Hello, this is attorney Eom Sang-yoon at Cheongchul Law Firm.

In recent years the e-commerce market has undergone significant change, including (i) the rapid growth of consumer-to-consumer (C2C) second-hand trading platforms, (ii) the entry of overseas e-commerce platforms such as AliExpress and Temu into the Korean market, and (iii) the growing influence of user reviews on purchasing decisions. Against this backdrop, it has been pointed out that the existing Act on Consumer Protection in Electronic Commerce (the "E-Commerce Act") and its subordinate regulations could not effectively address newly emerging types of consumer harm.

On July 14, 2026, the Korea Fair Trade Commission (KFTC) announced that the amendment to the Enforcement Decree of the E-Commerce Act had passed the Cabinet meeting, together with amendments to the Enforcement Rules and the Notice on Criteria for Imposing Penalty Surcharges on Businesses Violating the E-Commerce Act (the "Penalty Surcharge Notice"). The amended Decree, Rules and Notice take effect on July 21, 2026, while the provisions on designating a domestic agent under Article 25-4 of the Decree take effect on January 21, 2027. Below we review the key changes and the practical implications for e-commerce businesses and consumers.

Key changes in the amended E-Commerce Act Decree

Reflecting changes in the e-commerce market, the amendment (i) rationalizes the scope of identity verification for individual sellers, (ii) specifies the criteria for overseas businesses to designate a domestic agent, (iii) introduces disclosure requirements for how user reviews are collected and handled, and (iv) substantially strengthens the penalty surcharge criteria for violators.

1. Rationalizing the scope of individual seller identity checks (Decree Article 25-3)

Previously, platforms brokering online sales (online marketplace intermediaries) had to verify and provide consumers with five items of information — name, date of birth, address, telephone number and e-mail address — regardless of whether the seller was a business or an individual. Applying this uniform five-item obligation even to C2C second-hand transactions was criticized for creating excessive collection of, and leakage risk for, personal data.

The amended Decree narrows the identity information that intermediaries must verify for individual sellers to two items: telephone number and e-mail address. Where the intermediary already holds identity information verified through an identity verification agency designated under Article 23-3(1) of the Network Act, the burden is further eased so that only the telephone number need be verified.

2. Specifying criteria for overseas businesses to designate a domestic agent (Decree Article 25-4)

Although overseas businesses without an address or place of business in Korea were already required to designate a domestic agent to protect Korean consumers and enable effective KFTC oversight, the scope of covered businesses was criticized as unclear. The amended Decree specifies that the obligation applies to any business meeting one of the following: (i) revenue of KRW 1 trillion or more in the preceding year (preceding fiscal year for corporations); (ii) a monthly average of 1 million or more Korean consumers accessing its cyber mall during the three months preceding the end of the previous year; or (iii) having been required by the KFTC to report or submit materials because significant consumer harm has occurred or is likely to occur due to a violation.

In addition, after designating a domestic agent, the overseas business must promptly submit the agent's details (name, address, telephone number and e-mail address) to the KFTC in writing and disclose them on the front page of its cyber mall. As noted above, this provision takes effect on January 21, 2027.

3. Disclosure of how user reviews are collected and handled (Decree Article 27-3)

Where a business posts consumer reviews, the amended Decree requires it to inform consumers, on the first screen where reviews can be viewed, of (i) who is entitled to write reviews, (ii) the posting period, (iii) the rating criteria and the effect of ratings, and (iv) the deletion criteria and the objection procedure where a review is deleted. This reflects concerns that reviews effectively function as advertising, yet the criteria for collecting, posting and deleting them are not clearly disclosed to consumers, which can lead to improper manipulation or deletion of reviews.

The KFTC stated that it will allow a three-month grace period for this requirement and will separately distribute a Q&A guide on review collection and disclosure addressing businesses' main questions.

4. Substantially stronger penalty surcharges for violators (Decree Table 2 and the Penalty Surcharge Notice)

To secure effective deterrence, the amended Decree allows penalty surcharges to be increased by up to 50% for even a single repeat violation, and by up to 100% for a fourth repeat violation. This reflects practitioner criticism that the previous aggravation criteria for repeat offenders were relatively low, and the level of economic sanctions on repeat violators is expected to rise considerably.

The amended Penalty Surcharge Notice also sharply reduces the discount for voluntary correction from up to 30% to no more than 10%. As the incentive from voluntary correction diminishes, building a preventive compliance system to avoid violations in the first place has become more important than ever.

The amended Decree also establishes criteria for business suspension orders for breaches of newly created obligations such as domestic agent designation, and revises the administrative fine criteria to reflect newly created and increased fines. The amended Enforcement Rules also simplify procedures — for example, where a business loses or damages its registration certificate when filing closure of an online sales business, it may simply state the reason on the closure report without submitting a separate explanatory statement.

Practical implications

This amendment has implications for a range of stakeholders, including e-commerce businesses, overseas platforms, individual sellers and consumers.

For online marketplace intermediaries (e-commerce and second-hand trading platforms), the narrowed scope of individual seller identity checks means that member sign-up flows, identity verification systems and seller information displays should be updated in time for the effective date. In particular, where identity information obtained through a verification agency is already held, the required check narrows to the telephone number alone, so practical differences will emerge between platforms with and without such verification. As for the review disclosure requirement (Decree Article 27-3), although a three-month grace period applies, product detail and review page UI changes may be needed, so preparation during the grace period is advisable.

For overseas e-commerce platforms, it is necessary to determine promptly whether the domestic agent obligation applies and to complete practical preparations — appointing an agent, executing the contract and making the required disclosures — ahead of the effective date (January 21, 2027). Businesses near the revenue or user-number thresholds in particular risk being subject to the newly created business suspension criteria if they fall within the obligation but fail to comply and are then asked by regulators to submit materials, so establishing a proactive response system is essential.

For general e-commerce businesses, the significantly expanded aggravation for repeat violations and the reduced discount for voluntary correction mean that strengthening preventive compliance now matters far more than after-the-fact response. Businesses should review internally for areas prone to repeat violations (false or exaggerated advertising, violations relating to withdrawal of subscription and refunds, and violations relating to online sales business registration) and put recurrence-prevention systems in place by violation type.

For consumers, C2C transactions such as second-hand trading now disclose a narrower range of seller identity information, creating new considerations when assessing an individual seller's trustworthiness. That said, where the intermediary holds identity information verified through a verification agency, a minimum level of verification is still assured; and the new domestic agent obligation for overseas businesses creates an effective domestic channel for addressing consumer harm arising on overseas platforms — both positive developments from a consumer protection perspective.

These changes are closely interrelated, and their practical impact varies considerably depending on each business's structure and scale. In particular, the review-related requirements and the aggravated penalty criteria for repeat violations may produce different outcomes depending on the specific facts and type of violation. Businesses would therefore be best served by assessing their own operations against the requirements of the amended Decree before the effective date and, where necessary, obtaining professional advice to develop a response plan.