The Internet Transactions Act (RA 11967): What It Means for a Foreign-Owned Online Business

TL;DR: Republic Act No. 11967, the Internet Transactions Act of 2023, has been fully enforceable since June 20, 2025. It puts online sellers, marketplaces and platforms under the DTI’s new E-Commerce Bureau and adds disclosure, invoicing, complaint-handling and registration duties on top of your normal SEC/DTI, BIR and data privacy compliance. It does not replace incorporation, and it can reach foreign sellers who have no Philippine entity.

What RA 11967 actually is

The Internet Transactions Act (ITA) was signed on December 5, 2023. Its stated aim is to protect online consumers and merchants and to build trust in e-commerce. Most coverage treats it as a consumer-protection explainer for shoppers. If you are the one selling, the more useful reading is a rulebook that tells you what to publish, who to register with, and what happens when a buyer complains.

Three pieces matter most.

1. The E-Commerce Bureau. The Act orders DTI to create an Electronic Commerce Bureau as the lead regulator. It formulates e-commerce policy, monitors compliance, receives complaints and investigates violations.
2. The Online Business Database. The Bureau must build a database of digital platforms, e-marketplaces and online merchants doing business in the Philippines. Section 10 requires this within one year and says it should draw on existing agency databases, so consumers and government can look up who is behind an online business.
3. Duties by business model. Sections 21 to 23 assign different obligations to e-marketplaces, other digital platforms, and e-retailers and online merchants. Which bucket you sit in decides most of your compliance work.

The implementing rules and regulations (IRR) were issued as Joint Administrative Order No. 24-03 on May 24, 2024. They were signed by DTI together with the BSP, the Department of Agriculture, DICT, the Department of Health and the National Privacy Commission. The law itself gave businesses 18 months from its effectivity to comply, and that window closed on June 20, 2025.

Current status: in force, with no transition left

As of this article’s update date, October 8, 2026, the IRR are issued and the transition period has ended. DTI announced full enforcement from June 20, 2025. It said it can now issue takedown orders against illegal listings and subpoena documents during investigations. It also said platforms can be held solidarily liable with sellers when they fail to act on illicit activity.

Two cautions. First, DTI’s authority under the Act is ancillary where another agency already regulates the product. A food, drug or financial product still answers to FDA, BSP or SEC first. Second, check the E-Commerce Bureau’s current registration process directly before you rely on any summary here. The statute sets up the Online Business Database, and secondary sources describe a registration duty, but how and where a given merchant registers has been rolling out in practice. We did not find a fee schedule to quote, so confirm the current procedure and any fee with DTI.

Who the Act reaches, including foreign sellers

The ITA covers business-to-business and business-to-consumer transactions. Consumer-to-consumer transactions are excluded, and so is online media content. Non-financial goods and services are the focus.

The reach is wide. The Act applies where at least one party is situated in the Philippines, or where the digital platform, e-retailer or online merchant is availing of the Philippine market or has minimum contacts here. Law firms who reviewed the IRR (Nagashima Ohno & Tsunematsu and Cruz Marcelo among them) read this as extraterritorial. A foreign company that markets to Filipino buyers, accepts pesos or ships to Philippine addresses can be inside the Act without owning a single peso of local assets.

For a foreign founder this means the practical question is not “does the Act apply to me” but “which of three situations am I in”.

• A Philippine corporation selling online. You are a local e-retailer or online merchant. All the merchant duties apply in full.
• A foreign company selling through Lazada, Shopee, TikTok Shop or a similar marketplace. You are an online merchant. The marketplace must verify you before listing, and you must meet the merchant duties.
• A foreign company running its own storefront aimed at Philippine buyers. You are an e-retailer. You carry the homepage disclosure, invoicing and complaint duties directly, with no marketplace in between to share liability.

Obligations by business model

The table is a working summary of Sections 21 to 23 and the IRR as described by the law firms listed in the sources. Read the statute text and the JAO itself when you draft your own checklist.

Disclosures a foreign-owned seller must publish

Section 23 is concrete, and it is where most small sellers fall short.

On your website or app

Your homepage must show your corporate name, your physical address and your contact details. Contact details must include a mobile or landline number and a valid email address. A contact form alone does not satisfy this.

This sits awkwardly with how many foreign-run shops operate. If your site is hosted abroad and lists only an offshore company address, you have a disclosure that exists on paper but gives a Philippine buyer no local point of contact. A Philippine address and number for a locally registered entity is the cleaner answer. If you do not have one yet, e-commerce business registration is the first step, not the compliance footnote.

On every product offer

Whether you sell on your own site or through a marketplace, offers should clearly state the product name, brand, price, description and condition. DTI has also said it expects price and delivery conditions to be disclosed up front. Treat “total price including shipping and any fees” as the safe presentation.

On every sale

You must issue a paper or electronic invoice or receipt for all sales. This overlaps with BIR invoicing rules, and the ITA does not replace them. Your BIR-registered invoice system should be the one producing the consumer’s receipt. If you sell through a marketplace, confirm whose document the buyer actually receives and who is the legal seller of record.

Misleading advertising and what the Act adds

The ITA targets deceptive practices directly. Section 29 sets graduated fines for them, and goods that do not match their description or advertising are a core merchant liability. The Act also reinforces older consumer law. RA 7394, the Consumer Act of the Philippines, remains the source of the underlying warranty and remedy rules, and the ITA points back to it.

A point of precision, because online summaries get this wrong. Some articles say the Act imposes a cooling-off period or bans “dark patterns” by name. In the statute text we reviewed, we found neither. What the Act does provide is this.

• If goods are defective, malfunctioning or lost without the consumer’s fault, or do not conform to warranty, the consumer can pursue repair, replacement, refund or other remedies under RA 7394 and related laws.
• When the consumer takes a replacement or refund, the merchant may require return of the original goods. The return must cost the consumer nothing, and it must happen within a reasonable period unless the parties agree otherwise.

So you do not owe a blanket 7-day change-of-mind return by default. You do owe fast, fair handling of defective and not-as-described goods. If you want a change-of-mind return as a sales feature, publish it clearly, and then honor exactly what you published. A written policy you break is the easiest deceptive-practice complaint to prove.

Check any digital-product or cross-border listing separately. The IRR is reported to add accessibility and cybersecurity expectations for digital goods, which the statute text does not spell out.

Complaints: the 7-day clock

This is the rule that changes your operations most.

An aggrieved consumer must first use the internal redress mechanism of the platform, marketplace or e-retailer. That mechanism is treated as exhausted if the complaint stays unresolved after seven calendar days. After that the consumer can go to DTI or a court.

Practically, a complaint that sits in your inbox for a week becomes a regulatory file. A foreign owner who manages support from abroad, in a different time zone and language, should set a Philippine-hours response owner, a ticket log with timestamps, and a rule that every complaint gets a substantive reply inside seven calendar days. Those logs are also your best evidence if DTI later asks what you did.

What the E-Commerce Bureau and DTI can do

The enforcement toolkit is real, though it is administrative rather than criminal at the first step.

1. Investigate and subpoena. The Bureau receives complaints, investigates violations and can compel documents.
2. Issue compliance orders. DTI can order you to fix a specific practice.
3. Order takedowns. The Secretary can order removal of listings for endangered animals, illicit drugs, counterfeit goods or items that threaten public safety. A takedown order lasts up to 30 days, and it is renewable through a court order, according to the law-firm summaries.
4. Blacklist repeat violators. Non-compliant businesses can be publicly listed. You come off the list when you show compliance.
5. Impose administrative fines. Section 29 sets fines for deceptive practices at P20,000 to P100,000 for a first offense, P100,000 to P500,000 for a second, and P500,000 to P1,000,000 for a third or later. Ignoring a takedown order carries a similar escalating schedule, topping out at P1,000,000. Secondary summaries put the floor for registration-type violations at P5,000.

The practical risk for a foreign seller

The fine amounts are modest next to a growing e-commerce business, and a seller with no Philippine assets might think they are unreachable. The bigger exposure is operational.

• A marketplace that faces joint liability has every reason to delist a merchant who will not cooperate. Your Lazada or Shopee storefront is the first thing you lose.
• Payment processors and logistics partners deal with DTI-visible entities. A blacklisted name is a commercial problem even where no fine is ever collected.
• A takedown order against your own site’s Philippine-facing listings hits revenue directly.

In short, the enforcement hook for an offshore seller is its dependence on Philippine platforms, not DTI knocking on a foreign door.

How this fits with registration, tax and privacy you already owe

The ITA is an additional layer. It does not replace anything.

Foreign ownership limits also still apply to the type of business you run. Retail trade, for example, has its own capitalization and nationality rules under separate laws. The ITA is silent on that question, so structure your entity first and then apply the ITA checklist to it. A Philippine-incorporated seller with proper registrations will also find marketplace verification straightforward, because the documents the platform asks for are the ones you already hold.

A compliance checklist for the first 30 days

1. Decide your category. Merchant on a marketplace, own-site e-retailer, or platform operator. Many businesses are two of these, and each carries its own duties.
2. Confirm your legal entity and permits. Registered entity or business name, BIR registration, and local permits. Fix gaps before anything else.
3. Rewrite your homepage footer. Corporate name, physical Philippine address, mobile or landline number and a monitored email address.
4. Audit every listing. Name, brand, price, description and condition must be present and accurate. Include delivery cost in the displayed price information.
5. Align receipts with BIR invoicing. Every sale produces an invoice or receipt the buyer can keep.
6. Publish a return and refund policy. Cover defective and non-conforming goods as the Act requires, and add any change-of-mind window you choose to offer.
7. Set up the 7-day complaints workflow. One named owner, a ticket log, and a seven-calendar-day reply standard.
8. Check regulated goods. If you sell food, cosmetics, devices or supplements, secure the relevant agency approvals before listing.
9. Confirm Online Business Database registration. Ask DTI’s E-Commerce Bureau how and where your business type registers today, and what fee, if any, applies.
10. Review privacy basics. Privacy notice, consent where needed, and a contact for data requests.

Where foreign founders usually go wrong

Most problems we see are structural, not legal subtleties. A company sells to Filipino buyers from a foreign entity with no local invoicing, then discovers that marketplace verification, receipts and complaint handling all assume a Philippine presence. Others copy marketplace templates and assume the platform carries the liability. The Act says the merchant carries primary liability, and the platform is only secondarily or jointly on the hook.

The cheap fix is early. Pick the right entity, register it, and write the homepage, receipt and complaints process once. Retrofitting after a takedown notice costs more and moves slower.

This guide is general information, not legal advice on your specific facts. Book a consultation if you want a fixed-scope review of your entity and online selling setup before you launch or scale.