Legal Considerations for BigCommerce Store Owners: Real-World Examples

I have seen product image alt text as the most exposed area for BigCommerce stores and the first item to be flagged by an attorney in a demand letter. Why does it get overlooked? It is due to structure: BigCommerce’s upload process does not require you to enter alt text; therefore, when many merchants import their large catalogs (without entering alt text), they often leave many or all products without alt text, which causes an immediate barrier to screen reader users when visiting every product page. When adding multiple variant images and setting default images using themes—that add the parent’s blank alt attribute to every SKU—this issue can quickly escalate into multiple problems. This is a clear example of a failure of WCAG 1.1.1 and attorneys send these types of letters out in the hundreds every year.

When conducting my last audit, I decided to start by addressing the most important and high-revenue driving product pages first. I then worked with our merchandising team to develop an alt pattern that would enable us to address them at scale. As such, I also put restrictions around how new products were added to prevent the fix from drifting away. Inside a quarter, the majority of the risk had been removed.

TKEG Expat is a corporate service firm that handles tax registration for founders who are entering foreign markets.

I think the first legal consideration for BigCommerce store owners is that the merchant is the seller of record for tax, instead of the platform. BigCommerce’s own tax documentation does say it assumes the merchant knows their tax requirements, and that its support is not qualified to give tax advice. Moreover, the automatic tax providers only calculate tax and submit documents, whereas the nexus jurisdictions are configured by the merchant inside the provider’s dashboard, so the software can not create a registration.

The EU and UK registration thresholds are not available to a seller established outside them, because the EUR 10,000 distance selling threshold applies only to a supplier established in one Member State, and a business with no UK establishment that makes any taxable supply to the UK must register regardless of turnover. Washington is the US example I use, because it sets economic nexus at more than $100,000 in gross receipts sourced to Washington in the current or prior year, counted across every channel selling to Washington customers including the merchant’s own website. Therefore, marketplace facilitator collection does not cover the merchant’s store.

Our completed VAT registrations includes France, Spain and Poland. After a registration is delivered, the filing work continues. We have completed 6 French monthly CA3 returns, 4 Spanish quarterly Modelo 303 returns and 6 UK VAT returns.

Marketing Calendar: A Complete Guide

Personalization changes what you owe the customer. My jewelry is engraved to order, and the moment a piece carries someone’s name or date it stops being standard stock — you can’t restock it, and consumer rules that let shoppers change their mind generally don’t force you to take it back. Most store owners hear that and write “no returns on custom items.” I did the opposite: I offer 30 days anyway and put a lifetime guarantee on the engraving itself. The consideration worth acting on is that the law sets your floor, not your policy. Know where the floor is, then decide deliberately how far above it you want to stand.

As an ecommerce consultant for BigCommerce for 8 years, the one legal factor ecommerce owners often do not think about is sales tax nexus in several states based on the amount of business income achieved, even if they have never registered in those states. The misconception exists that a physical presence is required to pay tax, yet economic nexus regulations require a business to register once the number of sales reaches $100,000 or 200 transactions per year in any state.

This particular case I handled involved the company, whose income had unknowingly exceeded the necessary threshold in 6 states, thus making them liable for past back taxes and additional penalties. By introducing an automated tax compliance application into their BigCommerce site, we made sure the company would be compliant going forward. In less than 3 months, the problem was solved, and the potential penalties worth up to $15,000 were avoided.

Marketing Calendar: A Complete Guide

Not a lawyer, so take this as an operator’s view: the thing that bites BigCommerce store owners is consent — specifically how you collected the email and phone number you’re marketing to.

We run two alpaca apparel brands on BigCommerce and send everything through Klaviyo. Early on the temptation is to treat every address in your customer table as a subscriber. Someone bought socks in 2019, they’re in the database, so into the flow they go. That’s not consent, and it’s also how you torch your deliverability.

What we do now: the only people in a marketing list got there through a form that says what they’re signing up for, with a timestamp and a source attached to the profile. Checkout opt-in is a real checkbox, not pre-checked, and it’s separate from the transactional email. SMS is stricter still — its own express consent, its own checkbox, its own disclosure about message frequency and rates. We don’t bundle it with the email opt-in to inflate the number.

The unglamorous part is the paper trail. Klaviyo stores the consent method and the timestamp on the profile. If somebody complains, that record is the entire defense. Migrate platforms or swap ESPs and lose it, and you’re relying on a story instead of a record.

The same principle covers the rest of the legal surface on a storefront — your return policy matching what support actually does, auto-renew language if you sell subscriptions, a privacy policy that reflects what your pixels are really collecting. None of it is exciting. All of it is cheaper to get right up front than to fix after someone files a complaint.

In ecommerce, consent isn’t a checkbox — it’s a record, and if you can’t produce it, you never had it.

The State of eCommerce in 2025!

Any health/wellness/supplement brand using BigCommerce needs to be aware of the legal risk most founders fail to consider: claims language on product pages.

FDA & FTC rules allow for supplements to support the structure or function of the body. However, if your copy says it “treats”, “cures”, or “prevents” anything, you have turned that supplement into an unapproved drug in the eyes of the FDA; and no platform migration will fix that after a warning letter has been issued.

All of our PDP’s, subscription upsell blocks and review widgets at happy V are reviewed by us for claims prior to shipping. We have learned quickly that templated recommendation and cross-sell copy is where disease claims hide – a single bundle headline written once can be stamped across categories where it should not be. Therefore, we created a shared claims matrix with our scientific advisory board: what we can say, what we cannot say, and the substantiation behind each approved phrase. User-generated claims from reviews are also moderated against this same list, because they still count as your claims.

Bake the review step into your publish workflow, not your legal audit. Any retroactive cleanup costs more than the extra day upfront.

Marketing Calendar: A Complete Guide

I’m not a lawyer, so I’ll flag this as the practical consideration we push every BigCommerce client toward rather than legal advice: website accessibility. We had a client get a demand letter over ADA accessibility, missing alt text on product images and no keyboard navigation on the checkout flow, before we had ever touched her site.

It cost her real money to settle, and more time than the settlement itself to retrofit the theme afterward. Since then, every new BigCommerce build we hand off gets run through an accessibility checker (we use WAVE) before launch, and we tell clients explicitly to loop in an attorney to review their site’s actual exposure, because the legal standard shifts by state and by court.

The pattern I’ve seen: stores that get targeted are almost always ones with a lot of traffic and an outdated theme, not small new stores. If a BigCommerce owner has been live for a couple of years on the same theme, that’s worth a full accessibility review, not a quick glance.

The most critical legal risk for BigCommerce store owners is the technical failure to suppress data collection until explicit consent is granted, as the presence of a cookie banner does not guarantee compliance. Many merchants install a privacy app and assume they are protected, yet marketing pixels and analytics scripts often fire the moment a page loads.

In managing global e-commerce delivery, I have found that third-party apps frequently leak data by operating outside the store’s primary privacy settings. To solve this, we implement a centralized Consent Management Platform integrated directly with the BigCommerce Stencil framework and Script Manager. This involves auditing the entire tracking architecture and mapping every script—from social media pixels to heatmaps—to specific consent categories so that no data is transmitted until the user provides an affirmative opt-in.

We recently refactored a client’s entire architecture because their tracking tools were bypassing the consent hierarchy entirely, creating a massive liability. Compliance is not a static setting but a continuous engineering requirement; a single new marketing tool can render a compliant store non-compliant. The technical burden of proof is shifting toward the merchant, making privacy-by-design a fundamental business necessity rather than an optional feature.