Navigating International Sales Legalities for Digital Goods

When you sell digital goods to customers in other countries, you step into a web of laws that differ from your home market. Taxes, consumer rights, data privacy, IP protection — each area carries its own rules and penalties for non-compliance. The core challenge is that digital products are intangible and can be sold anywhere instantly, but legal obligations follow the buyer’s location.

This article covers the main legal areas to address when selling digital goods internationally: tax registration, consumer protection laws, data privacy requirements, IP enforcement, and export controls. Following these guidelines helps minimize risk and keeps your business operating legally across borders.

Do You Need to Collect and Remit VAT or GST?

Value-added tax (VAT) or goods and services tax (GST) is often the first hurdle. Unlike physical goods, digital products are taxed in the country of the consumer, not the seller. The European Union, Australia, New Zealand, Japan, and many other jurisdictions require foreign sellers to register for VAT/GST once their sales exceed a certain threshold (e.g., €10,000 in the EU marketplace scheme).

Collect the correct rate at checkout and file regular returns. Most digital platforms like Gumroad or Selz handle this automatically, but if you sell directly via your own site, you need a tax compliance service or direct registration. Penalties for non-collection can include back taxes plus fines.

Which Consumer Rights Apply to Your Digital Products?

Consumer protection laws vary widely. The EU Consumer Rights Directive gives a 14-day withdrawal period for digital content and services, unless the consumer has expressly waived that right by downloading or streaming. Australia’s Consumer Law requires digital products to be of acceptable quality and fit for purpose. In the United States, consumer rights are more contract-based, with fewer statutory withdrawal rights.

Your terms of sale should specify the applicable law and jurisdiction, but be aware that mandatory consumer protections in the buyer’s country may override your choice of law. Provide clear refund policies that comply with the stricter regime between your law and the buyer’s. Check whether your product qualifies as a “digital good” under local definitions — some tax or consumer laws treat streaming services differently from downloads.

How Does Data Privacy Law Affect International Sales?

If you collect personal data (email addresses, names, payment details), privacy laws like the EU’s General Data Protection Regulation (GDPR) and Brazil’s LGPD apply. GDPR requires a lawful basis for processing, a clear privacy policy, and data subject rights (access, erasure, portability). You must also have mechanisms for consent or legitimate interest, and keep records of processing activities.

Transferring data outside the EU is restricted unless you use standard contractual clauses or rely on an adequacy decision. Read our guide on How to Comply with GDPR for Digital Product Sales for step-by-step implementation. Neglecting privacy can lead to fines up to 4% of global annual turnover.

Protecting Your Intellectual Property Across Borders

Copyright protection is automatic in Berne Convention countries, but trademarks and patents require registration in each jurisdiction. A US trademark does not protect you in China or the EU. File for protection in your key markets before launching. For digital goods, watermarking, license keys, and DRM platforms help enforce IP but do not substitute for legal rights.

In some countries, local laws may allow parallel imports or limit enforcement against private use. Work with an IP attorney in major markets to draft end-user license agreements (EULAs) that are enforceable locally. Consider registering your copyright formally in the US (Copyright Office) to enable statutory damages in US courts.

Export Controls and Encryption Restrictions

Software and digital content that includes encryption is subject to export controls under regimes like the Wassenaar Arrangement. The US Export Administration Regulations (EAR) classify encryption software and may require a license for distribution to certain countries (e.g., Iran, North Korea, Syria). Even publicly available open-source encryption can be restricted if it uses certain key lengths.

Check your product’s classification under your home country’s export control list. Many commercial encryption products qualify for “mass market” treatment with less restrictive rules, but you must self-classify and keep records. Violations can result in criminal penalties and loss of export privileges.

Step-by-Step: Getting Compliant for International Sales

1. Identify your target markets. List the countries where you expect customers. Prioritize high-traffic jurisdictions like the EU, US, Australia, and Japan.
2. Check tax thresholds. For each country, note the VAT/GST registration threshold. If you exceed it, register and start collecting the correct rate.
3. Review consumer laws. Ensure your refund policy and terms meet the most protective applicable law (likely the EU Consumer Rights Directive).
4. Draft a compliant privacy policy. Include required disclosures for data collection, processing purposes, third-party sharing, and international transfers.
5. Implement consent and rights tools. Add cookie consent, data subject request forms, and a process for handling complaints.
6. Register IP in key markets. File trademark applications in your top sales countries. Consider design patents for graphic works.
7. Classify export controls. Determine if your product contains encryption. If yes, verify whether you need a license or can use an exception.
8. Choose a contract law and jurisdiction. State in your EULA that certain disputes will be handled under a specific law, but acknowledge mandatory protections.

Common Compliance Mistakes to Avoid

One frequent error is assuming a single policy works everywhere. For example, offering a 7-day refund in the EU violates the 14-day withdrawal right. Another mistake is ignoring data transfer restrictions — storing EU customer data on US servers without a proper safeguard mechanism breaches GDPR. Sellers also overlook the ongoing obligation to monitor sales volumes; once you cross a VAT threshold, you must act immediately, not at year-end.

Finally, do not assume that platform liability shields you. If you sell through a marketplace that handles tax, the platform may be liable for collection, but you remain responsible for consumer rights and IP. Always maintain records of your compliance steps for at least the statutory retention period in each market.

Frequently asked questions

Do I need to charge VAT on digital sales to EU customers?

Yes, if your annual sales to EU customers exceed €10,000 (or a lower country-specific threshold). You must register for the VAT in the member state where your customer resides, collect the appropriate rate, and file returns. Many sellers use the One-Stop Shop (OSS) scheme to handle multiple EU countries through a single portal.

What are the consumer rights for digital goods in the EU?

EU consumers have a 14-day right of withdrawal from the purchase of digital content, unless they expressly consent to immediate access and waive that right. The product must also be fit for purpose, match the description, and be of satisfactory quality. Digital goods are covered under the Sale of Goods Directive, which mandates a 2-year legal guarantee.

How does GDPR apply to selling digital products internationally?

GDPR applies to any business that processes personal data of individuals in the EU, regardless of where the business is located. You must have a lawful basis, provide a privacy policy, enable data subject rights, and ensure adequate safeguards for data transfers outside the EU. Non-compliance can result in fines up to €20 million or 4% of annual turnover.

Can I use US copyright law to protect my digital goods worldwide?

No, copyright protection is territorial. While the Berne Convention provides automatic protection in member countries, enforcement depends on local law. To fully protect your digital goods, you should register copyrights in major markets (e.g., US Copyright Office) and consider local registrations where applicable. A US registration helps in US courts but not abroad.

Are there export restrictions on software with encryption?

Yes, many countries restrict the export of encryption software under regimes like the Wassenaar Arrangement. In the US, the Export Administration Regulations (EAR) classify encryption items. Most mass-market software with limited encryption (e.g., SSL/TLS) qualifies for an exception, but you must self-classify and submit an annual classification request to the Bureau of Industry and Security.