant permit.
• Internal redress mechanism that acknowledges complaints, tracks the seven-calendar-day exhaustion period and preserves evidence for DTI or ODR proceedings.
• Submission of required platform and merchant information to the Online Business Database, and a decision, documented at board or management level, on Trustmark participation before 31 December 2026.
• Privacy programme covering merchant and buyer data, with NPC registration where thresholds are met and breach-response procedures.
• Payment-partner due diligence aligned with AFASA expectations: identity verification, transaction monitoring and a protocol for responding to fund-hold requests.

For e-retailers and social-commerce sellers

• Business registration in order: DTI business name or SEC registration, BIR registration and receipts, and local permits. Sole proprietors can start with our guide to BNRS registration.
• Homepage or profile disclosure of legal name, address and contact details; every listing stating price, brand, description and condition.
• Published returns, refund and cancellation terms that track Sections 19 and 20, including the reasonable return period and the limited grounds for post-payment cancellation.
• Complaint mechanism with a response within seven calendar days, and records of every live-selling session's offers, prices and promotions.
• Permits for any regulated category sold, kept current and available to the platform and the DTI on request.
• Monitoring of DTI issuances, since department orders on the Trustmark and codes of conduct under Section 18 can change with little notice.

Businesses facing a DTI notice, a takedown order, a blacklist entry or a liability claim from a consumer should treat the first seven days as decisive, both because the internal redress window runs and because the 48-hour hearing opportunity on a takedown order is short. Abanto Law Firm's corporate law practice advises platforms, brands and sellers on ITA compliance programmes, merchant onboarding frameworks, response to DTI enforcement and the interaction with payments, privacy and cybercrime rules; to discuss a specific situation, contact the firm.

9Frequently asked questions