Selling through online marketplaces to EU consumers offers major opportunities, but it also imposes concrete legal obligations. This practical guide explains the steps non-EU sellers should take on VAT (OSS/IOSS), marketplace liability, consumer protection, product safety (CE), customs, and GDPR to sell compliantly and sustainably.

The key connecting factor for EU law is the customer’s location in the EU, not the seller’s place of establishment. Being located outside the EU does not automatically remove VAT, product safety or data-protection obligations.

• EU rules apply based on the customer’s location .
• Non-EU sellers are not automatically exempt .
• VAT, product safety, and data rules may apply .

Is the sale B2C or B2B? Are goods imported or stored in the EU? Are you selling through a marketplace that handles fulfillment? These facts determine registration needs and reporting options.

• IOSS (Import One-Stop Shop): Designed for distance sales of imported low-value goods (≤ €150). IOSS enables VAT collection at point of sale and centralized monthly reporting for registered sellers/intermediaries.
• OSS (One-Stop Shop): Used to centralize VAT reporting and payment for intra-EU distance sales (B2C), reducing the need for multiple country registrations.

OSS and IOSS significantly reduce multiple VAT registrations but do not eliminate all compliance obligations.

• Keep transaction logs showing buyer country, VAT applied, invoice numbers, proof of delivery and shipment data.
• Check the marketplace’s Terms & Conditions: does the platform collect VAT as a “deemed supplier” or does the seller remain liable? Retain written evidence.

Under EU VAT e-commerce rules, online marketplaces (such as Amazon, eBay, and Etsy) may be treated as “deemed suppliers” in specific situations — particularly for imports from outside the EU or where the marketplace fulfils and ships the goods.

When a marketplace is classified as a deemed supplier, it generally becomes responsible for collecting and remitting VAT on the sale. However, product compliance, consumer-protection obligations, and regulatory requirements usually remain with the seller.

Before selling into the EU through any marketplace, non-EU sellers should clearly verify the following:

• Who collects VAT: Whether VAT is collected and reported by the marketplace or remains the seller’s responsibility.
• Who issues the invoice: Whether the marketplace issues VAT-compliant invoices to EU customers or whether the seller must do so.
• How returns are handled: Which party manages returns and how VAT adjustments or refunds are processed in returned transactions.

These responsibilities vary depending on the transaction structure, the seller’s location, and the marketplace’s operational model. Always confirm VAT handling, invoicing, and returns procedures in the marketplace’s terms and written documentation before launch.

• Display the final price pre-checkout (VAT, fees, shipping included).
• Publish clear seller identification (legal name, postal address, contact method).
• Provide a clear withdrawal/returns policy — typically 14 days for distance sales with narrow statutory exceptions for bespoke or perishable items.
• Implement a complaints and warranty handling process. (Note: national consumer-protection details vary between Member States.)

• Identify whether your product category requires CE marking or other conformity assessment. The manufacturer (or the party placing the product on the EU market) is responsible for ensuring compliance, preparing a technical file, and affixing the CE mark where applicable.
• If the manufacturer is outside the EU, consider appointing an EU authorized representative when required by the sectoral rules (e.g., certain medical devices, personal protective equipment).

Classify goods using correct HS codes and declare country of origin on commercial documents.

If you process personal data of people in the EU, GDPR can apply extraterritorially (Article 3). Prepare a clear privacy policy in market language(s), document your lawful bases for processing (contract, consent, legitimate interest), maintain a processing register, and implement procedures to handle data subject requests (access, correction, deletion). Consider whether you must appoint an EU representative under Article 27.

Hossam Adel Law Office