The Internet Transactions Act (RA 11967) and Philippine E-Commerce Compliance for Foreign Investors in 2026: A Comprehensive Legal Guide

For foreign investors who have been watching the Philippines' e-commerce regulatory environment from the sidelines, the grace period is over. Republic Act No. 11967, otherwise known as the Internet Transactions Act of 2023 (hereinafter "ITA"), officially took full effect on June 20, 2025, following an 18-month transitional period. As of mid-2026, the Department of Trade and Industry (DTI) has moved from advisory enforcement to active compliance monitoring — and the consequences for non-compliance are real and immediate.

This article is written for foreign entrepreneurs, digital nomads, and international business groups who are either operating an e-commerce business targeting Philippine consumers or considering entry into this market. It is a comprehensive, lawyer-grade analysis of: (1) the ITA's legal framework and who it applies to; (2) the DTI E-Commerce Bureau and its Trustmark registration system; (3) BIR tax obligations for foreign digital service providers; (4) data privacy requirements; (5) consumer protection obligations; and (6) a practical compliance checklist with timelines and estimated costs. Every legal reference has been verified against official sources.

1. The Legal Framework: Understanding RA 11967 and Its Implementing Rules

1.1 Republic Act No. 11967 — The Internet Transactions Act of 2023

RA 11967 was signed into law by President Ferdinand R. Marcos Jr. on December 5, 2023, and its full text is available on the LawPhil Project and the Supreme Court E-Library. The law was designed with a specific mandate: to protect both online consumers and online merchants engaged in internet transactions, while building trust in the Philippine digital economy.

The ITA's Section 3 (Scope and Coverage) is critical for foreign investors. It states that the law applies to all business-to-business (B2B) and business-to-consumer (B2C) internet transactions within the mandate of the DTI, where one of the parties is situated in the Philippines or where the digital platform, e-retailer, or online merchant is availing of the Philippine market and has minimum contacts therein. Critically, the law explicitly excludes consumer-to-consumer (C2C) transactions and online media content from its coverage.

The ITA's Section 5 (Extra-territorial Application) is perhaps the most consequential provision for foreign investors:

"A person who engages in e-commerce, who avails of the Philippine market to the extent of establishing minimum contacts herein, shall be subject to applicable Philippine laws and regulations and cannot evade legal liability in the Philippines despite lack of legal presence in the country."

This means that a foreign e-commerce company — whether incorporated in Delaware, Singapore, or Hong Kong — that actively targets Philippine consumers through a website, app, or digital platform, is subject to Philippine law under RA 11967, regardless of whether it has a registered entity in the Philippines. This is the legal foundation for the DTI's enforcement authority over cross-border e-commerce.

1.2 Joint Administrative Order No. 24-03 (2024) — The Implementing Rules and Regulations

The ITA's general provisions required detailed implementing rules. On May 24, 2024, the DTI, in coordination with the Department of Information and Communications Technology (DICT), the Bangko Sentral ng Pilipinas (BSP), the National Privacy Commission (NPC), the Philippine Competition Commission (PCC), the Securities and Exchange Commission (SEC), and the Cooperative Development Authority (CDA), issued Joint Administrative Order No. 24-03, Series of 2024 (hereinafter "JAO 24-03"). JAO 24-03 contains the Implementing Rules and Regulations (IRR) of RA 11967 and is accessible on the DTI E-Commerce Bureau website.

JAO 24-03 operationalizes several key ITA provisions, including the establishment of the DTI E-Commerce Bureau, the registration framework for e-marketplaces and online merchants, the Trustmark system, the Online Business Database (OBD), and the complaint referral mechanism between agencies. For foreign investors, JAO 24-03 specifies the documentation and information that foreign e-commerce operators must submit to operate legally in the Philippine market.

1.3 Department Administrative Order No. 25-12 (2025) — The DTI Trustmark Rules

The E-Commerce Philippine Trustmark is a government-issued digital badge that signals to consumers that an online merchant, e-marketplace, or digital platform has been verified by the DTI. While RA 11967's Section 11 authorized the Trustmark, it was DAO 25-12 — issued by the DTI — that established the detailed rules for its implementation.

Under DAO 25-12, the Trustmark is mandatory for all online merchants, e-marketplaces, e-retailers, and digital platforms conducting e-commerce in the Philippines. As of early 2026, the DTI has recorded approximately 18,405 Trustmark applications, reflecting growing — though still incomplete — industry uptake. Despite high application volumes, the DTI announced in December 2025 that Trustmark enforcement would remain voluntary through the end of 2026 while the agency completes its review of the registration system. However, the DTI has been clear that mandatory enforcement is imminent and that early registration is strongly recommended as it signals legitimacy to Filipino consumers and reduces regulatory risk.

The Trustmark registration costs approximately ₱1,000 (roughly US$17), though this fee is waived for microbusinesses with assets not exceeding ₱3 million. The badge is valid for one year and must be renewed annually. Critically, under DAO 25-12, Trustmark holders must also submit government-issued licenses or permits for regulated goods before offering them online — this is particularly relevant for foreign e-commerce businesses selling products regulated by the FDA, BSP, or other sector-specific agencies.

2. Who Must Comply? The "Availing of the Philippine Market" Standard

One of the most practically important questions foreign e-commerce operators ask is: Does RA 11967 apply to my business? The answer turns on whether your business is "availing of the Philippine market."

Under RA 11967's Section 3 and Section 5, the ITA applies to any person — including foreign entities — that:

• Conducts internet transactions where one party is situated in the Philippines; or
• Avails of the Philippine market and has "minimum contacts" therein

The "minimum contacts" standard is not defined with precision in the statute, but JAO 24-03 provides practical guidance. The following activities are generally considered to constitute "availing of the Philippine market" for foreign e-commerce businesses:

• Selling goods or services to Philippine consumers through a website, app, or digital platform, regardless of whether the transaction is in Philippine pesos or a foreign currency
• Operating an e-marketplace or digital platform that facilitates transactions between sellers and Philippine consumers
• Shipping physical goods to addresses in the Philippines
• Providing digital services (software, streaming, cloud storage, online courses, SaaS) to Philippine-based consumers or businesses
• Targeting Philippine consumers through localized marketing, Filipino-language content, or Philippine-specific payment options (e.g., GCash, Maya, bank transfers)

Conversely, a purely technical website hosted in the Philippines that sells only to customers outside the Philippines — with no marketing or targeting directed at Philippine consumers — would likely not constitute "availing of the Philippine market." The analysis is fact-specific and depends on the totality of the business's activities and contacts with the Philippine market.

2.1 The Extra-Territorial Reach and the Consequences

Once a foreign e-commerce business is determined to be availing of the Philippine market, it faces the full weight of Philippine law — even without a registered legal presence. This has several practical consequences:

• The DTI can issue compliance orders and takedown orders against the foreign entity's website or platform (RA 11967, Sections 14-15)
• The DTI can blacklist the entity's website or platform, publicly listing it as non-compliant (RA 11967, Section 16)
• The foreign entity can be sued in Philippine courts for consumer protection violations under the ITA and the Consumer Act of the Philippines (RA 7394)
• BSP and BIR tax obligations apply regardless of legal presence
• The DTI can coordinate with payment gateways, ISPs, and app stores to restrict the entity's access to the Philippine market

For foreign investors, the implication is clear: if you are targeting the Philippine market, you need to comply proactively — not because you might get caught, but because the enforcement mechanisms are increasingly sophisticated and cross-border enforcement cooperation is improving.

3. The DTI E-Commerce Bureau: Structure and Powers

RA 11967's Chapter II mandated the creation of the E-Commerce Bureau within the DTI. The Bureau was established within six months of the ITA's effectivity (i.e., by mid-2024) and is now the primary regulatory authority for e-commerce compliance in the Philippines.

The Bureau's key powers under RA 11967, Section 8 include:

• Formulating policies, plans, and programs for e-commerce development
• Monitoring and ensuring strict compliance with the ITA
• Requiring the registration of digital platforms and online merchants with the Bureau
• Investigating violations and recommending the filing of cases
• Issuing compliance orders and takedown orders
• Maintaining the Online Business Database (OBD) — a public registry of digital platforms, e-marketplaces, e-retailers, and online merchants

Under RA 11967, Section 9, the Bureau serves as a complaint referral hub: it receives complaints about e-commerce violations and refers them to the appropriate regulatory authority (BIR, NPC, PCC, FDA, etc.) under the DTI's "no-wrong-door" policy. For foreign investors, this means that a single complaint can trigger multi-agency scrutiny.

4. DTI Trustmark Registration: Requirements, Process, and Practical Guidance

4.1 Who Must Register for the Trustmark

Under DAO 25-12, as confirmed by the DTI's official Trustmark FAQ page at trustmark.dti.gov.ph/faqs, all online merchants, e-marketplaces, e-retailers, and digital platforms must be Trustmark-registered to use the internet for conducting e-commerce in the Philippines. This applies to both domestic and foreign entities. The DTI has repeatedly confirmed that foreign e-commerce operators are not exempt from Trustmark requirements if they are availing of the Philippine market.

4.2 Trustmark Registration Requirements

To apply for the Trustmark, an applicant must submit the following through the official Trustmark portal:

• Business registration documents — for foreign entities, this includes proof of incorporation in the home jurisdiction and, if operating through a Philippine subsidiary or branch, the SEC registration certificate
• Line of business or PSIC (Philippine Standards Industrial Classification) code
• List of digital platforms or websites used for online sales
• Valid government-issued identification of the applicant or authorized representative
• Internal redress mechanism — a step-by-step description of how the business handles consumer complaints and disputes internally
• For regulated goods — the relevant government-issued licenses or permits (FDA registration, BPS certification, etc.)

4.3 Trustmark Costs and Timeline

• Application fee: Approximately ₱1,000 (waived for microbusinesses with assets ≤ ₱3 million)
• Validity: One year from date of issuance
• Renewal: Annual renewal required; must be renewed at least 30 days before expiry
• Processing time: The DTI processes applications on a rolling basis; as of January 2026, the portal requires valid government-issued identification for identity verification

4.4 Consequences of Non-Registration

While the DTI has maintained voluntary compliance through 2026, non-registered entities face several risks:

• Consumer distrust — the Trustmark badge signals legitimacy; its absence is a red flag for Filipino consumers who are increasingly aware of online scams
• Platform exclusion — major Philippine e-marketplaces (Shopee, Lazada, TikTok Shop) have internal compliance requirements that may align with Trustmark registration
• Regulatory exposure — once mandatory enforcement begins, unregistered entities face administrative fines of up to ₱1,000,000 under RA 11967, Section 22
• Takedown orders — the DTI can order the removal of listings or offers from unregistered merchants

5. BIR Tax Obligations: VAT on Digital Services for Foreign E-Commerce Businesses

E-commerce compliance for foreign businesses in the Philippines is not limited to DTI registration. The Bureau of Internal Revenue (BIR) has established a comprehensive VAT framework for cross-border digital services that directly affects foreign e-commerce operators.

5.1 The Legal Framework: RA 12023 and BIR Revenue Regulations No. 3-2025

Republic Act No. 12023 amended Sections 105, 108, 109, 110, 113, 114, 115, 128, 236, and 288 of the National Internal Revenue Code (NIRC) of 1997, as amended, to establish a VAT regime for digital services provided by non-resident digital services providers (NRDSPs) to Philippine consumers and businesses. BIR Revenue Regulations (RR) No. 3-2025 implements RA 12023 and sets out the detailed rules for VAT collection, remittance, and reporting.

Under RR 3-2025, non-resident digital services providers — which includes foreign e-commerce businesses selling digital goods and services to Philippine consumers — are required to:

• Register with the BIR through the VAT on Digital Services (VDS) Portal
• Charge and collect 12% VAT on B2C digital services provided to Philippine consumers
• Remit the VAT collected to the BIR on a quarterly basis
• File VAT returns using BIR Form 2550-DS (as formalized by RMC 52-2025)

5.2 RMC 47-2025: Clarifications on VAT Application

On May 8, 2025, the BIR issued Revenue Memorandum Circular No. 47-2025 (accessible at bir-cdn.bir.gov.ph), which provides detailed FAQs on the application of VAT on cross-border digital services under RR 3-2025. RMC 47-2025 clarified several important points:

• B2B transactions: Where a Philippine business entityprocures digital services from a non-resident provider, the Philippine entity is required to withhold and remit the 12% VAT to the BIR. The non-resident provider does not collect VAT from the Philippine business customer in this scenario — the Philippine customer self-assesses and remits.
• B2C transactions: Where a non-resident provider sells directly to Philippine consumers, the provider must register, collect, and remit the 12% VAT.
• Registration deadline: Nonresident providers of digital services were required to register with the VDS Portal on or before June 1, 2025.
• VAT effective date: The VAT liability for cross-border digital services started on June 2, 2025.

5.3 Implications for Foreign E-Commerce Operators

For a foreign e-commerce business selling both physical goods and digital services to Philippine consumers, the VAT obligations are layered:

• Physical goods shipped to the Philippines: Subject to standard import VAT and customs duties at the point of importation. If the foreign business has a Philippine entity, that entity may also have VAT obligations on local sales.
• Digital services and goods (software, e-books, streaming, online courses, cloud services): Subject to the 12% VAT under RR 3-2025, collected and remitted by the foreign provider or withheld by the Philippine customer.
• Platform fees and marketplace commissions: These are generally subject to VAT as well, depending on the nature of the service.

Foreign e-commerce businesses that have not yet complied with BIR registration and VAT remittance obligations should treat this as an urgent priority. Penalties for BIR non-compliance include surcharges, interest, and fines that can accumulate significantly over time, and the BIR has been increasing its enforcement activities against non-compliant digital service providers.

6. Data Privacy Obligations: RA 10173 and the NPC

The Philippines' Data Privacy Act of 2012 (RA 10173) and its IRR (RA 10173's IRR, as amended) apply to all businesses that process the personal data of Philippine residents — including foreign e-commerce businesses that collect data from Philippine consumers. The National Privacy Commission (NPC) is the primary regulatory authority.

For foreign e-commerce businesses, the key data privacy obligations include:

• Registration with the NPC as a personal information controller (PIC) or personal information processor (PIP), if the threshold requirements are met
• Implementation of appropriate security measures for the personal data of Philippine data subjects
• Data breach notification obligations — the NPC and affected data subjects must be notified within 72 hours of discovery of a breach
• Consent and transparency obligations — Philippine consumers must be informed of how their data is collected, used, and shared
• Cross-border data transfers are permitted only to countries or organizations with adequate data protection, or subject to appropriate safeguards

The DTI E-Commerce Bureau coordinates with the NPC on data privacy matters affecting e-commerce, and a data breach at a foreign e-commerce platform serving Philippine consumers would likely trigger parallel investigations by both the NPC and the DTI ECB.

7. E-Marketplace and Digital Platform Obligations Under the ITA

For foreign investors who operate or plan to operate an e-marketplace (a digital platform that connects sellers with buyers) in the Philippines, RA 11967 and JAO 24-03 impose specific obligations that go beyond those for simple e-retailers.

Under RA 11967, Section 21, e-marketplaces must:

• Ensure that all internet transactions on their platform are clearly identifiable as e-commerce transactions
• Identify the person(s) on whose behalf each e-commerce transaction is made
• Disclose all promotional offers, discounts, premiums, and gift conditions in accessible, clear, and unambiguous terms
• Require all online merchants — whether foreign or Filipino — to submit, prior to listing on the platform: (a) name and valid government ID (for individuals) or business registration documents (for juridical entities); (b) geographic address; (c) contact details including a valid email and phone number; and (d) professional licenses or memberships where applicable
• Verify merchant information to the extent practicable
• Maintain records of merchant information and make these available to the DTI upon request

JAO 24-03 further elaborates these obligations, including the requirement that e-marketplaces implement mechanisms for consumer redress and maintain an internal dispute resolution process. For foreign-operated e-marketplaces, the practical challenge is ensuring that the merchant verification process is rigorous enough to satisfy the DTI without being so burdensome as to drive away legitimate sellers.

8. Consumer Protection and Redress Obligations

The ITA, together with the Consumer Act of the Philippines (RA 7394), imposes robust consumer protection obligations on all online merchants and e-marketplaces serving Philippine consumers. Key consumer rights under the ITA framework include:

• Right to repair, replacement, refund, or other remedies — when goods are defective, malfunctioning, or do not conform to warranty (RA 11967, Section 20)
• 48-hour right to be heard after a takedown order is issued against them (RA 11967, Section 15)
• Non-cancellation rights — online consumers may not cancel orders once goods have been paid for and are in transit, except under specified conditions (RA 11967, Section 19)
• Online Dispute Resolution (ODR) — the DTI is mandated to develop an ODR platform under RA 11967, Section 17, which will provide an alternative to court litigation for small-value e-commerce disputes

For foreign e-commerce businesses, the practical implication is that they must have a clearly communicated, accessible, and effective consumer redress mechanism — a requirement that is also a condition for Trustmark registration under DAO 25-12.

9. Practical Compliance Roadmap for Foreign Investors in 2026

Based on the foregoing analysis, the following is a practical compliance roadmap for a foreign e-commerce business targeting the Philippine market in 2026:

Step 1: Determine Whether RA 11967 Applies to Your Business

Assess whether your business "avails of the Philippine market" by reviewing the criteria in Section 2 of this article. If you sell to Philippine consumers, operate a platform used by Philippine consumers, or ship physical or digital goods to the Philippines, compliance is required.

Step 2: Assess Your Corporate Structure

Determine whether you need a Philippine subsidiary, branch office, or representative office. A branch office can engage in profit-generating activities in the Philippines; a representative office cannot. Both must be registered with the SEC. Foreign e-commerce businesses selling directly to consumers may prefer a domestic subsidiary for liability protection and clearer regulatory standing.

Step 3: Register with the SEC

If operating through a Philippine entity, incorporate or register the entity with the Securities and Exchange Commission (SEC). For branch offices, submit: (a) authenticated articles of incorporation and bylaws; (b) SEC pre-war certificate of registration; (c) letter of authority from the parent company; (d) financial statements; and (e) other supporting documents.

Step 4: Register with the BIR

Obtain a Tax Identification Number (TIN) and register for applicable tax types. If providing digital services to Philippine consumers, register on the VAT on Digital Services (VDS) Portal and begin collecting and remitting the 12% VAT.

Step 5: Obtain Local Government Permits

Secure barangay clearance, the Mayor's Permit, and business license from the city or municipality where you operate. Additional sector-specific permits may be required (FDA, BPS, etc.) depending on the products sold.

Step 6: Register for the DTI E-Commerce Trustmark

Apply through trustmark.dti.gov.ph. While voluntary enforcement continues through 2026, early registration is strongly advisable. Prepare: (a) business registration documents; (b) PSIC classification code; (c) website/app URLs; (d) internal redress mechanism description; (e) regulated product licenses if applicable.

Step 7: Register with the NPC

If processing personal data of Philippine residents and meeting the threshold requirements, register as a PIC with the National Privacy Commission and implement appropriate data protection measures.

Step 8: Implement Consumer Redress and Data Protection Mechanisms

Establish a written consumer complaint and redress procedure that is accessible, transparent, and compliant with DAO 25-12. Implement data protection policies including breach notification procedures.

Step 9: Ongoing Compliance

Comply with annual Trustmark renewal, BIR VAT filings (quarterly), SEC annual report requirements, and any updates to DTI e-commerce regulations. Monitor the DTI E-Commerce Bureau's official communications for regulatory updates.

10. Penalties for Non-Compliance: What Foreign Businesses Face

The ITA establishes a graduated penalty framework:

• Administrative fines of up to ₱1,000,000 for violations of the ITA's provisions (RA 11967, Section 22)
• Takedown orders removing listings or offers from platforms, websites, and apps
• Blacklisting and public disclosure of non-compliant entities on the DTI's official blacklist
• Contempt of court for failure to comply with DTI subpoenas
• Coordinated enforcement with payment gateways, banks, and app stores to restrict access to the Philippine market

Beyond the ITA, non-compliance with BIR VAT obligations can result in surcharges (25% of the tax due), interest (20% per annum), and civil penalties under the NIRC. Data privacy violations under RA 10173 carry penalties of imprisonment of six months to seven years and fines of ₱500,000 to ₱5,000,000 for the responsible individuals.

11. Conclusion: Compliance Is Now the Cost of Entry

The Philippines' e-commerce regulatory landscape has matured significantly. What was once an informal market with minimal enforcement has become a jurisdiction with a robust multi-agency compliance framework — the DTI E-Commerce Bureau for platform and merchant obligations, the BIR for VAT on digital services, the NPC for data privacy, and the courts for consumer protection disputes.

For foreign investors, the message is clear: compliance is no longer optional and no longer avoidable through clever corporate structuring. RA 11967's extra-territorial reach means that any foreign e-commerce business targeting Philippine consumers is subject to Philippine law. The question is not whether to comply — it is whether to comply proactively (reducing risk and building consumer trust) or reactively (facing fines, blacklists, and reputational damage).

The Trustmark, while technically still on a voluntary footing through 2026, should be treated as mandatory by any rational foreign investor. The reputational benefit of a government-issued trust badge in a market plagued by online fraud is significant. The BIR's VAT registration and remittance obligations are already fully in effect and being enforced. And the NPC's data privacy requirements apply to any business collecting personal data from Philippine consumers.

Foreign investors who approach the Philippine e-commerce market with the same regulatory seriousness they would bring to the European Union or the United States will find a growing, dynamic market with real opportunities. Those who treat it as a regulatory backwater will find themselves in escalating legal difficulty.

This article is for general informational purposes only and does not constitute legal advice. For specific guidance on your e-commerce compliance obligations in the Philippines, please consult with a qualified Philippine attorney at TTFC Law.