Most UAE online stores are running on a returns policy copied from a well-known overseas retailer, English-only product pages, and a general sense that consumer law is something that happens to other people.
The framework here is real, it applies to free zones, it applies to e-commerce, and the penalty ceiling for misleading advertising is imprisonment of up to two years and a fine of up to two million dirhams.
None of this is difficult to comply with. It is just different from what most store owners assume, and almost all of it is cheaper to build in than to retrofit.
The framework, in one paragraph
Consumer protection in the UAE runs on Federal Law No. 15 of 2020, amended by Federal Decree-Law No. 5 of 2023, with operational detail in Cabinet Resolution No. 66 of 2023 [1][2][3]. The Ministry of Economy oversees it and operates a consumer protection function [4][5].
The scope is broad and worth reading carefully, because the exemptions people assume exist do not.
The provisions apply to all goods and services in the UAE, including free zones, as well as related operations carried out by suppliers, advertisers or trade agents, including through e-commerce where the supplier is registered in the UAE [1][4].
So a free zone licence is not an exemption. Selling only online is not an exemption. Being small is not an exemption.
Three frameworks, one customer
Worth mapping explicitly, because online sellers routinely satisfy one and assume they have covered the others. They overlap and they are not the same obligations.
Consumer protection governs what you must tell the customer, in what language, what happens when goods are faulty, and how you may advertise. It is enforced by the Ministry of Economy and the emirate-level economic departments.
VAT and tax governs what you charge, what a tax invoice must contain, and what records you keep. It is enforced by the Federal Tax Authority, and our guide on VAT-compliant ecommerce covers it.
Data protection governs how you collect, use, store and delete personal information about that same customer. It is a separate framework with its own regulator, covered in our PDPL guide.
The overlaps are where mistakes happen. Your invoice has to satisfy both consumer protection, which specifies language and fields, and VAT, which specifies tax detail. Your displayed price has to satisfy consumer protection on transparency and VAT on inclusivity. Your customer email address is governed by data protection generally, by a specific consumer protection provision about promotional use, and by separate telecoms rules on unsolicited messages.
A store that has done thorough VAT work and nothing else is not compliant. Neither is one with an excellent privacy policy and an English-only catalogue. The frameworks do not substitute for one another, and each has its own enforcement route.
The practical response is not to run three compliance programmes. It is to make one list of what your store actually does, and check it against all three at the same time, which is an afternoon rather than a project.
The rights that a policy cannot remove
This is the single most important thing for an online seller to understand, and it is where the copied policy causes damage.
The law creates consumer rights. Your terms and conditions cannot contract out of them. A clause saying all sales are final does not remove an obligation the law imposes on you, however prominently it is displayed and however many customers accept it at checkout.
You can absolutely have a returns policy. It should set out your process, your timeframes and how you handle change of mind. What it cannot do is override the statutory position on faulty goods.
The consumer rights the framework establishes include being provided an appropriate and safe environment when purchasing, obtaining correct information about goods they purchase, having the right to choose among available products and services, and obtaining fair compensation for damage suffered as a result of purchasing or using defective goods [4].
Read that last one alongside the specific mechanics below.
Faulty goods: the numbers that matter
Three provisions, and they are more specific than most sellers realise.
Refund on defect. Where goods have no warranty, or where the spare parts warranty conflicts with the full product warranty, or where there is no commercial agent or distributor warranty, the provider must take the goods back and refund the price if the defect or fault is discovered within thirty days from the date the defect appears, whether apparent or hidden [1].
Notice the clock. It runs from when the defect appears, not from the date of sale. A hidden fault emerging later can still engage the obligation. A returns window built purely around a purchase date is working from a rule the law does not state.
Repair standards. Where a provider repairs rather than refunds, the repair must be carried out with the necessary professionalism, and the repair and any replaced parts must be guaranteed for not less than fifteen days from delivery to the consumer, unless the nature of the parts or the service requires longer. The exception is where the fault arose from the consumer's own use [1].
The seven-day rule. If the repair takes more than seven days, the provider must give the consumer a similar alternative good to use free of charge for the period they cannot use their own [1].
That third one is the least known and the most operationally significant. It converts a slow repair from an inconvenience into a logistics commitment, and it is worth knowing before you design a repair process rather than after a customer cites it.
What your product pages must carry
Online businesses must provide details about their licensing entity, information in Arabic about the product or service provided, its specifications, the terms of the contract, payment terms, and the warranty [4].
Three things in that sentence catch stores out.
Arabic product information. Not a translated policy page. Information about the product or service itself. An English-only catalogue selling to UAE consumers does not meet this, and it is the single most expensive item to retrofit once a catalogue has grown to thousands of SKUs. Our guide on multilingual website development covers doing it properly, and machine-translating a product catalogue is a weak answer to a legal obligation.
Licensing entity details. Your trade licence information belongs somewhere findable. Most stores that fall short do so through oversight rather than intent, and it is a footer change that also happens to build trust with customers checking whether you are a real business.
Warranty terms, stated. Not implied, not left to the manufacturer's page, stated by you.
What good looks like on a product page
To make the requirements concrete, here is what a compliant product page carries that most UAE stores do not.
Product information in Arabic as well as English. The description, the specifications, the materials or ingredients, the dimensions. Not a translated policy link at the bottom of the page.
The price the customer will pay, inclusive of VAT, shown at every point a price appears rather than only at the final step.
Warranty terms stated by you, not merely a link to a manufacturer's global page that may not reflect what you are actually offering in this market.
Delivery expectations, since a delivery estimate is part of the contract terms the customer is agreeing to.
A visible link to returns and refunds, from the product page rather than only from the footer, so the customer can find it before deciding rather than after a problem.
Your licensing entity details, reachable from the page, usually via the footer, so a customer who wants to check whether you are a licensed business can do so in one click.
None of that requires a redesign. All of it is content and configuration, and a developer can add the structural pieces in a day. The Arabic content is the part with a real cost attached, and it is the part that gets more expensive every month you postpone it while the catalogue grows.
If you are building a new store, put these in the specification rather than discovering them at launch. Our guide on ecommerce website development covers the build, and this list belongs in the requirements alongside the payment gateway and the shipping rules.
Invoices
A dated invoice in Arabic showing the trade name, the address, the type of product, the price and the quantity [4].
Many stores issue an English-only order confirmation email and treat it as an invoice. Those are not the same document and the confirmation usually lacks several required fields.
This is normally a template change rather than a development project. It is worth doing before anybody asks for it.
Price display
Prices shown to consumers should be the price the consumer pays. In a VAT context that means inclusive rather than exclusive.
Adding tax at the final checkout step, after the customer has already decided, is both a compliance risk and one of the best-documented causes of cart abandonment there is. Our guide on checkout optimisation covers the commercial half of the same point, and our guide on VAT-compliant ecommerce covers the tax half.
The two frameworks meet at the invoice and the displayed price. VAT determines what you charge and what a tax invoice must contain. Consumer protection determines what the customer must be told and in what language. Satisfying one does not satisfy the other.
Advertising carries the same exposure as the product
This is the part marketing teams do not expect.
Penalties for misleading advertising, providing false information, or failing to repair or replace defective products can reach imprisonment of up to two years and a fine not exceeding two million dirhams [4].
Those are ceilings rather than typical outcomes. They are also a clear signal that your marketing copy sits inside the same risk perimeter as your fulfilment.
The fake discount question deserves naming directly. Presenting a price as reduced from a figure the product was never genuinely sold at is precisely the shape of conduct these provisions address. If you run a permanent sale where the original price is fictional, that is worth reviewing with your adviser rather than treating as a marketing convention imported from another market. It being common practice somewhere else is not a defence.
The same logic applies to scarcity claims, countdown timers that reset, and stated availability that does not reflect stock.
The data provision people miss
Suppliers must protect consumers' privacy and data security, and refrain from using consumer data for promotional and marketing purposes [4].
That sits inside consumer protection law rather than data protection law, which is why it surprises people who have read one and not the other.
It constrains a practice many stores treat as routine, and the practical implication is that the basis on which you market to your customer list needs care rather than assumption. Discuss it with your adviser.
There are also separate rules on unsolicited electronic marketing enforced by the telecoms regulator, covered in our guide on marketing messages and telemarketing rules. Between the two frameworks, the defensible position is explicit consent rather than inferred permission.
And separately again, your obligations under the data protection framework apply in full. Our guide on PDPL compliance covers that.
Three frameworks, one customer email address. They do not collapse into each other.
Complaints, and why speed pays
Suppliers are obliged to settle consumer disputes promptly [4].
That is stated as an obligation rather than defined as a number of days, so the practical standard is what a reasonable person would expect.
What matters commercially is that the Ministry of Economy operates a consumer complaints route, publicised on its own channels including a consumer helpline, and individual emirates run consumer protection functions through their economic departments [4][5][6].
Your dissatisfied customer therefore has an easy escalation path that does not involve you and that you would rather they did not take.
The businesses that avoid escalation are not the ones with the best policies. They are the ones with a named owner for complaints, a stated response time, and somebody who can resolve a case without collecting three approvals. That is a process decision rather than a legal one, and it is entirely within your control.
What your returns policy should actually say
Two processes, kept separate, because merging them is where most policies go wrong.
Faulty goods. What the customer does, what you do, timeframes, who pays return shipping, and how the refund is issued.
Change of mind. Your commercial policy, which has more room, provided it is clearly displayed before purchase.
The failure mode is a single policy whose change-of-mind terms quietly apply to faulty goods, so a customer with a genuine defect is told they have missed a fourteen-day window and must pay return postage. That is the version copied from overseas retailers, and it is the version that produces complaints.
Where to display it. Linked from the product page and the checkout, not buried in a footer. A policy the customer first encounters during a dispute has not achieved what a displayed policy achieves.
Who should write it. Write the operational version yourself, because you are the only one who knows what your team can actually deliver, then have it reviewed. Policies drafted entirely externally tend to promise processes that do not exist, which is worse than a simpler policy you can honour every time.
Edge cases worth resolving properly
Digital products and services. The law covers goods and services rather than physical goods alone, so software, subscriptions and digital content are in scope. The mechanics differ, since a defective download is not returned like a defective appliance, and the obligations around accurate information, warranty terms and not misleading the consumer apply just as directly.
Marketplace selling. If you are the supplier, the obligations are yours regardless of whose platform runs the transaction. Marketplaces impose their own policies on top, frequently exceeding the legal minimum, and complying with a marketplace's rules is not the same as complying with the law. Our guide on selling through Noon and Amazon covers the platform layer.
Business customers. Consumer protection protects consumers, so business-to-business sits largely outside it. The boundary is less clean than sellers assume, particularly with sole traders and mixed use. If your customer base is mixed, take advice rather than assuming the whole framework is out of scope.
Selling into the UAE from outside. The e-commerce provisions are framed around suppliers registered in the UAE. Cross-border selling raises questions about which framework applies and how it would be enforced, which is worth resolving properly if a material share of your revenue depends on it.
Free zone companies. Covered, as above. Free zone status affects ownership, tax treatment and where you may sell, which our guide on free zone versus mainland addresses. None of it removes your obligations to consumers.
Your platform will not do this for you
Worth stating plainly, because the assumption is widespread.
Shopify, WooCommerce and every other platform give you the fields for policies, tax settings and translations. They do not decide what your obligations are and they do not fill them in.
A default store is configured for a generic international seller. Every UAE-specific obligation in this article is something you configure or write, and nothing in the admin interface warns you if you do not. Our guide on Shopify versus WooCommerce versus custom covers choosing the platform; none of the options changes this.
Who owns this internally
Nobody, in most stores, which is the underlying reason the gaps persist.
Consumer protection compliance sits awkwardly between three functions. Marketing writes the advertising copy and the product descriptions. Operations handles returns and repairs. Whoever manages the website configures the tax display and the policy pages. None of them owns the whole obligation, and each reasonably assumes somebody else has checked.
Give it to one person, and give them the four-check audit above as a recurring task rather than a one-off. Quarterly is ample. The check takes under an hour once the store is in reasonable shape, and it catches the drift that accumulates as new products are added, new campaigns launch, and policy pages are edited by whoever needed a change that week.
The same person should own complaints. That pairing matters more than it looks, because somebody who handles complaints develops an accurate picture of where the store's promises and its behaviour diverge, which is exactly the information the compliance check is trying to surface.
Where a business is too small for that to be a distinct role, it belongs with whoever owns the store commercially rather than with a developer or an agency. Agencies build what they are asked to build. Nobody outside your business is going to notice that your product descriptions exist only in English.
The one-hour audit
Four checks. Most stores fail at least two and none takes long to fix.
Does your returns policy contain anything unenforceable, such as a blanket no-returns clause or terms that apply your change-of-mind window to faulty goods?
Does your product information exist in Arabic, meaning the product information itself rather than a translated policy page?
Do your prices display inclusive of VAT, at every point the customer sees a price rather than only at the end?
Do your licence details appear anywhere on the site, findable rather than technically present?
Then two more, if the first four go well. Does your invoice carry the required fields in Arabic? And does anybody own complaints with a stated response time?
The economics here are unusual and worth noticing. Policy pages, invoice templates and licence display are trivial to fix at any time. Arabic product information across a large catalogue is a real project that gets more expensive every month you add SKUs. That asymmetry is the entire argument for handling this at build time.
If you want an outside view, a store compliance review covering your policies, product information, price display, invoicing and licence disclosure, with a written list of what to change, starts from around AED 2,500 with us. Implementation is priced separately by scope. Final pricing depends on scope, and these are our own figures rather than a market survey.
For anything turning on how a provision applies to your specific situation, take legal advice, and we would say so rather than guessing. What we can tell you is what your website and systems currently do, which is usually where the gap actually sits. The legal question is normally narrower than owners expect once the factual position is clear.
References
- UAE Legislation, Federal Law No. 15 of 2020 on Consumer Protection
- UAE Legislation, Cabinet Resolution No. 66 of 2023 concerning the Executive Regulations of the Federal Law on Consumer Protection
- Ministry of Economy, Federal Law No. 15 of 2020 on Consumer Protection
- UAE Government, consumer protection
- Ministry of Economy and Tourism, consumer protection
- Consumer Rights UAE, Blue Book policies regulating the relationship between suppliers and consumers
- SKIMBOX, VAT-compliant ecommerce in the UAE
- SKIMBOX, checkout optimisation for UAE ecommerce
- SKIMBOX, multilingual website development in the UAE
- SKIMBOX, marketplace selling on Noon and Amazon
- SKIMBOX, telemarketing and marketing message rules in the UAE
- SKIMBOX, PDPL compliance in the UAE
This article summarises published UAE consumer protection provisions and is not legal advice. The law has been amended and its executive regulations issued, so confirm the current position with the Ministry of Economy or a qualified adviser before acting on any specific point.
