Without a single US e-commerce code, compliance teams use AI agents to screen reviews and endorsements, test subscription journeys against state auto-renewal laws, check opt-out signals are honoured and flag children's data collection. Counsel and compliance keep every remediation. Federal consumer protection rules, state laws such as California's CCPA as amended by the CPRA, and PCI DSS apply.
What does e-commerce compliance look like in the US?
The US has no single e-commerce code, so compliance stitches together federal and state rules. The federal consumer protection agency polices deceptive and unfair practices nationally, including fake reviews and undisclosed endorsements, and has issued a rule targeting fake reviews and testimonials. State attorneys general enforce their own consumer laws, often more aggressively.
Subscriptions are a frequent source of trouble. Many states have automatic renewal laws requiring clear disclosure of terms, affirmative consent, and easy cancellation, in some cases online cancellation for online sign-ups. A retailer selling nationally must design to the strictest common denominator.
Privacy is a patchwork. California's CCPA as amended by the CPRA gives consumers rights to know, delete and opt out of sale or sharing of personal information, including through browser opt-out signals, and many other states have similar laws. Federal law requires verifiable parental consent before collecting personal information from children under 13 on sites directed to them or with actual knowledge. Card payments bring PCI DSS v4.0.
Where do agents help?
- Review and endorsement screening (depth 2). The agent flags suspected fake reviews, reviews from employees or paid sources without disclosure, and influencer content missing clear disclosures, and drafts actions for a moderator.
- Auto-renewal journey tests (depth 1). The agent walks each subscription journey, checks disclosures and consent capture, and tests that online cancellation works without obstacles, against a checklist built from the strictest state rules you face.
- Opt-out signal checks (depth 1). The agent visits the site with browser opt-out signals on and records whether advertising trackers still fire or data is still shared.
- Children's data review (depth 1). The agent reviews products, content and journeys that may attract children and flags data collection that would need parental consent.
- Privacy request testing (depth 2). The agent submits test access and deletion requests and checks responses arrive within required timeframes and are complete, drafting a findings report.
Opt-out signal checks are a strong first use. They test a specific, observable behaviour that regulators can check for themselves from outside. The agent's evidence is objective: trackers fired or they did not.
What stays with people?
Decisions to remove reviews, end influencer relationships or change subscription flows stay with named staff. Each has commercial consequences and legal implications.
Responses to the federal consumer protection agency, state attorneys general or the California privacy regulator stay with counsel. So do decisions on consumer refunds after a subscription finding, and on whether to notify anyone of a privacy failure.
Children's data findings go to a person immediately, because the consequences of getting it wrong are serious. This follows our position that AI compliance agents are second line, never the last word.
Which US rules apply?
There is no single federal AI law. The federal consumer protection agency enforces against deceptive and unfair practices, including fake reviews and undisclosed endorsements, and federal law protects children's personal information online. States add automatic renewal laws, consumer protection laws enforced by attorneys general, and privacy laws such as California's CCPA as amended by the CPRA. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions; most e-commerce uses will fall outside it, but check any AI that decides access to services. Card payments bring PCI DSS v4.0. Our overview of how AI agents are regulated in the United States covers the wider picture.
As shoppers start using AI agents to buy for them, disclosure and anti-deception duties apply to what those agents see. A hidden auto-renewal term is no less deceptive because an agent accepted it. Our explainer on what agentic commerce is explains the shift.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should you start in the first 90 days?
Month one: run opt-out signal checks across your sites and apps, and fix any tracker that ignores the signal. Retest and keep the evidence.
Month two: run auto-renewal journey tests on every subscription product against a checklist agreed with counsel. Fix cancellation obstacles first.
Month three: start review and endorsement screening at depth 1 on new reviews, then move to depth 2 with moderators deciding on the flags. Add privacy request testing.
Where Pryme fits
Pryme certifies each test separately, on the retailer's own pages and requests, through Attest. Checking agents operate at depth 1 and cannot change site settings. Every verdict is filed with the bound that decided it, giving counsel a dated record of what was tested and found.
Questions people ask
Do state privacy laws apply to an AI shopping assistant?
Yes, where it processes personal information of residents of those states. Notices, rights requests and opt-outs apply as for any other processing.
Can an agent decide whether a review is fake?
It can flag signals and recommend. The decision to remove a review should stay with a moderator, because removing genuine reviews also distorts what customers see.
How does the US compare with the UK for e-commerce compliance?
The UK has a single national consumer regime with direct fines, while the US relies on federal rules and state laws. See our brief on compliance agents in UK e-commerce.