E-commerce, technology and AI law · Updated:

Digital commerce and artificial intelligence in Israel

Sell to an Israeli consumer and Israeli consumer law applies to you, wherever your servers sit. Israel has no dedicated AI statute — which does not mean an automated decision comes without liability. This is what the law actually requires.

In short

Every online store selling in Israel must comply with the Consumer Protection Law and the Protection of Privacy Law. In a distance sale the consumer may cancel within 14 days of receiving the goods or the disclosure document, whichever is later (section 14C(c)). A business using AI and collecting personal data must tell people why the data is collected and to whom it will be passed (section 11 of the Protection of Privacy Law), and must keep it secure. Breach means damages and administrative fines.

Office in Kiryat Ono, in the Tel Aviv metropolitan area; Hebrew and English.

Opened an online store? Here is what the law requires of you

A physical shop is sometimes subject to business licensing. An online store looks simpler — but the legal requirements are exactly the same. And more than that: the moment you sell to an Israeli consumer, the Consumer Protection Law applies to you, even if your servers are abroad.

Three principal statutes govern digital commerce in Israel: the Consumer Protection Law, 5741-1981 (חוק הגנת הצרכן, תשמ״א-1981); the Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות, תשמ״א-1981); and the Electronic Signature Law, 5761-2001 (חוק חתימה אלקטרונית, תשס״א-2001). Fail to comply and the exposure is damages, administrative fines, and sometimes personal liability.

What every Israeli online store must have

Terms of use and a privacy policy. The usual way to meet the disclosure duties. Before the purchase the business must disclose who operates the store, the price, when and how delivery is made, the warranty and how to cancel (section 14C(a)), and by the time of delivery it must give a written disclosure document (section 14C(b)); whenever it collects personal data, it must say why and to whom the data will be passed (section 11 of the Protection of Privacy Law). Keep this information accessible before the purchase — not buried several clicks deep.

Prices inclusive of VAT. A displayed price must include all taxes. In distance marketing, the full price — including delivery charges and any other addition the consumer will bear — must be disclosed in advance (sections 14C(a)(3) and 14C(f)).

A 14-day cancellation right. In a distance transaction (internet, telephone) the consumer may cancel within 14 days without giving a reason. The period runs from receipt of the goods or of the document setting out the transaction details, whichever is later; for a senior citizen, a person with a disability or a new immigrant it is four months where the sale involved a conversation (section 14C1). The business must refund the money within 14 days of receiving the cancellation notice, and may deduct a cancellation fee of up to 5% or ILS 100, whichever is lower — unless the cancellation is due to a defect or a breach (section 14E).

Exceptions to the cancellation right. The right to cancel a distance sale, including the four-month period, does not apply to perishable goods; to hospitality, travel, holiday or leisure services where the cancellation falls within seven days, not counting rest days, before the service is due; to "information" as defined in the Computers Law, 5755-1995; to goods made specially for the consumer following the transaction; or to goods that can be recorded, reproduced or copied whose original packaging the consumer has opened (section 14C(d)).

Product warranty. A product bought online is subject to the same duties as one bought in a shop: the conformity rules of the Sale Law, 5728-1968, and the warranty duties under the Consumer Protection (Warranty and After-Sale Service) Regulations, 5766-2006. Where there is a defect, the consumer may cancel the distance sale without any cancellation fee (section 14E(a)).

Payment security. If you take credit card details directly, the card companies require compliance with the PCI DSS standard (a contractual requirement, not legislation), and the Protection of Privacy (Data Security) Regulations apply alongside it. The alternative is to work with an approved payment processor (PayPal, Stripe, Tranzila) that handles this for you.

AI in the business: what is permitted, what is risky, and what falls on you

Israel has not yet legislated a dedicated AI statute of the kind the European Union has enacted. But "there is no AI statute" is not the same as "there is no liability". The courts will apply tort law, contract law and the Protection of Privacy Law to AI exactly as they apply them to anything else.

AI and liability for harm. If your AI system made a decision that caused harm to a person, you as the operator may bear liability under tort and contract law — not only the developer who sold you the system. The defence: documentation of the decisions, ongoing testing, and a human appeal mechanism.

AI and training on other people's data. Using images, texts or music to train an AI system may infringe copyright. The safe route: data under an express commercial licence, or data you generated yourself.

AI and discrimination. A system that decides on loans, insurance or hiring may not be biased on grounds of race, religion, sex or origin. Even where the bias comes from the model rather than from any deliberate intention, the responsibility is yours.

Privacy and data protection: not just the GDPR

The Israeli Protection of Privacy Law (5741-1981) and the regulations made under it apply to any business that collects the data of Israeli customers — even where the business is registered abroad.

What the law requires of businesses.

Registration of a database — only in narrow cases since Amendment 13 came into force on 14 August 2025. Under section 8A(a)(1), a database must be registered only if its main purpose is collecting personal information in order to pass it to others as a business or for consideration, including direct-mail services, and it holds information on more than 10,000 people, or if it is controlled by a public body. A database holding information of special sensitivity on more than 100,000 people must instead be notified to the Privacy Protection Authority (section 8A(b)). Breach carries administrative fines.

Clear consent for marketing: you cannot send a newsletter to someone who did not expressly agree to receive it. The anti-spam provision (in the Communications Law, 5742-1982) requires an opt-out option in every marketing approach.

A right of access and correction: any person may inspect the personal information held about them in a database (section 13), and ask for information that is incorrect, incomplete, unclear or out of date to be corrected or deleted (section 14). There is no general GDPR-style right to erasure, but a person may demand to be removed from a direct-mail database (section 17F).

How this practice works in the field

Yaron Meiri, Adv. & CPA advises digital businesses:

  • Legal audit of an online store: reviewing terms of use, the privacy policy and compliance with the Consumer Protection Law.
  • AI agreements: supplier contracts for the acquisition of AI systems, allocation of liability, and licence terms.
  • Privacy compliance: database registration, retention and deletion policies, and responding to access requests.
  • Consumer claims: representation against customers bringing claims for breach of their rights in an online purchase.

Two drafting points recur in supplier contracts and are worth flagging. First, a SaaS or AI agreement should state expressly who controls the database and who merely holds it within the meaning of the Protection of Privacy Law as amended by Amendment 13: a supplier that processes and uses customer data for its own purposes, including model training, may be regarded as a controller of the database, not merely a holder, with the obligations the Law imposes on a controller. Second, terms of use that reserve a right to "change these terms at any time" without any notification mechanism are precarious — a material change made without clear advance notice is open to the argument that it does not bind the customer and, in a standard-form contract, to the argument that it is an unduly disadvantageous term.

Frequently asked questions

Does a small business selling online need terms of use and a privacy policy?

The law does not require documents called 'terms of use' or a 'privacy policy', but the disclosure duties they are meant to meet apply to a small business too: the Consumer Protection Law draws no distinction between a large business and a small one. In a distance sale the business must disclose, among other things, its name, identity number and address, the main features of the product, the price and payment terms, the time and manner of delivery, the warranty and the right to cancel (section 14C(a)), and must give the consumer a written disclosure document no later than delivery (section 14C(b)). Anyone collecting personal data must state, among other things, the purpose, to whom the data will be passed and who controls the database (section 11 of the Protection of Privacy Law). A breach means liability under those laws.

A customer wants to return a product after 20 days — do we have to accept it?

It depends on when the period began. Under section 14C(c), for goods the 14 days run from receipt of the goods or of the document with the transaction details, whichever is later; until that document is delivered, the period has not started. For a consumer who is a senior citizen, a person with a disability or a new immigrant, where the sale involved a conversation, the period is four months (section 14C1). Keep a record of when the document was delivered.

What happens if our data leaks?

Regulation 11(d) of the Protection of Privacy (Data Security) Regulations, 5777-2017 requires a severe security incident, and the steps taken after it, to be reported immediately to the Privacy Protection Authority, which may order the business to notify the data subjects who may be harmed.

Can I collect email addresses and send a newsletter?

As a rule, only with the recipient's express prior consent, in writing or by electronic message (section 30A(b) of the Communications (Telecommunications and Broadcasts) Law). A narrow exception covers a customer who gave their details in the course of a purchase, was told they would be used for the business's marketing of similar products and was given an opportunity to refuse (section 30A(c)). Every message must offer a simple way to refuse further messages.

Leave your details for a first call

Your name and a phone number are enough. I will get back to you during office hours. You can also write directly on WhatsApp.

A few lines are enough: what happened, when, and with whom. No account numbers, ID numbers or documents.

Providing these details is not a legal obligation and is up to you; without them I cannot get back to you. Please don't send documents or confidential details here. Contacting us through the website does not create an attorney–client relationship; that is created only by a written agreement. The form is sent via an external service (formsubmit.co) outside Israel, and from there to the firm's mailbox (Google Gmail). If you prefer, call or message on WhatsApp instead. Data controller: Yaron Meiri, Adv. & CPA, +972-50-431-3155. You may inspect your data and ask to correct it (sections 13–14 of the Israeli Privacy Protection Law). Full details: Privacy policy.

We'll first arrange a call, and then I'll ask for what's needed through a secure channel. Your details are used only to get back to you about your enquiry.

Prefer to talk? +972-50-431-3155 · WhatsApp

Legal framework and sources

Checked against the current statutory text in September 2026. Every source below is in Hebrew; the Hebrew text is the governing text of the law. This information is general and is not legal advice.

This page is general information about Israeli digital commerce, privacy and technology law, written for English-speaking readers. It is not legal advice, does not create an attorney-client relationship, and is no substitute for advice on your own facts. This is a fast-moving area and the governing text of every statute cited is the Hebrew original. Past results do not guarantee similar results in the future.

Selling online in Israel, or deploying AI in your business?

A first call to review your matter.

Request a first call WhatsApp