Online businesses face rules beyond data protection: platform duties under the EU Digital Services Act, data-sharing and cloud-switching rules under the Data Act, cookie consent rules, child online safety laws and, increasingly, mandatory e-invoicing. The e-invoicing deadlines are the most immediate: France from September 2026, the UAE from January 2027 for larger businesses and Saudi Arabia's next wave by February 2027. These are system changes that need lead time.
EU platform and data rules
The Digital Services Act imposes additional duties on platforms with over 45 million monthly users in the EU, and requires online marketplaces to verify and display sellers' contact details. National Digital Services Coordinators supervise platforms established in their territory. The Data Act, applicable since 12 September 2025, gives users rights to data from connected products, supports switching between cloud providers and prohibits unfair data-sharing terms.
Cookie rules still differ. Germany requires consent for storing or reading information on a user's device unless strictly necessary, while the UK no longer requires consent for cookies used only for statistics to improve the organisation's own service. The UAE's Child Digital Safety law took effect on 1 January 2026.1234567
E-invoicing mandates
From 1 September 2026 all VAT-registered businesses established in France must be able to receive electronic invoices, and large and mid-sized companies must issue them; SMEs follow from 1 September 2027. In the UAE, businesses with revenue of AED 50 million or more must appoint an accredited service provider by 30 October 2026 and go live by 1 January 2027. Saudi Arabia's 25th wave requires taxpayers with VAT-subject revenue above SAR 187,500 in 2022 to 2025 to integrate with ZATCA's Fatoora platform by 1 February 2027.8910
| Market | Rule | Date or threshold | Source |
|---|---|---|---|
| EU | Digital Services Act: very large platforms | Over 45 million monthly EU users | European Commission |
| EU | Data Act | Applies from 12 September 2025 | European Commission |
| Germany | Cookie consent (TDDDG section 25) | Consent unless strictly necessary | gesetze-im-internet.de |
| United Kingdom | Cookie exception for statistics | In Schedule A1 to PECR | GOV.UK |
| France | E-invoicing | Receive from 1 September 2026; SMEs issue from 1 September 2027 | economie.gouv.fr |
| United Arab Emirates | E-invoicing (revenue AED 50 million or more) | Provider by 30 October 2026; live 1 January 2027 | Ministry of Finance |
| Saudi Arabia | E-invoicing Phase Two, wave 25 | Integrate by 1 February 2027 | ZATCA |
Decisions to make
- Do we operate an online marketplace or platform used by EU consumers?21Marketplaces must verify and display sellers' details; the largest platforms carry extra duties.
- Which of our entities fall into the next e-invoicing deadline?8910France, the UAE and Saudi Arabia all have deadlines between September 2026 and February 2027.
- Do our cookie banners reflect each market's rules?65The UK has relaxed consent for statistics cookies; Germany has not.
- Do we make connected products or provide cloud services in the EU?4The Data Act has applied since 12 September 2025.
Documents usually needed
- Platform terms, seller verification records and notice procedures
- Cookie inventory and consent records by market
- E-invoicing project plan and accredited provider contract
- Data Act assessment for connected products and cloud contracts
- Child safety risk assessment for services used by minors
Common mistakes
- Using one cookie banner for every market
- Starting e-invoicing projects too close to the deadline
- Assuming marketplace seller verification is optional
- Ignoring Data Act switching and data access duties in cloud contracts
- Treating e-invoicing as only a tax matter rather than a systems change
Questions businesses ask
When does UAE e-invoicing start?
For businesses with revenue of AED 50 million or more, an accredited service provider must be appointed by 30 October 2026 and the system implemented by 1 January 2027; smaller businesses follow in 2027.9
Do UK websites still need consent for analytics cookies?
Not for cookies used only to collect statistics to improve the organisation's own service; other non-essential cookies still need consent.6
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- Digital Services Act application dates and fine levels, and Digital Markets Act gatekeeper duties, were not confirmed on an official page.
- India's Consumer Protection (E-Commerce) Rules and IT Rules were not researched.
- The UK Online Safety Act and Singapore online safety rules were not researched.
- Obligations of platforms under the UAE Child Digital Safety law were not reviewed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Under the Digital Services Act, the largest online platforms are those with over 45 million monthly users in the EU, which carry additional obligations. EU-wide; Regulation (EU) 2022/2065.
Under the Digital Services Act, online marketplaces must verify and display the contact details of the sellers on their platforms. EU-wide; online marketplaces allowing consumers to conclude contracts with traders.
Under the Digital Services Act, Digital Services Coordinators are national authorities that supervise compliance by platforms established in their territory. EU-wide.
The EU Data Act entered into force on 11 January 2024 and has applied since 12 September 2025. EU-wide. It gives users access to data generated by connected products, sets a framework for switching between cloud and data-processing providers and prohibits unfair data-sharing contract terms.
Storing information on, or reading information from, a user's device (for example through cookies) requires the user's consent based on clear and comprehensive information, under § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). No consent needed where the sole purpose is transmitting a message over a public telecoms network, or where access is strictly necessary to provide a digital service the user expressly requested (§ 25(2)).
Reused from market guide claim de-data-005.
Consent is no longer needed for cookies used only to collect statistics on how an organisation's own online service is used in order to improve it; other non-essential cookies still need consent. Exceptions now sit in new Schedule A1 to PECR; the Secretary of State can add or amend exceptions by regulations.
Reused from market guide claim gb-data-010.
Federal Decree-Law No. 26 of 2025 Regarding Child Digital Safety took effect on 1 January 2026. Federal. Obligations for platforms were not reviewed.
Reused from market guide claim ae-data-015.
From 1 September 2026 all VAT-registered businesses established in France must be able to receive electronic invoices and large and mid-sized companies (ETI) must issue them; SMEs and micro-enterprises must issue electronic invoices from 1 September 2027. Covers purchases and sales of goods and services between businesses established in France and subject to VAT. Invoices pass through platforms registered by the DGFiP.
The page dates from October 2024. E-reporting obligations for cross-border and B2C transactions are not covered on it and were not confirmed. Reused from market guide claim fr-data-010.
Businesses subject to the e-invoicing system with revenue of AED 50 million or more must appoint an accredited service provider by 30 October 2026 and implement the e-invoicing system by 1 January 2027. Federal; applies onshore and in free zones to persons subject to the system. The provider deadline was extended from 31 July 2026.
Ministry of Finance news item of 10 May 2026 confirms the extension and that the 1 January 2027 date is unchanged. Reused from market guide claim ae-data-013.
ZATCA's 25th wave of e-invoicing Phase Two (integration) covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, and requires them to integrate their e-invoicing solutions with the Fatoora platform by 1 February 2027. ZATCA notifies targeted taxpayers directly and announces each wave at least six months before its integration date.
Reused from market guide claim sa-data-016.
Questions on this topic
10 statements on digital services, e-commerce and e-invoicing rules
