Narrower identity checks and a domestic agent requirement: the July 2026 amendment to the Enforcement Decree of the Consumer Protection Act in Electronic Commerce

What changed

Before this amendment, Article 25(2) of the Enforcement Decree of the Consumer Protection Act in Electronic Commerce read the 'matters prescribed by Presidential Decree' in Article 20(2) of the Act as the client's name, date of birth, address, telephone number and e-mail address. Presidential Decree No. 36507 deletes that paragraph and adds Article 25-3 on what an intermediary must check for an individual seller in a person-to-person trade: the telephone number; the e-mail address, only where the intermediary holds no identity information verified through an identity verification agency designated under Article 23-3(1) of the Act on Promotion of Information and Communications Network Utilisation and Information Protection; and, only where it holds them, identity information verified through an electronic signature certification business operator or a credit information company etc., creditworthiness information the intermediary provides itself, and that identity verification agency information. The official reason gives the aim as narrowing the scope of identity information checked.

The new Article 25-4 sets the 'person meeting criteria prescribed by Presidential Decree' in Article 20-5(1) of the Act: total sales in the previous year (for a corporation, the previous business year) of 1 trillion won or more; an average of 1,000,000 or more domestic consumers a month accessing its cyber mall over the three months before the end of the previous year; or a violation of the Act causing or risking conspicuous consumer harm where a report or submission of data or things has been ordered under Article 81(1)(iii) of the Monopoly Regulation and Fair Trade Act, applied through Article 39(2) of the Act. Total sales are converted into won at the previous year's average exchange rate. After designating an agent (re-designation included), the business must 'without delay' submit the matters listed in Article 20-5(3) of the Act to the Fair Trade Commission in writing (electronic documents included) and disclose them on the first screen of its cyber mall etc.; the Commission may demand financial statements etc. on sales and data such as cyber mall access numbers to check the criteria.

The same Decree also adds Article 27-3 requiring disclosure of how consumer reviews are collected and handled, replaces the Act named in Article 5-2 with the Personal Information Protection Act, rewords Article 17, raises the surcharge adjustment limit in Table 2 from 50% to 100% of the basic calculation basis, revises and adds administrative fine amounts in Table 3, renumbers Articles 34-2 to 34-4 as Articles 34-3 to 34-5, and adds a new Article 34-2 entrusting consent decree performance checks to the Korea Consumer Agency.

What to read in the text

The addendum brings the Decree into force on 21 July 2026, except that Article 25-4, the new Article 40 item fixing 1 January 2027 as the review basis date for the domestic-agent criteria, the second to fifth of the sub-items added to Table 1's second entry, and the fourth to seventh of the sub-items added to Table 3's second entry take effect on 21 January 2027. All other provisions, including the rest of the revised and added fine amounts, take effect on 21 July 2026. The addendum says nothing about pending cases or earlier acts, and the Table entries reach this note only as attached images it has not read.

A file needs the seller's status as an individual seller and the categories of information the intermediary holds for Articles 25 and 25-3. For Article 25-4 it needs whether the business has an address or place of business in Korea (a condition the official reason attaches), its previous year's sales, the monthly average of domestic consumers accessing its cyber mall over the three months before the end of the previous year, and any order under the third criterion. The Act and the other Acts named in the Decree are not in this pack.

Questions for the legislature

Article 25-3 applies items 3 to 5 'only where the telemarketing intermediary holds the information concerned' and requires the e-mail address 'only where the intermediary does not hold the information in item 5'. Neither the text, the addendum nor the official reason says when information counts as held or for how long it may be relied on. May an intermediary rely on identity information verified earlier for another purpose to satisfy item 5 and leave the e-mail address unchecked?

Article 25-4(3) requires submission to the Fair Trade Commission and disclosure on the first screen 'without delay' after a domestic agent is designated. Neither the text, the addendum nor the official reason addresses a business that already met a criterion in Article 25-4(1) before 21 January 2027. Must such a business designate an agent and make the submission and disclosure when the provision takes effect, or does the duty arise only when a criterion is first met afterwards?

When to revisit

We revisit this note if the Act or the Monopoly Regulation and Fair Trade Act provisions cited in Article 25-4, or the Acts named in Articles 5-2 and 25-3, are read against this Decree, if a court or Fair Trade Commission decision explains holding identity information or the domestic-agent criteria, or if the Table entries delivered as images are read.