Online store launch checklist for Australia: GST, consumer law, shipping and payments

An online store is ready to launch when customers can understand the product and the full price. They can pay, receive the right order and get help if something goes wrong. Test every step together, from the product page to the refund. Hold launch while any material payment or legal issue is still open.

Check the whole order path

Launch readiness means the whole order works, from the first click to the last refund. What you sell changes the checks. A parcel store tests delivery. A digital store tests access.

Each step can fail on its own. Test what happens when one does, as well as the happy path.

Choose a platform you can operate

Pick the platform against what your store must do, then name who will run it. Compare platforms on the store you actually have:

• catalogue size, variants and stock locations

• payment methods, shipping and tax handling

• subscriptions, bookings or digital delivery

• links to stock, accounting and fulfilment systems

• who edits products and runs the store each day

Confirm whether each feature is native, included in your plan, a paid extension or custom work. An app in a marketplace doesn't prove the combined store meets the need.

Shopify is hosted commerce. WooCommerce adds commerce to WordPress, so hosting and maintenance need an owner. BigCommerce, other hosted builders and custom builds are worth investigating too.

Our Shopify vs WooCommerce guide compares the two in detail. The platform comparison tool helps too. Our small business website guide covers the wider build.

Whoever hosts the software, the business should own the store and its accounts. Name an operator and keep recovery access in the business. The website cost estimator gives an early budget range, not a quote.

Plan the catalogue and product pages

Build categories the way customers shop. A brand or supplier can be a fine category when people shop that way. Use searchable product names and descriptive URLs, such as /collections/soy-candles. Add filters customers actually use.

Test zero result searches, unavailable variants and the path back to a collection. If you're replacing an old store, keep meaningful URLs or plan relevant redirects.

Then check each product page:

A new store with no reviews is normal. Don't invent them, fake stock counts or run countdowns that reset. A common mistake is printing "Australian made" without the evidence to back it.

Back every important claim with evidence and a review date:

When an offer ends, remove it from ads, product pages, checkout and feeds together. Google requires product structured data to match what the page shows. Merchant Center prices must match the landing page and checkout. Our guide to ecommerce SEO covers setup, with no promise of rich results.

Test the checkout and payments

Test the cart and checkout like a customer, on a real phone and with a keyboard:

Guest checkout is a useful design choice. It isn't a legal requirement, and digital products or regulated services may need other fields.

Try the awkward cases too. Decline a payment, return from an external payment page and drop the connection mid order. Click twice and refresh. You want one correct order and charge, or a clear unresolved state staff can check.

Get live payments ready

Choose a gateway on what you sell and how customers pay. Then compare fees and disputes, plus refunds and support. Examples to check include Shopify Payments, Stripe and PayPal. Processing fees, platform transaction fees and customer surcharges are different amounts.

A sandbox success doesn't prove live settlement. Before live selling, confirm:

• merchant approval and identity checks

• bank and payout details

• production credentials, with test mode off

• who can see payment status and fund refunds

A payout can differ from gross sales because of fees, refunds and timing. Providers can also hold back part of a payout as a reserve. Match the transaction to the order before calling a gap missing revenue. Use the provider's test process. If a live test purchase is needed, agree it with the owner and refund it properly.

Decide how stock is reserved or reduced, and what happens when two people buy the last one. Make sure a rollback can't erase orders taken after launch. Know how to pause sales safely if fulfilment fails.

Remove card surcharges

From 1 October 2026, businesses can't surcharge Visa, Mastercard, American Express or eftpos cards. That's the ACCC's current guidance. The RBA's reform covered eftpos, Mastercard and Visa. The ACCC's list includes American Express as well.

The card networks and payment providers enforce these rules, not the ACCC. The ACCC and state agencies still enforce consumer law on misleading prices.

Remove card surcharge settings and test every payment path. Don't relabel a card fee as handling. The ACCC says that may be misleading. Other genuine fees, like a public holiday surcharge, need correct price display.

Card processing still costs you money. You can build it into your prices instead.

Check GST and price displays

Show the total price customers must pay. The ACCC's price display rules require a single minimum total, including taxes and any unavoidable or preselected fees. Disclose fee types at the start of the purchase. Optional delivery that isn't preselected needn't sit in the product price.

Calculate the real total once the destination is known. Check that prices match everywhere a customer sees them, from product cards to receipts and ads. A was price must be genuine. The item should have sold at that price for a reasonable period first. There's no universal safe number of days.

Unit pricing depends on what you sell. The ACCC's Unit Pricing Code covers online sellers offering items from every listed grocery category. Large grocery stores are covered too. It doesn't put the same duty on every online store.

Register for GST at the right time

GST registration depends on GST turnover, not profit. The ATO requires registration once current or projected GST turnover reaches $75,000. Current turnover covers this month and the previous 11. Projected turnover covers this month and the next 11.

You have 21 days to register after you exceed the threshold. If current turnover reaches $75,000 but projected turnover won't, the ATO can accept that you needn't register.

An unregistered seller can't charge GST. A registered seller still needs the right treatment for taxable and GST free items. Mixed baskets, exports and digital supplies need specific checking. Confirm your position with your tax adviser.

Here's a simple example basket, in AUD. It assumes a GST registered seller with taxable goods and delivery. No discount applies:

GST is already inside the $121. Don't add another $11 at checkout. Refund one item and $5 of GST reverses in this simple example.

Test the tax flags and the inclusive price setting. Then test discounts, delivery and refunds.

A payment receipt isn't automatically a tax invoice. The ATO's tax invoice rules list what one must show. If you're registered, a customer can ask for one on a taxable sale over $82.50, GST included. Supply it within 28 days.

Set shipping and delivery promises

Test the combinations your store will really see:

• metro and regional postcodes

• an unsupported postcode and PO box rules

• heavy, bulky and mixed carts

• free shipping thresholds, express and pickup

Separate your dispatch time from the carrier's transit time. Make sure you can dispatch the volume you promise. State cut off times and business day assumptions accurately. Check the packed weight and size, as well as the product's own weight.

Free delivery still costs you money. Include it in your order maths.

Then follow one paid order through fulfilment:

Include pending and failed payments, duplicate notifications and partial refunds. Name who handles a mismatch. A common mistake is treating the success screen as proof the order worked.

Have a process for delays, split shipments, lost parcels and damage. Don't send customers off to fight the carrier while you disclaim your obligations. Other models need their own tests:

• digital products: access, permissions and expiry

• bookings: capacity, time zones and rescheduling

• subscriptions: first charge, renewal, failed payment and cancellation

Protect consumer rights and refunds

Consumer guarantees sit above any store policy. Your terms can't take them away:

A major problem gives the customer the choice of a refund or a replacement. A minor problem must be repaired free of charge. The ACCC's remedies guide explains the difference. Two separate questions often get mixed up:

Don't publish "no refunds" or "no refunds on sale items". Those signs can't remove consumer rights. Change of mind returns aren't required by the guarantees. If you publish a change of mind policy, you must follow it.

Give customers a clear contact path and staff a procedure for assessing requests. Test a full and a partial refund. Check the customer message, the stock decision and the accounting update. A refund isn't done because someone pressed a button.

Prepare for the July 2027 rules

Parliament passed new consumer protections in 2026. The law is the Competition and Consumer Amendment (Unfair Trading Practices) Act 2026. It covers unfair trading practices, drip pricing and subscription contracts. Treasury says the bans start on 1 July 2027. Here's where each rule stands:

The ACCC's enforcement priorities, announced in February 2026, include manipulative online practices such as subscription traps. A priority isn't a new ban in itself.

The Parliamentary Library's summary explains the main changes. Drip pricing means revealing extra charges bit by bit as someone buys. These drip pricing rules cover goods and services usually bought for personal, domestic or household use. A transaction based charge, or how it's worked out, will need to sit alongside the base price.

Covered subscription contracts will need clear key information at the offer. Notices, such as before a free trial ends, will follow regulations. Each cancellation method must be easy to find and straightforward, with only reasonably necessary steps.

Inspect your sign up and cancellation paths now and record the changes needed. Don't assume a one click cancellation rule or a fixed reminder period. Some details depend on regulations still to come. Our guide to dark patterns and consumer law covers the detail.

Don't copy a competitor's policy or trust a platform generated one as proof of compliance. Your policies must match what your store and staff actually do.

Check product safety before selling

Before listing a product, check for mandatory safety and information standards, bans and recalls. Product Safety Australia says it's an offence to supply goods that don't meet a mandatory standard. Not every product has one. Having none doesn't prove a product is safe.

Get supplier and test evidence for the exact model and batch. An overseas approval doesn't prove Australian compliance. Record what you checked:

Name who can stop sales, contact the supplier and find affected orders. Suppliers must report a death, serious injury or illness linked to a product. The deadline is 2 days from becoming aware. Follow the official procedure when it happens.

Get privacy and marketing consent right

The Privacy Act generally doesn't cover a small business with turnover of $3 million or less. The OAIC lists the exceptions, such as health service providers. Our guide to Australian privacy law changes for websites explains which businesses are covered.

Map what the store, payment service, delivery partner and apps collect and share. Publish truthful notices and drop fields you don't need. Our guide to privacy policies and website terms covers the documents.

Test any consent controls you show, including rejection and withdrawal. Keep names, emails and addresses out of analytics events and URLs.

For marketing email and SMS, the ACMA's spam rules need consent, clear sender identity and a working unsubscribe. Honour opt outs within 5 working days. A purchase or a typed email address doesn't prove consent by itself. Keep consent records, because it's up to you to prove it.

Review abandoned cart, review request and win back emails on their actual content. An app calling a message transactional doesn't make it so. Adding an offer changes things. A third party app sending it doesn't move the responsibility either.

Check accessibility, speed and measurement

Test the pages customers actually use, especially product pages and checkout. Diagnose first. One fast homepage or lab score doesn't describe the whole store. Our guide to why a website is slow covers diagnosis.

Check keyboard focus, labels and error messages. Then check zoom and contrast against WCAG 2.2. Our guide to website accessibility in Australia covers the standard.

It's a screening aid, not a conformance certificate. For measurement, check these GA4 ecommerce events where they apply:

• view_item

• add_to_cart

• begin_checkout

• purchase

• refund

Each purchase needs a unique transaction ID. GA4 uses it to remove duplicate purchases on web streams.

Refresh the confirmation page and make sure the order doesn't count twice. Compare a controlled order with the store record. Explain any gaps from tax, shipping, refunds or consent. Our GA4 guide covers the setup.

Keep Google Ads purchase tracking separate. Two primary actions shouldn't bid on the same purchase. Our guide to Google Ads conversion tracking covers that side.

Secure the store and its recovery path

Use HTTPS throughout, with unique accounts, multi factor authentication and current updates. HTTPS protects the connection. It doesn't prove a retailer is legitimate. Chrome replaced the padlock in version 117 for that reason. Our guide to SSL certificates explains more.

Card data security is shared work:

Hosted payments can reduce your exposure. They don't remove your duties. The PCI Security Standards Council says outsourcing doesn't remove the merchant's responsibility. Your acquirer is the bank or provider that processes your card payments. Ask it, or the card brand, what applies to your setup.

Never collect card numbers in forms, email or logs. Review installed apps and staff access. Limit who can change payment settings. If you run WooCommerce, our guide to WordPress security covers the basics.

Define what a backup includes, how it's restored and who can do it. Include products, orders, customers, settings and connected services. A product CSV isn't a restorable store. Restoring an old database can erase valid orders. Our guide to backing up your website covers protecting them.

Before release, name an owner for payment exceptions and refunds. Name owners for stock, shipping messages and security alerts too. Keep passwords and keys in a secure system, out of handover tables.

Run the launch tests and decide

Keep one register for the whole store. Expand each group into the checks that apply to you:

The second half covers what happens after the sale:

For each test, record what you expected and what happened. Add the status, the evidence, an owner and a retest date. Use Pass, Fail, Not tested or Not applicable, and give a reason for Not applicable. A failed essential holds launch, even when most other rows pass.

Not tested isn't a pass. A checklist score can't make up for an essential failure.

The tool's score isn't legal certification or proof that every integration works.

Watch the first week

Release in a staffed window, with a support contact and clear conditions for pausing sales. A new store may not need redirects. A replacement store does need a URL and data plan.

Then watch real orders and payment exceptions closely. Check confirmations, stock and refunds too. Reconcile the first live activity against the process. One quiet day doesn't prove the launch is safe.

Avoid recurring launch mistakes

What we recommend at Elev8d

Frequently asked questions

Next steps

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.