Digital trade law is the layered set of international treaties, regional trade agreements, and domestic statutes that governs commercial transactions conducted over the internet, from streaming media and cross-border software licensing to cloud services and online marketplaces. It determines who can tax a digital transaction, whose privacy rules apply to the data behind it, whether an electronic contract is enforceable, and what a company can lawfully export as code. A business selling digitally across borders is almost always operating under several of these systems at once, and the penalties for getting it wrong run from multi-million-euro fines to losing market access outright.
The WTO Baseline
Most digital commerce starts with two World Trade Organization agreements. The General Agreement on Tariffs and Trade (GATT) covers physical goods, including items ordered online but shipped in tangible form. The General Agreement on Trade in Services (GATS) covers services delivered digitally. A textbook ordered from a website and mailed to the buyer falls under the GATT. The same textbook delivered as a download occupies more contested territory.
GATS applies to digital services under the principle of technological neutrality: a service does not change its legal classification because it is delivered online instead of in person. An accounting firm giving tax advice on a video call is still providing an accounting service, subject to the same trade commitments as the in-person version. Member nations cannot discriminate against foreign service providers on the basis of delivery technology alone.
Since the 1998 Declaration on Global Electronic Commerce, WTO members have maintained a Work Programme on Electronic Commerce that examines how existing trade rules apply to internet-based transactions, covering goods, services, intellectual property, and development concerns. Alongside the Work Programme, members have periodically renewed a moratorium on customs duties for electronic transmissions, preventing governments from imposing tariffs on software downloads, streamed media, and e-books.
The 2024 Agreement on Electronic Commerce
In December 2024, seventy-one WTO members concluded the text of a new Agreement on Electronic Commerce after five years of negotiations. The co-sponsors represent roughly 70 percent of global trade and requested that the agreement be incorporated into the WTO framework as a plurilateral agreement under Annex 4 of the Marrakesh Agreement. As of early 2026, seventy-two co-sponsors had backed the request for formal incorporation.
The agreement addresses six themes: enabling electronic commerce, maintaining openness in digital trade, building trust in digital transactions, cross-cutting regulatory issues, telecommunications infrastructure, and market access. It is the first time WTO members have created a dedicated legal instrument specifically for e-commerce rather than relying on rules originally designed for physical goods and traditional services.
The Customs Duty Moratorium
The 1998 moratorium on customs duties for electronic transmissions has never been made permanent. Members renew it at each Ministerial Conference, and negotiations have grown more contentious. At MC13 in Abu Dhabi in early 2024, members extended the moratorium only until MC14, scheduled for late March 2026 in Cameroon, and for the first time the renewal explicitly stated that both the moratorium and the Work Programme would expire on that date. Some developing nations argue the moratorium costs them customs revenue as commerce shifts from physical to digital formats; exporting nations counter that duties would raise costs for consumers and small businesses worldwide. The MC14 outcome will determine whether governments gain the ability to tax cross-border digital transmissions.
Regional Trade Agreements
Regional and bilateral agreements go further than the WTO baseline, with enforceable commitments the multilateral system has not reached. Two set the modern standard: the United States-Mexico-Canada Agreement (USMCA) and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP).
Chapter 19 of the USMCA prohibits member governments from requiring companies to store data or locate computing facilities within their borders as a condition of doing business. This data localization ban means businesses do not have to build local server infrastructure in each member country where they operate. The chapter also requires non-discriminatory treatment of digital products: a government cannot impose higher taxes or more restrictive regulations on software or media created in another member country than on domestic equivalents.
The CPTPP carries similar rules. Article 14.4 bars member nations from giving less favorable treatment to digital products created, produced, or first made commercially available in another member’s territory. The agreement defines “digital product” broadly to include computer programs, text, video, images, and sound recordings that are digitally encoded and produced for commercial sale or distribution. The non-discrimination rule does not extend to broadcasting or government subsidies, but it covers most commercial digital goods and services traded between member nations.
Both agreements promote cooperation on cybersecurity and consumer protection. The Digital Economy Partnership Agreement (DEPA) between Singapore, Chile, and New Zealand pushes further, incorporating provisions on artificial intelligence governance and algorithmic transparency that most other trade agreements have not touched.
Cross-Border Data Transfers and Privacy
Moving personal data across borders is the highest-risk area in digital trade compliance, because privacy regimes vary sharply and a single transaction can trigger obligations under multiple systems at once.
The GDPR
The European Union’s General Data Protection Regulation is the most influential data protection framework in global commerce. Under Article 45, the European Commission can approve transfers of personal data to a non-EU country only if that country provides an adequate level of protection, evaluated on factors including rule of law, independent data protection authorities, and international commitments. Without an adequacy decision, companies must rely on alternative transfer mechanisms like standard contractual clauses.
Enforcement is meaningful. Violations involving cross-border data transfers can trigger administrative fines of up to 4 percent of a company’s total worldwide annual turnover or €20 million, whichever is higher. A company with €5 billion in global revenue faces potential exposure of €200 million for a serious violation.
The EU-U.S. Data Privacy Framework
U.S. companies handling EU personal data can self-certify under the EU-U.S. Data Privacy Framework (DPF), which provides an adequacy-based mechanism for transatlantic transfers. Certification is voluntary, but once a company self-certifies, compliance becomes mandatory and enforceable under U.S. law. The company must reflect its DPF commitments in its public privacy policy, and the International Trade Administration maintains a public list of certified organizations that is updated based on annual re-certification. Companies removed from the list must stop claiming participation but must continue protecting any personal data they received while certified for as long as they retain it.
The Global Cross-Border Privacy Rules System
In the Asia-Pacific region, the APEC Cross-Border Privacy Rules system has evolved into the Global CBPR Forum, which formally launched its certification system in June 2025. The Global CBPR system is voluntary but enforceable: once an organization is certified, its privacy commitments become binding and enforceable by both independent accountability agents and national privacy authorities. As of early 2026, the Forum includes ten member economies and four associates.
Data Localization Bans
Modern trade agreements increasingly prohibit data localization requirements. The USMCA, the CPTPP, and other recent agreements bar governments from mandating that data be stored on servers within national borders, so a company using centralized cloud infrastructure does not have to replicate its architecture in every country where it has customers. Reconciling these trade commitments with domestic privacy mandates requires ongoing compliance work, including data protection impact assessments and records of processing activities.
Electronic Contracts and Signatures
A contract formed by clicking “I agree” on a screen needs the same legal standing as one signed in ink, and several frameworks make that possible. The UNCITRAL Model Law on Electronic Commerce, adopted in 1996, established the principles most countries now follow. Its core concept is functional equivalence: an electronic record satisfies a legal “writing” requirement if the information remains accessible for later reference, and an electronic signature satisfies a signature requirement if it meets certain reliability criteria.
The companion UNCITRAL Model Law on Electronic Signatures sets out what makes a digital signature legally reliable. The signature creation data must be linked to the signer and no one else, must have been under the signer’s control at the time of signing, and any post-signing alteration to either the signature or the underlying document must be detectable. Courts cannot invalidate a contract solely because it was executed electronically.
The U.S. ESIGN Act
In the United States, the Electronic Signatures in Global and National Commerce Act gives electronic signatures and records the same legal effect as their paper equivalents for transactions in interstate or foreign commerce. A signature or contract cannot be denied enforceability solely because it exists in electronic form.
ESIGN imposes specific requirements when a business delivers records to consumers electronically. Before obtaining consent, the business must clearly disclose the consumer’s right to receive paper records instead, the right to withdraw consent (including any fees or consequences), and whether the consent covers a single transaction or an ongoing relationship. The consumer must also receive a statement of the hardware and software needed to access the electronic records and must demonstrate the ability to access the format being used. If a later technology change creates a risk that the consumer can no longer open the records, the business must re-disclose the updated requirements and give the consumer another chance to withdraw consent without penalty.
Intellectual Property in the Digital Environment
Digital IP protection operates through layered international and domestic frameworks. The Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) sets the global baseline. Article 10 requires WTO members to protect computer programs, whether in source code or compiled form, as literary works under the Berne Convention. Software developers get the same exclusive rights over their code that authors have over their books, including the right to prevent unauthorized copying and distribution.
The WIPO Copyright Treaty supplements TRIPS by requiring member countries to provide legal protection against the circumvention of technological protection measures. Article 11 obligates countries to create effective legal remedies against bypassing security measures such as encryption or digital rights management.
DMCA Anti-Circumvention and Safe Harbor
In the United States, the Digital Millennium Copyright Act implements those WIPO obligations through two mechanisms. Section 1201 makes it illegal to circumvent technological measures that control access to copyrighted works and prohibits manufacturing or distributing tools primarily designed for circumvention. The statute defines circumvention broadly to include descrambling, decrypting, or otherwise bypassing access controls without the copyright owner’s authority.
Section 512 creates safe harbor protections for online service providers that host user-generated content. To qualify, a service provider must adopt and enforce a policy for terminating repeat infringers, must not interfere with standard technical measures that identify copyrighted works, and must designate a DMCA agent with the U.S. Copyright Office to receive takedown notices. When a provider receives a valid takedown notice, it must act quickly to remove or disable access to the material. The provider also loses safe harbor protection if it has actual knowledge of infringement or receives a direct financial benefit from infringing activity it could control. Agent designations expire every three years and must be renewed.
Statutory Damages
Copyright holders who pursue infringement claims in U.S. courts can elect statutory damages instead of proving actual losses. For a single work, statutory damages range from $750 to $30,000 as the court considers appropriate. Those amounts can increase significantly if the infringement is proven to be willful. For any business using licensed software, media assets, or third-party code in its products, proper licensing is the difference between a manageable legal fee and a judgment that can threaten the company.
Digital Taxation
Beyond the customs duty moratorium, the other major tax issue in digital trade is the growing adoption of digital services taxes.
Digital Services Taxes
Multiple countries have enacted unilateral digital services taxes (DSTs) targeting revenue earned by large technology companies from online advertising, data sales, and digital marketplace operations. Rates vary. Several European countries impose taxes ranging from 2 to 5 percent on qualifying digital revenues, with some jurisdictions applying different rates to different service types. These taxes typically apply only to companies above a global revenue threshold, so they primarily affect large multinationals rather than small digital businesses.
DSTs were originally positioned as interim measures pending completion of the OECD’s Pillar One reforms, which would reallocate taxing rights to countries where digital companies earn revenue. Several adopting countries committed to repeal their DSTs once Pillar One took effect. The Multilateral Convention implementing Pillar One’s Amount A has not been finalized or opened for signature, and those rollback commitments have largely lapsed. Companies now navigate a patchwork of country-specific taxes with no global solution imminent.
The OECD Two-Pillar Framework
The OECD’s proposed solution has two pillars. Pillar One would reallocate a portion of profits from the largest multinationals (those with global revenues above €20 billion and profitability above 10 percent) to jurisdictions where they sell products and services, and is designed to replace most unilateral DSTs. Pillar Two, which has seen broader implementation, ensures that large multinational groups with at least €750 million in global revenue pay a minimum effective tax rate of 15 percent in each jurisdiction where they operate. Until Pillar One is finalized, digital businesses face both the DST patchwork and the Pillar Two minimum tax.
U.S. Export Controls on Digital Products
Selling software, cloud services, or encryption technology from the United States triggers obligations under the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security. The EAR reaches beyond physical shipments: all items in the United States, all U.S.-origin items regardless of location, and certain foreign-made products incorporating controlled U.S. technology are potentially subject to these rules.
Encryption software receives particular scrutiny. Encryption source code in electronic form remains subject to the EAR even when the equivalent printed source code in a book would not be. Foreign-produced encryption technology that incorporates U.S.-origin encryption technology controlled under certain export classifications is subject to the EAR regardless of how much U.S.-origin content it contains. Publicly available encryption object code can be excluded from EAR jurisdiction, but only if the corresponding source code meets specific criteria.
The Entity List adds another layer. Before exporting, reexporting, or transferring any item subject to the EAR, a company must check whether any party to the transaction appears on the Entity List. A license is required for transactions involving listed entities, and that requirement extends to any foreign entity that is 50 percent or more owned by one or more listed entities. When ownership cannot be determined, the company must either resolve the uncertainty or obtain a BIS license before proceeding. The foreign direct product rules further extend U.S. jurisdiction to items manufactured abroad using certain U.S. technology or software, covering advanced computing, semiconductor manufacturing equipment, and AI model weights.
Artificial Intelligence Provisions
AI governance is the newest frontier in digital trade law, and the frameworks are more aspirational than enforceable. DEPA includes provisions encouraging member countries to adopt AI governance frameworks based on internationally recognized principles including explainability, transparency, fairness, and human-centered values. DEPA also prohibits requiring manufacturers to disclose proprietary algorithm specifications, encryption keys, or design details as a condition of selling products in a member country.
In the United States, the NIST AI Risk Management Framework provides structured guidance around four functions: govern, map, measure, and manage. The framework is voluntary rather than a binding regulatory requirement, though it is increasingly referenced in procurement standards and sector-specific guidance. In April 2026, NIST released a concept note for an AI RMF profile focused on trustworthy AI in critical infrastructure.
The gap between trade agreement language and enforceable regulation is wide. Most AI provisions set principles rather than mandates, and no binding international framework currently governs how AI systems must be designed or deployed across borders. Companies building AI products for international markets should track both the trade agreement provisions that protect against forced technology disclosure and the domestic regulations in each target market.
Data Breach Notification
Companies engaged in digital trade face notification obligations when personal data is compromised. In the United States, all fifty states have enacted breach notification laws, but requirements vary. About twenty states specify a numeric deadline, typically 30, 45, or 60 days from discovery. The majority use qualitative standards like “without unreasonable delay,” which introduces uncertainty about exactly how fast a company must act. Some states also require notification to the state attorney general or other regulators in addition to affected consumers.
Under the GDPR, data controllers must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach unless the breach is unlikely to result in a risk to individuals’ rights. Companies operating across multiple jurisdictions need breach response plans that account for the shortest applicable deadline in any market where they hold personal data. Having a plan before the breach matters far more than scrambling to figure out obligations after one.
The EU Digital Services Act
The Digital Services Act imposes significant obligations on online platforms and intermediaries operating in the EU market, making it directly relevant to any company facilitating digital transactions with EU consumers. Platforms must provide easy mechanisms for users to flag illegal content and must explain their reasoning when content is removed or accounts are suspended. Users have the right to appeal content moderation decisions through the platform itself or an independent dispute resolution body.
Larger platforms serving more than 45 million monthly active users in the EU face additional obligations. They must conduct systemic risk assessments covering illegal content, threats to fundamental rights, and risks to public health and child safety, and must offer users the option to view non-personalized content feeds. All platforms are banned from targeting advertisements to children and from using dark patterns such as deceptive interface designs, aggressive pop-ups, or misleading consent buttons. Online marketplaces must verify and display seller contact information. The DSA is fully operational, with the European Commission actively investigating compliance and pursuing enforcement actions as of early 2026.
How Disputes Get Resolved
When digital trade rules are violated, the resolution mechanism depends on which agreement is at stake and who is bringing the complaint. WTO disputes are resolved through a structured process that begins with consultations between the governments involved and can escalate to a panel hearing. Non-compliance can lead to authorized trade sanctions, typically in the form of increased customs duties. Since December 2019, the WTO’s Appellate Body has been unable to hear appeals due to blocked appointments, leaving panel reports as the final word in most cases. A group of WTO members established the Multi-party Interim Appeal Arbitration Arrangement in 2020 as a workaround, giving participating members access to a two-step process with an independent appeal stage.
Under regional agreements like the USMCA, dispute resolution is state-to-state: only member governments can initiate a complaint, and private companies cannot directly challenge another country’s measures under the agreement. Under USMCA Chapter 31, a government files a written consultation request identifying the specific measure and legal basis. If consultations do not resolve the issue within 75 days, the complaining government can request a panel. Parties can also pursue voluntary mediation at any stage. These mechanisms apply to digital trade chapter violations just as to disputes over physical goods or traditional services.