Everything the adaptive question bank can teach and test in E-Commerce, from foundations through advanced practice. Work through it in order, or start practicing and let the questions find your level.
Conversion rate divides completed purchases by a count of visits. With 120 orders from 4,000 sessions the rate is 3%; count the same traffic as 3,000 users and it becomes 4%. A session is one visit, and one person can make several, while user counts are imperfect: someone who switches from a laptop to a phone can be counted as two users. Always state which denominator a rate uses.
A typical online store can record the path to a sale as separate events: a shopper views a list of products, opens one item's details, adds it to the cart, begins checkout, enters shipping and then payment details, and buys. Counting each event shows how often each step happens, which is what makes the funnel measurable step by step.
A conversion is whatever desired action you define, so it need not be the final purchase. Adding an item to a cart or a wishlist, or starting checkout, can each be counted and turned into a rate. These rates track progress along the path, but they are not sales: in one company's A/B test the share of visitors who reached their cart rose 11% while sales rose 8%, so report both rather than letting one stand in for the other.
Suppose 10,000 shoppers view a product, 1,200 add it to the cart, 600 start checkout and 450 buy. The step rates are 12%, 50% and 75%, so the move from product view to cart loses the most people. A loss late in the funnel, though, costs shoppers who had already added items. The counts show where people leave; finding out why takes observation or interviews.
Pop-ups, modals, overlays and interstitials that stop someone mid-task are classic friction, which is why design guidance treats a modal as a last resort and warns against interruptions that are not part of the task. A modal does suit a decision that needs full attention, such as confirming an action that cannot be undone. Wording carries a trust cost too: alarming legal, security or error messages erode confidence.
Cognitive load is the mental effort needed to process information, and complex forms can feel overwhelming. Design guidance lowers it in concrete ways: show one small topic at a time, move from simple questions to harder ones, show people where they are in the process, and let them save and resume. Clear hint text and specific error messages help people avoid mistakes and recover from them.
If phones bring 60% of sessions but only 40% of orders, phone visits convert at two thirds of the site average. Mobile networks can swing between fast and slow or drop out, and phones have less processing power, so the same page can perform worse there, and speed guidance measures page loads separately for mobile and desktop. Compare the two segments' rates directly instead of reading only the store-wide figure.
One measure of perceived load speed is LCP, Largest Contentful Paint: the time until the largest image, text block or video in view has rendered. In one company's A/B test, two landing pages looked and worked the same, but one had a 31% better LCP, and it produced 8% more sales. That is one site's result, not a forecast for yours, but it shows how to isolate speed's effect: change nothing else.
An A/B test, also called a split test, shows each visitor version A or version B, assigned by chance, and tracks a chosen measure by which version each person saw. Decide before the test what result counts as success. Random assignment is what lets a difference be credited to the page rather than to who happened to arrive. The test tells you whether a version works better; it does not tell you why.
If version B has both a new headline and a new photo, a win cannot be pinned on either one, because their effects are mixed together. Changing one element per test keeps the credit clear but misses interactions, where one change's effect depends on another's setting. A full factorial design runs every combination, here four versions, so each effect and their interaction can be estimated.
The sample needed to detect a change in a rate depends on four inputs: the current rate, the smallest difference worth detecting, the false-alarm risk (alpha) and the chance of catching a real difference (power). That difference is squared in the formula's denominator, so halving it roughly quadruples the visitors needed. The formula counts observations, not days, so a quiet store can need weeks to reach what a busy one gets in a day.
A test starts from a null hypothesis that the versions do not differ. The significance level, alpha, is the risk of rejecting it when it is true: at 0.05, a real no-difference case is wrongly flagged 5% of the time. Failing to reject is not proof of no difference. And because detection depends on sample size, a huge sample can make a difference too small to matter significant.
A fixed-size test is planned to be read once, after the full sample is in. Looking along the way and stopping as soon as the result crosses the significance line, called optional stopping, inflates the Type I error rate: the chance of declaring a difference that is not there. Sequential designs do allow early looks, but they schedule them in advance and adjust for them.
Say desktop converts at 4.0% on A and 4.8% on B, while mobile converts at 2.0% on A and 1.8% on B. With equal traffic, B wins overall, 3.3% to 3.0%, yet loses on phones. A few segments chosen before the test can be read at the stated error rate. Choosing segments after seeing the data, or checking many, changes the overall false-alarm rate unless a multiple-comparison method is used.
Analytics report what people did and how often, but not why. Qualitative research is exploratory work aimed at underlying reasons, opinions and motivations, gathered through methods such as interviews that keep asking why, and observing people in their own setting. A small group of participants can surface usable insight, and the findings can supply hypotheses for a later quantitative test.
Each participant, one per session, gets a short scenario, such as needing to find a return policy, and tries it while you watch without hinting how. They think aloud, describing what they see and what they are trying to do. Three to five people who fit simple criteria, not your own team, are enough to look for problems that affect several of them. Retest after a fix, since the change may need more work.
Heuristics here means general usability best practices, such as keeping people informed about whether an action worked, or using familiar words instead of internal jargon. Three to five people who know these practices, usually user experience specialists, each review the site alone and note problems, then meet to compare and rank them. The method surfaces broad, frequent usability problems fast, with no need for in-depth user research.
Before a controlled test, decide what result you will count as success, and frame the claim as a pair: a null hypothesis that the versions do not differ and an alternative that they do. The reason for the change can come from qualitative research, which helps generate hypotheses for quantitative tests. Comparisons picked only after seeing the data lose the confidence level they claim.
One-factor-at-a-time tuning holds everything fixed but one element, keeps that element's best setting, then moves to the next. That works when elements act independently. When they interact, the best setting for one depends on the others, so where you start decides where you finish, and a better overall design can stay untested. A long run of small tweaks inside one layout can stall this way.
Tailoring what a shopper sees depends on data about that shopper. An FTC guide for business builds data security on a few principles, among them holding only the personal data you need, protecting what you keep and disposing of it properly once it is no longer needed. Each extra signal kept for tailoring is one more thing to secure and later discard, a cost to weigh against any gain in relevance.
Contribution margin is a product's price minus what that unit costs you. Sell a $50 item that costs $30 and each order contributes $20, so 1,000 orders bring $20,000. A 20% discount cuts the price to $40 and the contribution to $10, so it takes 2,000 orders, double the conversion on the same traffic, just to match the old total.
Visitors from different traffic sources can convert at different rates, so a shift in the marketing mix can move the store-wide rate even when no page has changed. Traffic source is a standard analytics dimension, so the rate can be broken down by source to see whether the mix moved. A randomized test sidesteps the problem: it splits the same incoming audience between versions, and random assignment is necessary for a sound conclusion.
Seasonality is a repeating, periodic pattern in data over time. Retail sales typically rise from September through December and fall back in January and February, so a drop from December to January says little about your store on its own. Comparing this January with last January, or this quarter with the same quarter last year, holds the season constant.
Average order value is revenue divided by orders. Revenue then equals sessions times conversion rate times average order value: 20,000 sessions at 2% with a $50 average gives $20,000. If revenue falls while sessions and conversion hold steady, the change is in order value, and a checkout redesign would target the wrong number. Dividing orders by sessions and revenue by orders lets you check each factor on its own.
B. Product pages, catalog, and merchandising
Sharp, clear photos appeal to people more than blurry ones, and listing guidance prefers pictures that show the product plainly, for example on a white background, and that depict the item actually offered. Images are often the heaviest part of a page, so they need optimizing and responsive sizing to stay fast. Alt text, a short description of what an image conveys, gives screen reader users the same information.
Product markup accepts a list of images, not just one, and every image must represent the item being sold. When a gallery holds several views, the alt text for each should describe the information that view adds, such as a rear panel and its ports, rather than how the photo looks, and it should not repeat what the page text already says.
An ad is judged by the overall impression its words and pictures create together, including claims made only by implication. A tight close-up that makes a small item look large can mislead, and fine print elsewhere cannot fix a picture it contradicts. Giving measured dimensions plainly, and choosing photos whose sense of scale matches them, keeps the image and the facts in agreement.
Listing guidance recommends several high-resolution images, at least 50,000 pixels when width is multiplied by height, and sharp images are favored over blurry ones. High resolution has a cost: images are often the largest part of a page's size and can make it slow to load. Image optimization and responsive image techniques are how a page offers that detail while staying fast.
Product markup can link a 3D model of an item, in the glTF format, next to its photos. For video, WCAG, the Web Content Accessibility Guidelines, calls for captions of speech and meaningful sounds on prerecorded video with sound, and audio description narrates key visuals for viewers who are blind or visually impaired. Automatic captions alone fall short of that standard.
Readers want to know what applies to them, so clear writing tells them early why something matters and puts the most important point first, with background later. That freedom has a limit. Every objective claim in an ad, whether stated outright or only implied, needs a reasonable basis, meaning objective evidence in hand before the ad runs, and a money-back guarantee is no substitute.
An ad can deceive through what it leaves out when the gap gives a wrong impression of the product. Some disclosures are required outright: an online listing for a textile product must say whether it was made in the USA, imported or both, and if it mentions a fiber, it must give the label's fiber content, without percentages. Structured product data also has fields for size, color, material and identifiers.
When a shopper picks a size or color, Google's variant guidance expects the page to show that variant's image, price and availability and let it be added to the cart. Clear writing puts the most important information first, and on a product page that means the facts needed to decide. Showing part of the price and adding mandatory charges late in checkout is drip pricing, which FTC staff list as a dark pattern.
Style the button most shoppers should press so it stands apart from every other button, and keep the total number of buttons low. Use buttons for actions and plain links for moving between pages or for less important options. The label should be short and start with a verb that says what happens next, such as Add to cart rather than Cart options.
Product data treats each size or color as a separate variant within one product group, each with a unique ID such as a SKU, the merchant's own product code, and picking one should update the image, price and availability shown. If a sold-out variant stays on the page as unavailable, which can show shoppers it exists, say why it cannot be chosen, in a way screen readers also announce.
Product data gives each offer one availability state, such as in stock, out of stock, back order, preorder or limited availability. Google does not promise how fast it recrawls a page, so a store can also send stock changes through scheduled product feeds or an API for immediate updates. Saying inventory is low when it is not, to push a quick purchase, is the false low-stock message FTC staff list as a dark pattern.
Reviews help shoppers only when they give an honest picture of buyer opinion. A product page that shows an average star rating, the number of reviews at each star level and individual reviews presents itself as that picture. Made-up activity, such as a false count of people viewing an item right now, and reviews from people who never used the product are deceptive.
A 5.0 average from three reviews is a far shakier estimate than 4.6 from 900, because an estimate from a small sample carries more uncertainty, which is why a rating should travel with its review count and the count at each star level. Dates matter too: if a product has been materially changed, older reviews may describe the earlier version, and a clear date lets readers judge.
A store that withholds reviews under four stars while showing an average rating and star breakdown misrepresents what buyers think. Under the FTC rule on consumer reviews, a business may not claim or imply that its displayed reviews are all or most of those submitted while suppressing low-rated or negative ones. It may still withhold reviews on neutral grounds applied to all, such as abusive content or a reasonable belief a review is fake.
A business may not write or buy reviews from people who do not exist or never used the product, or pay for reviews on condition that they be positive or negative. A manager's own review must disclose the tie to the business. An incentive for a review must not depend on its sentiment and must be clearly disclosed. Some platforms accept reviews only from verified buyers, a closed system, while open systems let anyone post.
When a business reposts a customer's photo, quote or review in its own ads, the content becomes an endorsement, a message people take to reflect someone else's experience. It must reflect that person's honest experience, cannot be reworded to distort it, and a connection the audience would not expect, such as a free product, must be disclosed. Pairing real testimonials with stock photos that look better than real results misrepresents them.
Questions people send, and the phrases they type into site search, show what they want to know and may not have found on the page. Listening to them is one of several ways to learn about readers before writing for them. A seller's answer that makes an objective claim about the product is still a product claim, and FTC guidance says advertisers need proof for the claims shoppers take from an ad.
Urgency cues press people to buy now. FTC staff list the false versions as dark patterns that induce false beliefs: a countdown clock that resets or vanishes when it hits zero, a limited-time offer with no real deadline, inventory said to be low when it is not, and demand said to be high when it is not. A deadline or stock claim has to match the real offer and the real inventory.
Showing a case beside a phone, or batteries beside a toy, leaves the choice with the shopper. The line is crossed when the store makes the choice for them: putting items in the cart without permission, using a pre-checked box, or tacking on add-ons such as an extended warranty unless the shopper notices and opts out. FTC staff call these sneaking and preselection.
Offering a larger size or a premium version before the shopper commits is an upsell, and it leaves the decision with the shopper when both options are presented evenly. Two patterns in the FTC staff list show how it turns manipulative: preselecting the most expensive option instead of the cheaper or free one, and pressured upselling, where contrasting visual prominence, such as a bright button beside a pale link, steers the choice.
Grouping items under one price changes what a shopper compares. Used to keep shoppers from comparing item prices easily, bundling is a dark pattern in the FTC staff list. Offers such as buy one, get one free can mislead if the seller raised the regular price of the required item, cut its quantity or quality, or attached other strings, so the FTC pricing guides say all terms should be clear at the outset.
A card sort asks people to group items into categories: in an open sort they make and name the groups, and in a closed sort they place items into groups you set. The results show how shoppers expect a catalog to be organized. A menu that is too long hides items at the bottom, and one too deep buries them behind clicks, so test the balance, and link categories down to every product page.
Faceted navigation lets shoppers filter a list by attributes such as product type, color and size, and each added filter multiplies the combinations, some of which match nothing. When filtered views have their own crawlable addresses, Google advises that an empty combination return a 404 not-found status at that address rather than redirect to a generic error page, and that filters in a URL path keep a fixed order.
Search logs show the words shoppers use, how often results get clicked, and which searches return nothing. Synonyms, acronyms, slang and common misspellings can be mapped to the right pages, and a no-results page can suggest broader terms and link onward. Keep the box wide enough to show several words, keep the query in the box on the results page, and make simple search the default.
Product data is the set of attributes that describe each item, such as title, description, color, size, price and availability. Global identifiers such as a GTIN, plus a unique ID for each variant, pin down which item a listing describes, and a category field places it in a taxonomy. Where the same attributes drive variant pages, filters and search listings, one wrong value can show up in all of them.
C. Cart, checkout, and payments
The rate compares carts with purchases: if 1,000 sessions include an add to cart and 300 of them end in a purchase, 700, or 70 percent, were abandoned. Google Analytics, for one, logs adding to cart, starting checkout and purchasing as separate events, so you can tell carts dropped before checkout from checkouts dropped partway through. Its add-to-cart count rises with every item added, not once per cart.
Shoppers give up on forms that look long or complex or that give no sense of where they lead, and this bites hardest on small screens or when people are rushed. The payment form is a frequent breaking point: if autofill fills every card field except a custom expiry-date picker, the shopper has to go and find the physical card, and the sale may be lost right there.
Drip pricing, as FTC staff use the term, means advertising part of a price and adding mandatory charges late in the purchase, such as a convenience fee that first appears on the checkout screen. Workshop panelists said buyers feel committed by then. A study cited in the FTC's 2022 report found ticket buyers not shown fees upfront spent about 20 percent more and finished more often, which the report counts as a cost to consumers.
FTC staff say unavoidable, mandatory fees belong in the upfront advertised price, and they flag designs that spotlight a subtotal while listing required fees below it, where the higher total is easy to miss. The FTC's fee rule, 16 CFR 464, is narrower than its name: it covers only live-event tickets and short-term lodging, and its total price may leave out shipping and government charges.
Requiring an account before payment adds a separate sign-up task to the purchase, and guest checkout removes it. web.dev treats guest checkout as the default for an online store and advises against forcing account creation before a purchase. FTC staff list forced registration among dark patterns, designs that trick people into choices they might not otherwise make, citing a prompt that blocks the purchase until the shopper creates an account.
Once checkout is finished, the store already holds most of the data an account needs, so signing up can be quick. web.dev suggests offering the account at that point instead of before payment, with one detail that is easy to miss: link the order that was just placed to the new account, so the shopper's first purchase appears in it.
Each field is work for the shopper, so first settle what data the order requires and drop the rest; fewer fields also means less personal data to guard and less liability. Merge where you can: one name box instead of separate first, last and title fields, and a billing address that defaults to the delivery address, shown with an edit link rather than as a second form.
One form of address autocomplete is browser autofill: the browser fills fields from details the shopper saved earlier, which works when each input carries the right autocomplete value, such as shipping postal-code. A postal-code lookup is a different tool with known limits: it does not work in every country, and one code can cover so many addresses that picking from the list on a phone is slow and error-prone.
Checking a field while the shopper is still at it lets them fix a problem at once, rather than facing a list of errors after pressing submit. Timing matters: show an error only after the person has interacted with that field. In U.S. Web Design System testing of a live validation checklist, screen reader and screen magnifier users did not notice when its status changed. The server must still check the data again.
An error message exists to get the shopper moving again, so name the problem, point to the field and give the fix, such as the date format you expect. Write it for the person filling in the form, not for the system behind it. Do not rely on a red border alone to mark an error, and replace vague notes such as a bare Error at the top of the form with a specific message tied to each problem field.
The choice trades fewer screens against shorter ones. Shoppers tend to abandon forms that look long, complex or directionless. Splitting shortens each screen but adds screens, so each needs a heading, a button naming the next step and an easy way back to edit the order. U.S. Web Design System guidance keeps step indicators for processes with three or more sections.
Showing position reduces uncertainty in a long process. U.S. Web Design System guidance makes the current step the most prominent, keeps pending steps readable rather than grayed out like disabled controls, and puts step-of-total text such as 2 of 4 beside a real page heading. It advises against an indicator when answers can change the number of steps or when steps can be done in any order.
Input types decide which keyboard a phone shows: type=email and type=tel bring up email and phone keyboards, and for a card number, type=text with inputmode=numeric gives a number pad without the spinner arrows that type=number adds. Make tap targets about 48 by 48 pixels, roughly a fingertip, and use autocomplete values so saved details fill in. Many sites get more mobile traffic but more desktop conversions.
On the web, the Payment Request API, a browser payment interface, lets a store list the payment methods it accepts and hand checkout to a payment app, which can reuse details already on file, so a long form becomes a few taps. canMakePayment() reports, before payment starts, whether the browser supports at least one listed method. How the payment screen looks is up to the payment app provider, not the store.
Card details can be kept by the merchant, by a payment service such as PayPal, or by the shopper's own browser. For the browser route, label card fields with autocomplete values such as cc-number, cc-name and cc-exp-month so stored cards fill correctly; without them, shoppers may write card numbers down or store them insecurely. For returning users, show the saved address as plain text with a link to change it.
In the common pay-in-four form, the shopper usually pays a first 25 percent share, due at checkout or two weeks later, then three more every two weeks, typically without interest, though most such loans charge late fees for missed payments. Partner merchants pay the lender a per-transaction merchant discount fee. Lenders pitch merchants on higher order values and conversion, figures that come from the lenders' own marketing.
The CFPB recounts that buyers and sellers on early Chinese marketplaces were wary, and that Alipay took off after it held a buyer's money until the goods arrived; Alipay and WeChat Pay then grew dramatically, while U.S. super apps have taken a different path. On the web, the Payment Request API lets a store list several accepted methods and check whether the browser supports at least one of them.
Paying before the goods arrive asks the buyer to trust the seller, and that doubt can hold a market back. The CFPB recounts how early Chinese marketplace buyers worried their orders would never come, until Alipay removed the risk by holding payment until delivery and usage took off. Faked reassurance is another matter: FTC staff list false activity messages and phony or undisclosed paid testimonials as dark patterns, meaning manipulative designs.
FTC consumer advice tells shoppers to check whether a seller allows returns for a full refund and, before sending an item back, to find out who pays return shipping, how many days they have and whether a restocking fee applies. Terms on sale and clearance items often differ. FTC staff also list hiding material terms in fine print, long terms of service or vague links as a dark pattern, a design that manipulates choices.
Checkout should offer as few exits as possible, and web.dev advises removing distractions such as product promotions there. Whether discount codes raise revenue is, web.dev says, the kind of question that analytics combined with server logs, conversion data and A/B tests can answer. Google Analytics events can record the coupon used at checkout and purchase, so redemptions can be compared with completed orders.
CAN-SPAM, the U.S. commercial email law, sorts messages by primary purpose. Transactional content confirms or completes a deal the recipient already agreed to, and the FTC's guide says the law reads that category narrowly. A message mainly promoting a product is commercial and needs, among other things, an accurate subject line, a working opt-out and a postal address. FTC staff call fake countdown timers and false low-stock notices dark patterns.
A cart kept in sessionStorage, a per-tab browser store, lasts only as long as that tab. IndexedDB, a browser database, is best effort by default: unless the site has requested persistent storage, the browser may clear it, for example when the device runs low on space. Safari also caps script-writable storage, IndexedDB included, at seven days of Safari use without interaction with the site, except for web apps added to the home screen.
Under CAN-SPAM, the U.S. commercial email law, an email that only confirms a purchase the buyer already agreed to is transactional: exempt from most of the law's rules but still barred from misleading routing information. Add promotions and it can turn commercial if the subject line reads like an ad or the order details are not mainly at the start. FTC advice tells buyers to keep such emails to hold sellers to their promises.
Right after payment, the store already holds most of the details an account would need, so web.dev suggests offering sign-up at that point and linking the order just placed to the new account. Completing the purchase is also when the analytics purchase event is sent, with a transaction ID that any later refund event must carry, so a refund can be matched to its original order.
Send each step as its own event, such as begin_checkout, add_shipping_info, add_payment_info and purchase, then compare the counts. Say 1,000 shoppers start checkout, 700 add shipping details, 600 add payment and 540 buy: the shipping step loses 300 people, more than the other two steps combined, so that screen gets studied first. The funnel shows where people leave; an A/B test shows whether a change there helps.
D. Pricing, promotions, and unit economics
If a store takes in $12,000 from 300 orders in a month, its average order value is $12,000 / 300 = $40. Divide by customers instead and you get a different metric: if those 300 orders came from 200 people, revenue per paying customer is $60. Also decide whether revenue nets out refunds and includes shipping and tax, because Google Analytics reports those pieces separately.
Gross margin is gross profit divided by net sales. Sell an item for $50 that cost you $30 and gross profit is $20, a 40 percent margin. Do not confuse it with markup, which divides by cost instead: in an FTC pricing-guide example, a pen bought for $5 and sold for $7.50 carries a 50 percent markup but only a 33 percent gross margin.
Subtract all variable costs from the price, then divide by the price. A $50 order whose goods cost $30 has a 40 percent gross margin, but add $6 of shipping and $2 of payment fees and variable cost reaches $38, leaving $12, or 24 percent. Card fees belong here because they are typically charged as a percentage of each transaction. Contribution is what is left to cover fixed costs.
Rent, salaries, insurance and interest stay put over a period whether orders rise or fall; product cost and per-transaction card fees grow with each order. Some costs are mixed, such as monthly phone service, which the Small Business Administration lists as semi-variable and suggests splitting into its fixed and variable parts. The split matters because only variable costs come out of each sale's contribution.
The Small Business Administration (SBA) formula is fixed costs / (price per unit - variable cost per unit). With $6,000 a month in fixed costs, a $50 price and $35 of variable cost, each unit contributes $15, so the store must sell 6,000 / 15 = 400 units a month to break even, the point where total revenue equals total cost. The SBA calls the result an estimate and suggests adding a cushion, say 10 percent, for costs you cannot predict.
If a month's acquisition spend is $6,000 and it brings in 150 first-time buyers, customer acquisition cost (CAC) is $6,000 / 150 = $40. The trap is the denominator: divide by all 250 customers who bought that month, repeat buyers included, and CAC appears to be $24, which understates what a new customer really costs. Google Analytics reports first-time purchasers separately from total purchasers.
Suppose paid social costs $4,000 and brings 50 new customers, $80 each, while search ads cost $2,000 and bring 100, $20 each. Blended customer acquisition cost (CAC) is $6,000 / 150 = $40, a figure neither channel has. Add 50 customers who arrived on their own and the blended figure falls to $30, yet paid social still costs $80 per customer. Channel CAC shows what each source of customers really costs.
A customer who stops buying takes all their future profit with them, so stores estimate what each customer is worth over time. A simple version multiplies contribution per order by expected orders: $12 of contribution times 2.5 orders is $30. Using revenue instead, $50 times 2.5 or $125, overstates it more than fourfold. Many estimation models exist, from simple formulas to probability models, and all are forecasts.
Neither number means much alone. A lifetime value (LTV) of $30 covers its acquisition cost (CAC) three times over if winning the customer cost $10, a ratio of 3, but loses money if it cost $40, a ratio of 0.75: each such customer returns $30 of contribution on $40 of spend. Measure LTV in contribution, not revenue, or the ratio flatters the business.
Divide acquisition cost by the contribution a customer generates per month. A customer who cost $40 and yields $5 of contribution a month pays back in 40 / 5 = 8 months. Until then the store is out of pocket, so a customer who stops buying in month 5 never repays. Use contribution, not revenue: $25 of monthly revenue would suggest a payback under 2 months that is not real.
Spend $1,000 on ads that produce $4,000 in sales and ROAS is 4, also written as 400 percent. Google Analytics defines its version as total revenue divided by advertiser ad cost, so check which revenue sits on top. The trap is reading it as profit: ROAS counts revenue before the cost of goods, shipping, fees or the ads themselves, so a ROAS well above 1 can still lose money.
If each sale keeps a 40 percent contribution margin before ad costs, every $1 of revenue leaves $0.40 to pay for ads, so ads break even when revenue is 1 / 0.40 = 2.5 times their cost. At a 25 percent margin the bar rises to 4. Any return on ad spend below the break-even figure loses money on the sales it drives, however large the ROAS number looks.
ROAS, return on ad spend, measures revenue, not what is left of it. Spend $1,000 on ads that bring $3,000 in sales of a product with a 20 percent contribution margin: the sales leave $600, so the campaign loses $400 despite a ROAS of 3. The same ROAS on a product with a 50 percent margin leaves $1,500 against $1,000 of ads, a $500 gain. Compare any ROAS with its break-even level, 1 divided by the margin.
A profit and loss statement takes revenues minus expenses to reach net income or loss. A store that lifts sales from $10,000 to $15,000 by spending more on ads and discounts can still end up worse off: if costs climb from $9,000 to $15,500, a $1,000 profit becomes a $500 loss. Whenever a metric is built on revenue, such as ROAS or average order value, ask what it looks like after costs.
Count customers with two or more orders and divide by all customers. Take 100 customers: 90 buy once and 10 buy six times each, for 150 orders. Orders per customer comes to 1.5, which sounds as if many come back, yet the repeat purchase rate is only 10 percent. Google Analytics reports average transactions per purchaser, so check which of the two numbers you are reading.
A cohort is a set of customers who started in the same window, such as everyone whose first purchase came in January. Retention is the group's active members in a later period divided by its starting size: 30 of 200 still buying in month three is 15 percent. Totals across all customers can rise while every cohort retains worse, as long as each new cohort is larger than the last.
The idea rests on the left-digit effect: people give the leftmost digit extra weight, so a just-below price such as $1.99 tends to be underestimated. Field studies have reported revenue gains after sellers switched to such endings, but a preregistered 2022 online experiment, in which 266 people chose whether to buy lottery tickets, found no significant effect of just-below or rounded prices. The effect is contested.
An anchor is the first number in view, and judgments drift toward it, most when people know little about the product. In a 2025 online study of hearing-aid prices, high or low banner prices had no significant overall effect; only exploratory analyses of less-informed people found one. A 'was' price is a built-in reference point, and the FTC's pricing guides accept it only if the item was truly offered at it for a reasonably substantial period.
Adding an option can change which existing one people pick. A decoy sits close to the target but is worse on one attribute, such as the same product priced 10 percent higher, so the target looks like the better deal. In a 2021 study of 810 shoppers in one Chinese city choosing meat, decoys raised the target's share, with price decoys second of four kinds tested; other studies found decoys work less well on buyers who know the product.
The threshold creates an incentive only for carts below it. With a $50 threshold, a $42 cart must add $8 or pay for shipping, while a $65 cart gets it anyway, so the store pays shipping on every order above the line. In one 2026 brain-scan study, 38 young adults gave shoe offers at a fixed total price higher purchase ratings with free shipping than with the three larger fees, though not the smallest; thresholds were not tested.
Shipping is a cost the business incurs to send goods, so free shipping means the store absorbs it, recovers it in product prices, or both. In a 2026 brain-scan study of 38 young adults with total cost held equal, free shipping drew higher purchase ratings than the three larger fees, which the authors link to the pull of a zero price. On a $40 order with $12 of contribution before shipping, absorbing $7 of shipping leaves $5.
A sitewide percentage off lowers the price for every buyer, a coupon only for those who redeem it, and buy one get one free is half off each unit but requires two. On a $50 item costing $30, the free version sells two units for $50 against $60 of cost, while buy one get one half off brings in $75, like 25 percent off each. FTC guides warn that raising the bought item's regular price can deceive, and want terms clear upfront.
Take a $50 item that costs $30, a 40 percent gross margin. A 20 percent discount drops the price to $40, but the cost stays at $30, so gross profit falls from $20 to $10: one-fifth off the price removes half the profit. To earn the same total gross profit, the store must now sell twice as many units. A 30 percent discount would leave $5 a unit and require four times the units.
Under the FTC's pricing guides, a 'was' price is legitimate only if the item was openly offered at it for a reasonably substantial period in the recent, regular course of business; an inflated price held for a few days to stage a cut is fictitious. The FTC's guide on 'free' offers adds a frequency limit: one product should not carry a 'free' offer in an area for over 6 of any 12 months.
A dealer may price at or away from the MSRP if it decides alone, and a maker may stop dealing with retailers who ignore its price policy. Since 2007 federal courts weigh such programs by a rule of reason, banning only unreasonable ones, though some states hold minimum resale prices illegal per se, with no defense allowed. Makers get leeway over ads they help fund, yet the FTC found one set of minimum advertised price rules unreasonable.
E. Traffic, marketplaces, and platforms
Selling where a platform holds the shoppers means reaching them on its terms: in its 2023 complaint, the FTC alleged that most sellers on Amazon now have to buy ads to reach its shoppers. A store you run yourself can contact its own customers directly with promotions and new releases, but it has to attract them first, and every marketing email to that list must follow CAN-SPAM, including a working opt-out.
The three sources are paid for in different ways. Paid ads are billed by the platform, for example per click or per thousand impressions in Google Ads bidding. Organic search placement is earned, not bought: Google says it does not accept payment to rank pages higher, and its ranking is done programmatically. An owned channel, such as your email list, reaches people you can contact directly, and each marketing email must meet CAN-SPAM.
A lookback window caps how far back a report searches for touches to credit. Google Ads defines its click-through window as the most days that may pass between an interaction, such as a click, and a conversion, with a separate view-through window for ad impressions. Google Analytics lets a property choose 30, 60 or 90 days for non-acquisition conversions. Example: with a 30-day window, a click on day 1 earns no credit for a sale on day 40.
Under last click, the final channel a customer clicked before buying gets 100 percent of the credit; Google Analytics' version also ignores direct visits. Example: a shopper clicks a social ad, later clicks a search ad, then buys. Last click credits search alone, while a linear model, which splits credit equally across clicks, gives each half. Same sale, different story, and in Analytics a model change applies to past data too.
An incremental outcome is the part of results that marketing caused, found by comparing actual sales with a counterfactual, the sales you would have had without the campaign. In a Google Meridian example, $150,000 of sales against an estimated $125,000 without the campaign means $25,000 was incremental. Geo experiments estimate it from untouched control regions. A sale that follows an ad does not prove the ad caused it.
Retargeting (remarketing, in Google's ad tools) uses data such as past site visits to show those people ads on other sites or in search; dynamic remarketing shows the very products they viewed. The trap is measurement: under last click, the ad gets full credit whenever its click is the last before a sale, even from shoppers already coming back. Estimating what the ads added takes a comparison, such as with a similar group that saw no ads.
A marketplace supplies the shoppers and sets the rules; the FTC's 2023 complaint says Amazon shoppers see no obvious difference between listings Amazon sells itself and outside sellers' listings. The same filing describes store-building software that lets merchants run their own direct-to-consumer sites, with control of branding and access to customer analytics, but no built-in customer base, so merchants must pay to draw shoppers in.
The FTC's 2023 complaint lists four main fees Amazon charges sellers: a selling fee, monthly or per item; a referral commission based on price; fulfillment and delivery charges; and advertising. Its fulfillment service also charges for storage. Invented example: a $40 item with a 15% referral fee ($6), $5 fulfillment and $4 of ads costs $15, or 37.5% of the price. The FTC alleged fees reach close to half of many sellers' revenue.
Shopping displays draw on product data such as title, price and availability. For Google's merchant listings, the required properties are the product's name, an image and an offer, and Google prefers photos that clearly show the product. Policy-compliant markup makes a page eligible, though Google does not guarantee a display. On Amazon, the FTC's complaint notes, results show each item's name, picture, price, star rating and shipping estimate.
Google says it does not accept payment to rank pages higher, and that relevance is decided by hundreds of factors, which can include the searcher's location, language and device. Marketplace results can blend organic listings with ads: the FTC's 2023 complaint alleges Amazon places sponsored ads above and within its search results, and that 70% of its shoppers do not click past the first page.
When many sellers list one item, Amazon's Featured Merchant Algorithm picks a single offer, the Featured Offer, to fill the Buy Box with its Add to Cart and Buy Now buttons. In its 2023 complaint, the FTC alleges that nearly 98% of Amazon purchases go through that box, that the algorithm prefers Prime-eligible offers, and that offers lose eligibility when Amazon finds a lower price on certain rival sites. These are allegations, not findings.
The FTC's 2023 complaint draws the line this way. As a vendor, you sell goods in batches to the retailer for a wholesale price; it then takes legal title, usually sets the shopper's price and controls the sales data. As a third-party seller, you keep title, set and change your own prices and pay the marketplace a commission. On Amazon, the complaint adds, shoppers see no obvious difference between the two kinds of listing.
Fulfillment means storing, picking, packing and readying orders for delivery. With Fulfillment by Amazon (FBA), sellers place stock in Amazon's fulfillment centers and pay for storage plus a fee based on each item's size and weight. The FTC's 2023 complaint alleges that sellers using FBA give up physical control of their products and that Prime eligibility is generally tied to using it, which the FTC calls coercion. These remain allegations.
Fulfilling your own orders means you hold the inventory and you set the shipping promise. That promise is regulated: the FTC's Mail, Internet, or Telephone Order Merchandise Rule requires a reasonable basis for any shipping time you state, or for shipping within 30 days if you state none. On Amazon, the FTC's 2023 complaint alleges that Prime eligibility is generally conditioned on using Amazon's own fulfillment service instead.
Star ratings travel with a listing: the FTC's 2023 complaint notes that Amazon's search results show each item's star rating next to its name, picture, price and shipping estimate. For your own site, Google's review-snippet rules say not to aggregate ratings from other websites, so marketplace stars do not belong in your own product markup. The same rules bar fake reviews and incentivized ones that are not clearly disclosed.
A marketplace's rules decide who can sell and who gets seen. The FTC's 2023 complaint alleges that Amazon disqualifies sellers' offers from the Buy Box when it finds lower prices elsewhere, and that sales then "tank," in Amazon's own internal word. Law can force suspensions too: under the INFORM Consumers Act, a marketplace must suspend a high-volume seller's future sales if required details are not supplied within 10 days of notice.
NIST defines software as a service (SaaS) as using a provider's application, for example in a web browser, without managing the servers, operating systems, storage or even individual features, apart from limited settings. Hosted store builders follow this model; the FTC's 2023 complaint describes them as SaaS that lets merchants build and customize their own store and reach shoppers directly, but supplies no customer base.
Open source describes how the code is shared, not where the store runs. CISA defines open-source software as software whose human-readable source code is published for anyone to use, study, modify and redistribute. Run on rented servers, it fits what NIST calls infrastructure as a service: you control the operating system, storage and the deployed applications, while the provider manages the hardware and network underneath.
If a store's front end is built separately from its commerce system and fills in products with JavaScript, Google must render the page before it sees them; rendering is a separate step that can wait in a queue. Google also warns that Product markup generated by JavaScript can make Shopping crawls happen less often and less reliably, a problem for fast-changing price and availability, and recommends putting that markup in the initial HTML.
Features such as chat, analytics, A/B testing and social buttons can arrive as third-party JavaScript: code you did not write, served from someone else's servers. web.dev notes these scripts can slow pages and raise privacy and security issues, and if one loads synchronously and its server fails, rendering can stall until the request times out, which can take 10 to 80 seconds. It advises routine audits and never running two vendors for one job.
Google's Core Web Vitals measure real visits three ways: Largest Contentful Paint (LCP), good at 2.5 seconds or less; Interaction to Next Paint (INP), good at 200 milliseconds or less; and Cumulative Layout Shift (CLS), good at 0.1 or less. A page passes when all three meet the mark at the 75th percentile. INP replaced First Input Delay in March 2024. Google's ranking uses these metrics, but good scores do not guarantee top rank.
LCP times how long the biggest image, text block or video in the visible area takes to render, counting from the moment the user started navigating, so redirects and server delay count too. Good is 2.5 seconds or less at the 75th percentile of visits. If a product page's hero image is its largest element, LCP waits until that image has rendered; an image still loading does not count yet, so a smaller element may be reported first.
CLS takes the largest burst of unexpected layout shifts in a page's life, a burst being shifts less than 1 second apart within at most 5 seconds. Good is 0.1 or less; poor is above 0.25. Shifts within 500 milliseconds of a tap or keypress are excluded. Common causes are images or videos without set dimensions, fonts that render at a different size than their fallback, and ads that resize; setting image width and height reserves space.
web.dev's advice on breakpoints is to design for a small screen first, then widen until the layout needs to change, letting the content rather than device names decide where breakpoints go. Search adds a reason: Google uses the mobile version of a page for indexing and ranking, so content left off the mobile page can cost traffic. Google suggests tucking extra detail into accordions or tabs instead of deleting it.
Census counts a sale as e-commerce when the order is placed online, even if payment is not made online. Its August 2026 estimate put such sales at about 17% of US retail sales in the second quarter of 2026, seasonally adjusted, so most retail spending still happens elsewhere. For search, Google lets merchants share physical store inventory through Merchant Center feeds, even data not shown on their website.
F. Lifecycle, email, and retention
A welcome flow is the automatic message, or short series, sent right after someone signs up. Under CAN-SPAM, the primary purpose decides the rules, and the FTC reads the transactional categories narrowly: a message to new subscribers or members is not exempt just because of that relationship. A welcome whose primary purpose is promotion is commercial, so it needs an ad disclosure, your postal address and a working opt-out.
Abandonment can be detected from tracked events. In Google Analytics, add_to_cart and begin_checkout record a shopper's progress and purchase records the sale, so a cart with no purchase event is the trigger. The reminder's legal status matters too: CAN-SPAM's transactional category covers a transaction the recipient has already agreed to, the FTC reads the categories narrowly, and a shopper who left a cart has not completed the purchase.
In Google Analytics' ecommerce events, viewing a product's details is a view_item event and adding it to a cart is add_to_cart, so browse abandonment is a view_item with no add_to_cart after it. Acting on it requires recognizing the visitor, which sites do with cookies or pixels. The FTC notes pixels can capture how people use a page, and two of its 2023 cases over health data allegedly shared for advertising highlighted them.
Emails that confirm an agreed order, or deliver goods under it, are transactional under CAN-SPAM and exempt from most of the law except the ban on false routing data, as long as the order details lead and the subject line does not read like an ad. Expectations are regulated too: under the FTC's Mail Order Rule, a stated shipping time needs a reasonable basis, and if it slips you must seek consent to the delay or promptly refund.
A refill reminder can be timed from the customer's own purchase history. One 2023 segmentation study added a time measure, T, built from a customer's purchase dates, to recency, frequency and monetary value. Invented example: orders on day 0, 30 and 62 leave gaps of 30 and 32 days, an average of 31, so the next is due near day 93. A reminder whose main purpose is promotion is commercial email under CAN-SPAM.
In purchase data with no explicit churn flag, lapsed has to be defined by a rule. One 2026 e-commerce churn study counted customers as churned after more than 90 days without activity, and also tested cutoffs of 30, 60 and 120 days; each cutoff selects a different group. A win-back email is still covered by CAN-SPAM: the FTC's own example of covered mail is a note telling past customers about a new product line.
Segmenting means grouping customers so each group gets messages that fit it; RFM analysis, for example, sorts customers by the recency, frequency and monetary value of their purchases. GSA's email team describes the choice in its own setting: rather than sending one email to everyone, it sends targeted messages only to people who need the information, to avoid overloading inboxes. Each segment's marketing email still needs an opt-out.
RFM stands for recency (time since the last purchase), frequency (number of purchases) and monetary value. Studies differ on monetary: one sums each customer's spending, another uses average spend per order, so check which a report means. One scoring method sorts each measure into five equal groups, quintiles, scored 1 to 5. Invented example: a customer who bought last week, often and big might score 5-5-5; one gone a year scores low on R.
List quality starts with how addresses get on the list. CAN-SPAM carries criminal penalties for harvesting addresses or generating them by a dictionary attack, which sends to made-up addresses in the hope that some are real. Removal takes care too: writing about mailing lists that relay messages, NIST notes a message can bounce for failing DMARC authentication, and advises not unsubscribing the recipient when that caused it.
SPF lists the servers allowed to send mail for your domain; DKIM signs each message cryptographically so receivers can check it against a public key you publish. DMARC ties both to the From address people see and tells receivers what to do with mail that fails: reject it, send it to junk, or do nothing. Separately, reputation services rate mail by the sending domain or IP's history, and spoofing can get a brand's real mail blocked as spam.
CAN-SPAM is built around the recipient's right to make you stop: every marketing email needs a working opt-out, and the FTC notes a business does not need its members' consent to send them marketing email. Other channels set a higher bar. Commercial email sent to wireless-carrier domains on the FCC's list needs the recipient's express prior authorization, and marketing texts sent with an autodialer need prior express written consent.
Each commercial email must explain clearly how to opt out, and the mechanism must keep working for at least 30 days after sending. You must honor a request within 10 business days, and you cannot charge a fee, demand more than an email address, or require more than a reply email or a visit to one web page. Once someone opts out, you cannot sell or transfer the address, except to a firm you hired to help you comply.
CAN-SPAM bars deceptive subject lines: the subject must accurately reflect what the email contains. It can also set a mixed message's legal category. If a recipient reading the subject would likely conclude the email is an ad, the FTC treats a mixed message as commercial, with all of CAN-SPAM's rules. Misleading claims inside can also fall under the FTC Act's ban on deceptive ads, and each violating email can draw its own penalty.
The FCC treats a text sent with an autodialer as a call under the Telephone Consumer Protection Act, and its rules require prior express written consent for marketing ones: a signed written agreement that names the phone number and authorizes the seller's messages. As of October 2026, the FCC's rule text lets people revoke by replying words such as stop, quit or unsubscribe, and requires honoring that within 10 business days.
One way to let subscribers cut back sits inside the unsubscribe step. CAN-SPAM lets a sender offer a menu so a recipient can opt out of certain types of messages, as long as one option stops all marketing email. So a subscriber who finds daily deals too much can drop those and keep, say, a monthly newsletter, while the stop-all choice stays available and must be honored within 10 business days.
Opens are tracked with hidden pixels, tiny embedded images: when one downloads, an open is logged. A 2026 study of an email campaign counted an open only when its embedded images were downloaded, to cut false opens from automated scanners, and still reported a margin of error from image blocking and privacy settings. An open shows that the images loaded, not that a person read the message.
A store loyalty program gives discounts or promotions when shoppers link purchases to an email or phone number; a December 2024 CFPB report found 73 of the top 100 retailers offer a free one. Some are tiered, with free entry and paid upper tiers, or status earned by annual spending. They also capture valuable customer data, and the CFPB notes consumer reports of getting a store card when they thought they were joining a free program.
An auto-renewing subscription is what the FTC calls a negative option arrangement: the seller treats the customer's silence or failure to cancel as acceptance. The FTC names common forms, including automatic renewals, continuity plans that ship goods on a schedule until canceled, and free trials that convert to paid. One 2026 e-commerce study calls churn, the share of customers who stop, one of the most critical performance indicators.
Churn is the proportion of customers who stop buying from, or using, a business. The FTC has noted rates may be monthly, quarterly or annual, and reading a monthly rate as annual can badly understate yearly cancellations. Invented example: if 120 of 2,000 subscribers active on March 1 cancel in March, that group's March churn is 6%. Without a cancel event, lost needs a rule, such as 90 days without activity.
Churn is often split in two: voluntary, when the customer decides to leave, and involuntary, when the business ends the service, for example after nonpayment. In its 2024 rulemaking, the FTC described involuntary or passive cancellations as ones where the payment method on file cannot be processed, and noted some may be deliberate, such as closing a card to escape a subscription that was hard to cancel.
ROSCA, the federal law on online negative option sales, requires simple mechanisms for stopping recurring charges. A 2021 FTC policy statement read that as cancellation at least as easy as signing up. The FTC's 2024 rule spelling this out was vacated by the Eighth Circuit in July 2025, reinstating the older rule; the FTC restored its text in February 2026. Separately, Amazon's 2025 Prime settlement requires same-method cancellation.
A negative option treats a customer's silence or failure to cancel as acceptance, as in auto-renewals and free trials that turn paid. For online sales, ROSCA requires the seller to disclose all material terms clearly and conspicuously before taking billing details, get express informed consent before charging, and offer a simple way to stop charges. The FTC's Negative Option Rule itself covers only prenotification plans such as book clubs.
If you reward customers, with cash, discounts, free products or a chance at a prize, for recommending your store, the FTC's Endorsement Guides count that as a possible material connection: one the audience would not expect must be disclosed clearly and conspicuously, and the advertiser should help ensure it is. For email, the FTC says rewarding forwards may make a seller responsible under CAN-SPAM, and rewarding referrals likely does.
A 2020 study surveyed 409 customers of one large Chinese online retailer and found their views of its return, exchange and repair services linked, through satisfaction and trust, to their stated intention to buy again. Read it as an association, not proof: it measured intentions rather than actual repeat orders, covered one store, and its authors warn the results may not carry over to other countries.
NPS asks how likely you are to recommend a business on a 0 to 10 scale; 0 to 6 count as detractors and 9 or 10 as promoters, and the score is the promoter percentage minus the detractor percentage. Invented example: 50% promoters and 20% detractors give +30. A 2022 systematic review notes that business research did not support early claims, such as predicting customer loyalty, and that multi-question measures outperformed the single item.
G. Fulfillment, inventory, and returns
In-house fulfillment puts the whole warehouse routine on your payroll: receiving and shelving stock, picking the exact items in each online order, boxing them and labeling the boxes for the carrier. The work carries real injury risk; GAO found overexertion the most common hazard in warehousing and delivery. Whoever packs the box, the FTC holds the seller to the ship time it advertised.
A third-party logistics provider (3PL) stores and handles goods it does not sell; Census Bureau text on warehousing firms lists services such as inventory control, order fulfillment, pick and pack, and packaging. Outsourcing does not move legal duty: FTC staff say the seller is liable when its fulfillment house breaks the shipping rule, and in deciding whether to act they weigh steps such as contracts requiring compliance and seeded test orders.
Dropshipping, as an FTC complaint describes it, means your store lists products it keeps no stock of; each order is passed to a third-party supplier that ships straight to the shopper. You give up direct control of stock and shipping but not responsibility. FTC staff say the seller, not the drop shipper, is liable for shipping-rule violations, and that the seller can build into its promised dates the time to pass orders on and get a response.
Under the FTC's mail, internet or telephone order rule, a ship time you state or imply needs a reasonable basis when you make it; if you state none, you need a basis to ship within 30 days, or 50 if the buyer applies to you for credit. FTC staff point to anticipated demand, inventory or sources of supply, and whether fulfillment can handle a season's combined demand. The rule's clock ends at shipment, when goods reach the carrier.
GAO reports that online shopping has changed parcel delivery, with consumers expecting orders within a day or two. Advertised speed is an obligation, and the FTC rule measures it at shipment: staff say a seller claiming it ships in 48 hours "most of the time" must ship, or send a delay notice, within 48 hours on every order, since shoppers will read the claim as a promise. Speed also costs: ITA notes overnight delivery abroad can be expensive.
Carriers price speed: ITA notes that overnight or two-day delivery abroad is possible but can be expensive, especially for heavy items, while postal service costs less and takes longer. Each option you sell is a commitment. FTC staff say that charging customers for delivery insurance implies you will honor a genuine loss claim with prompt reshipment, or a prompt refund if reshipping is impossible.
Dimensional weight reflects density, how much space a parcel takes up relative to what it weighs, GAO explains. One GSA contract defines it as length times width times height in inches, divided by a set number. With an illustrative divisor of 160, a 20 x 16 x 12 inch box is 3,840 cubic inches, or 24 pounds dimensional, even holding 5 pounds; a 16 x 12 x 10 box cuts that to 12. The divisor is a carrier or contract term.
A shipping box does two jobs that pull against each other. ITA tells exporters to pack goods so they arrive in good condition and to insure against damage, loss, pilferage or delay. Yet carriers can base rates on a package's size as well as its weight, a practice GAO calls dimensional weighting, so empty space and oversized cartons can raise shipping costs. The aim is the smallest carton that still protects the item.
CBP bases U.S. import duties on an item's tariff classification, country of origin and value, so paperwork needs an accurate description and price; misstating either is illegal. Who pays is a term of sale, and Incoterms, the trade rules that assign such tasks, include DDP, Delivered Duty Paid. ITA notes that if duty is left unpaid the recipient pays on delivery, and a surprised buyer may refuse the parcel, costing the seller return freight.
If an order will ship late, the FTC's mail-order rule requires you to tell the buyer reasonably quickly, no later than the promised ship date or 30 days if none was given, and offer the choice to cancel for a full refund. FTC staff say email works, but a notice posted only on an order-status page fails if the customer does not visit in time; it is a good backup. CBP notes that a lost mail parcel without tracking can be impossible to trace.
Inventory research separates a backorder, where the buyer waits for later stock, from a lost sale, where the demand is gone. A study of online grocery retail notes that shoppers hit by a stockout are far likelier than in-store shoppers to cancel the whole basket, so the cost includes lost revenue now and churn later. Because that is hard to price, retailers often set a service-level target: the share of demand to fill from stock.
Before you advertise an item, the FTC expects a reasonable basis to ship it, including enough inventory or supply for expected demand. If oversold units mean you cannot ship on time, you must promptly offer a revised date and a free way to cancel, or cancel and refund. You cannot quietly ship something materially different, such as another color, unless the buyer agrees in advance; FTC staff treat style and color differences as material.
If one stock pool sells on your own site and on marketplaces, a sale that does not reach the shared count before the next shopper sees the item can let the last unit sell twice. ITA notes that most transactional sites tie checkout to back-office inventory and order systems. The FTC's mail-order guidance asks how inventory is monitored and coordinated with demand, and an order you cannot ship on time means a delay notice or refund.
GAO describes the reorder point as the threshold at which on-hand plus on-order stock prompts a new order, set to cover demand during the reordering period plus a safety level. Worked example with invented numbers: you sell 20 units a day, the supplier takes 10 days, and you hold 60 units of safety stock, so you reorder when on-hand plus on-order stock falls to 20 x 10 + 60 = 260. The trigger counts stock already ordered, not just the shelf.
A safety level, in GAO's description, is reserve stock kept for minor interruptions in resupply or unpredictable swings in demand, and an older GAO report says it covers fluctuations in both demand and lead times. Normal demand during the lead time is covered separately, by the lead-time level. So the more erratic your sales or your supplier's delivery dates, the bigger the buffer an item needs, while a steady item needs little.
GAO splits lead time into an administrative part, from identifying the need to placing the order, and a production part, from the order to receipt. Both feed the reorder calculation, so the figures must stay current. In a 2003 report GAO found the Navy had cut administrative lead time on some contracts from 200 days to 130 but had not updated its computations, which left its inventory requirements overstated.
Seasonal effects, in the Census Bureau's definition, are patterns that repeat at the same time each year, such as a September rise in heating oil output; analysts remove them to see the underlying trend. One-time spikes need the same care. On one item GAO reviewed, a Defense Logistics Agency planner judged a forecast too high and found an earlier jump in demand that was nonrecurring; high forecasts can leave excess stock, and low ones shortages.
Google's product-variant markup shows the discipline: variants that differ by size, color or material sit under a product group with its own unique group ID, and each variant needs a unique ID, such as its SKU, or stock-keeping unit. Variant data also matters under the FTC's mail-order rule: staff treat color and style as material, so shipping another color in place of an out-of-stock one needs the buyer's express prior consent.
Holding costs, as GAO describes the Defense Department's, include the cost of capital locked up in inventory, plus storage and obsolescence. GAO reported in 1994 that DoD used an annual rate of 18 percent of purchase price for clothing and textiles. Worked example on an invented item: a $50 product held three years at that rate costs $27 to carry, and after about five and a half years the carrying cost passes its price.
Easier returns can be a selling point: in China, Alibaba and an insurer introduced return-shipping insurance in 2011 partly to bolster online demand, and a 2025 game-theory model finds a seller offering it can gain demand and profit under some conditions. Leniency has a cost too. A 2026 paper, citing earlier studies, attributes rising return rates partly to relaxed return policies, alongside products that differ from their ads and late delivery.
Studies of online returns keep pointing to fashion, but the return rates they quote mostly rest on other work and disagree widely, so treat any single figure with care. One such paper lists lenient return policies, products that differ from their ads, and late delivery among the causes of rising returns, and suggests prompts such as size recommendations and fuller product details for shoppers likely to return.
A typical return travels backward: shipped back, inspected, then routed to resale, repackaging or disposal. Research models of e-commerce returns assume a returned product can be resold as new after inspection or repackaging, and weigh whether the retailer or the manufacturer should handle returns. Inspection includes a legal check: federal law bars selling recalled consumer products, and CPSC guidance on it addresses reverse logistics providers.
A refund returns the buyer's money; an exchange swaps the item for another version, as some return models allow for a mismatch; store credit holds the value for later. When the FTC's mail-order rule requires a refund for an unshipped order, such as a canceled late one, credit toward future purchases, vouchers and scrip do not count; refunds of cash, check or third-party card payments are due within seven working days.
A return that cannot sell as new needs a lawful next step. Federal law forbids selling a recalled consumer product, so check recall status first. An item resold as a second at a lower price needs a disclosure that any higher comparison price is for the perfect version, under FTC pricing guides. For tax inventory, IRS Publication 538 values damaged or shopworn goods at their bona fide selling price less the direct cost of disposing of them.
Research on product returns reports that a major share are false failure returns, goods with no functional or cosmetic defect, and one e-commerce paper lists a gap between the advertising and the actual product among drivers of rising returns, suggesting size recommendations and fuller product details. That makes customers' return reasons a feedback loop: one study says learning the actual reasons for returns opens ways to cut them.
H. Trust, security, legal, and strategy
The PCI Data Security Standard is the rulebook a merchant must follow to accept payment cards. A 2014 OCC handbook says it governs every organization that stores, processes or transmits payment data, and the card brands that founded the PCI council enforce it. Its goals include secure networks, protecting stored data and encrypting card data sent over public networks. The OCC adds that compliance does not guarantee against a breach.
The card industry's security standards govern every merchant or organization that stores, processes or transmits payment card data, per the OCC. The FTC's data-security guide adds the simplest defense: keep no account numbers or expiration dates without an essential need, since data not in your system cannot be stolen. A payment token, a random number standing in for the card, can complete a payment and, GAO says, better protects credentials.
In tokenization, card details are replaced with a randomly generated number, the token, that stands in for them. GAO describes mobile wallets doing this and then sending the payment over existing card networks, and says the token better protects consumer account credentials. For a store, the gain is in what it holds: the FTC's rule of thumb is that data not in your system cannot be stolen by hackers.
TLS, Transport Layer Security, encrypts data in transit; the FTC tells businesses to use it or another secure connection whenever they receive or send card or other sensitive financial data. Web.dev calls it a common misconception that only sensitive pages need HTTPS: unprotected pages let intruders watch what visitors do or tamper with what they see, such as by injecting ads. Encrypting stored data is a separate step on the FTC's list.
Under the FTC's Endorsement Guides, an organization's name or seal can be an endorsement, which must come from a process that fairly reflects the group's collective judgment, using recognized experts or standards if it claims expertise. In one example, approval from an official-sounding institute is deceptive if a manufacturer set it up, and can be deceptive even if independent unless valid tests back it. A badge is only as honest as its review.
Card fraud has shifted toward card-not-present (CNP) payments, where no card is shown in person: Fed data show in-person card fraud falling as chip cards spread in 2015 to 2016 while remote fraud rose. Merchants bear much of the loss. In the Fed's 2023 debit card data, merchants absorbed 65.1 percent of CNP fraud losses, assuming acquirers pass on every chargeback, while federal law limits a credit cardholder's liability for unauthorized charges.
For a credit card, per the OCC, a cardholder claiming a billing error, such as an unauthorized charge or goods not delivered as agreed, goes to the issuer, which posts a temporary credit and asks the merchant for documentation. If the issuer upholds the chargeback, the merchant bears the amount, and one that misses the deadline for records loses. If the merchant cannot pay, its acquiring bank, the bank that settles its card sales, must.
Not every chargeback starts with a thief. Billing-error rules let a cardholder dispute goods not delivered as agreed, and the OCC lists quality disputes, such as a claim the goods never arrived, beside fraud claims. The merchant answers with records of the actual sale and delivery, and they must be real: in 2023 the FTC sued a chargeback-dispute firm, alleging it sent card companies screenshots from sites other than where consumers bought.
For remote card payments, a Federal Reserve survey form sorts authentication into two-factor methods, citing 3-D Secure as the example, and other cardholder-provided data such as the security code, expiration date or billing address. Two-factor means proving identity with two distinct authentication factors. The OCC notes that card network rules govern cardholder authentication and vary by transaction type, amount and how the purchase is made.
A fraud screen can err two ways: blocking a good order, a false positive, or passing a bad one. When fraud is rare the first can dominate. Invented example: of 10,000 orders, 100 are fraud; a filter catches 80 but also flags 1 percent of the 9,900 good ones, so it blocks 99 real buyers and fewer than half its flags are fraud. A Fed staff working paper notes that on such data, approving everything scores 99 percent accuracy yet catches no fraud.
Because people reuse passwords, logins stolen in one breach are sold and fed automatically into other sites; the FTC calls this credential stuffing. Lockouts alone fall short, since some attackers pace attempts to slip under them, so the FTC urges combining authentication methods for accounts with access to sensitive data. NIST guidance adds limiting repeated failed logins and checking new passwords against lists that include breached ones.
The FTC's data-security guide says that if you have no legitimate business need for sensitive personal information, do not collect it, and if you do, keep it only as long as necessary. That includes not keeping card numbers and expiration dates without an essential need. An FTC staff report also warns against defaults that gather data people would not expect, citing a researcher who says sites often collect phone numbers they rarely need.
If a company tells consumers it will protect their personal data, the FTC can take legal action to make it keep that promise, often under Section 5 of the FTC Act, the ban on unfair or deceptive practices. Accuracy needs an inventory, which the FTC's security guide also urges: know what personal data you hold, where it enters, and who can reach it. The OCC adds that acquiring banks should require online merchants to post a privacy statement.
With Google's consent mode, for example, basic setup blocks tags until the visitor answers the banner and sends nothing on a refusal; advanced setup loads tags at once, sends cookieless measurements while consent is denied, and may fill gaps with modeling. Refusals leave holes in analytics. Design matters too: an FTC staff report recounts a panelist's dark-pattern example, a banner putting accept front and center while hiding refusal.
Under the FTC's Endorsement Guides, a tie between endorser and seller that might materially affect the weight people give an endorsement, such as payment, free or discounted products, or a family or business relationship, must be disclosed clearly and conspicuously when the audience would not expect it. That means hard to miss and easy to understand. A blogger earning affiliate-link commissions, for example, should disclose them.
The FTC's consumer reviews rule makes it unlawful to provide incentives conditioned on a review being positive or negative, and to write or sell fake reviews. It also bars presenting the reviews on your site as most or all of those submitted while withholding ones for low ratings or negative sentiment. Withholding by neutral criteria applied to every review, such as removing abusive content, does not count as suppression under the rule.
The FTC's substantiation policy requires a reasonable basis for objective ad claims before the ad runs; lacking one violates Section 5 of the FTC Act, and later evidence does not erase that. When an ad states its own support, such as "studies show" or "doctors recommend," the advertiser must hold at least that level of proof. What counts as reasonable turns on factors such as the kind of claim, the product, and the harm a false claim could do.
The FTC's Guides Against Deceptive Pricing treat a former-price comparison as legitimate when the earlier price was genuinely offered to the public, openly and in good faith, for a reasonably substantial period in the recent normal course of business. Raising a price briefly to then "cut" it is the classic fictitious bargain. A list price counts as genuine if substantial sales are made at it in your trade area; one well above that can mislead.
Once you learn an order will miss its promised ship date, or 30 days if you named none, you must tell the buyer reasonably quickly and by that deadline, give a definite revised date or say you cannot, and offer a way to cancel at your expense for a full, prompt refund. Silence can count as consent only to a first delay of 30 days or less. If a revised date will slip, a renewed notice is due before it passes; silence is not consent.
Nexus is the link to a state that lets it make a seller collect and remit its sales tax. The Supreme Court once required physical presence but overruled that in South Dakota v. Wayfair (2018), finding sufficient nexus under a law reaching only sellers above a sales or transaction minimum. GAO reports that by June 2021 every state with a statewide sales tax had economic nexus rules, and all but one made marketplaces collect for their sellers.
Origin sourcing applies the tax rate at the seller's location; destination sourcing applies the rate where the product goes. A 2013 CRS report calls destination sourcing the general rule under the Streamlined Sales and Use Tax Agreement, a multistate pact to simplify sales taxes, for sales from out-of-state sellers. Because local rates and bases can differ within a state, GAO found multistate sellers using software to find each sale's rate.
Justice Department guidance from March 2022 says Title III of the Americans with Disabilities Act, covering businesses open to the public such as retail stores, applies to what they offer on the web. With no detailed technical rule for them, it leaves them flexibility and points to WCAG, the Web Content Accessibility Guidelines, and warns a clean automated scan does not prove access. The guidance itself says it has no binding legal effect.
Research on online channels describes three formats: selling through your own site, agency selling via a marketplace that charges a fee, and wholesaling to online retailers that resell. ITA calls marketplaces an efficient way to find buyers without building a store site, but advises exploring your own store before relying on them alone for the long term. Several channels can bring channel conflict, where they compete and cannibalize sales.
ITA defines localization as adapting a website to a market's linguistic, cultural and commercial requirements, and its checklist goes past translation: payment preferences, prices in local currency, metric measurements, and duty and tax information. Payment habits differ by market, so ITA suggests checking which methods buyers prefer and how a processor handles disputes and fraud there. Accepting local currency also brings exchange-rate risk.
ITA's export guide warns that setting up a site does not guarantee customers, so a store must be promoted. Big-profit store pitches have drawn FTC action: in its case against Ecommerce Empire Builders, the FTC alleged that promised monthly profits from done-for-you stores never materialized and that ongoing costs, especially marketing, were understated; a 2025 settlement order bars the defendants from unsupported earnings claims.
Keentune is not affiliated with or endorsed by the organizations whose documentation informs these maps.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.