Digital commerce, artificial intelligence and privacy: the complete guide

The short answer

An online store that sells to an Israeli consumer is subject to the Consumer Protection Law, 5741-1981 even when its servers are abroad — including the disclosure duties and the right to cancel in a distance sale (section 14C) — and to the Protection of Privacy Law, 5741-1981 if it collects personal information (including the disclosure duty in section 11). Israel has no dedicated law on artificial intelligence (AI): the legal questions it raises are examined through the existing laws of privacy, copyright and torts.

This page is a translation. If it differs from the Hebrew page, the Hebrew version governs. You can call, write or meet with us in English or Hebrew. We reply within one business day.

Practical preparation starts with two documents — website terms and conditions and a privacy policy — written according to what the website actually does, and not as generic text.

What the law provides

The legal framework in this area rests on the following laws. The links lead to the original legislation (in Hebrew); the binding text is the one published in Sefer HaHukim (the official gazette of statutes).

Legislation index: all the sections the site discusses

Index of sections on the site: Contracts (General Part) Law, 5733-1973 · Commercial Torts Law, 5759-1999.

Copyright and artificial intelligence in the digital world

Section 11 of the Copyright Act, 5768-2007 grants an exclusive right to copy a work, perform it in public, broadcast it and make it available to the public; doing so without the right holder’s permission may be an infringement. Section 19, on the other hand, allows “fair use” of a work for purposes such as study, research, criticism and news reporting, according to four considerations: the purpose of the use, the nature of the work, the scope of the use and its effect on the market for the work. In case of infringement, section 56 allows a claim for compensation “without proof of damage” of up to NIS 100,000 for each infringement.

Privacy and direct mailing: two laws, two duties

When a body collects personal information, section 11 of the Protection of Privacy Law, 5741-1981 imposes a disclosure duty on it: to state whether providing the information is a legal duty or depends on consent, for what purpose the information is requested and to whom it will be transferred. Section 13 gives every person a right of access to the personal information collected about them, and section 14 — a right to ask that information that is not correct, complete, clear or up to date be corrected or deleted. This is a different duty from the one imposed by section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982, the “Spam Law”: a prohibition on sending advertising by email, text message or fax without express prior consent, except for an exception for an “existing customer”, and a duty to state “advertisement” and to include a simple opt-out mechanism.

A numerical example

A creator whose photograph was copied for commercial use without permission and without credit may ask for, and the court may award, compensation without proof of damage of up to NIS 100,000 (section 56 of the Copyright Act). Similarly, a company that knowingly sent 300 advertising messages without express consent is exposed to claims for exemplary damages of up to NIS 1,000 for each message (section 30A(j)) — up to NIS 300,000 in total — without proof of financial damage; in a class action, on the other hand, exemplary damages will not be awarded (section 20(e) of the Class Actions Law).

Three laws in digital commerce: what each law governs and the main duty
Law	What it governs	Main duty
The Copyright Act	Use of text, images, code and other digital content	The copyright owner’s permission is required, unless the use is permitted, such as fair use (section 19)
The Protection of Privacy Law	Collecting and using personal information	A disclosure duty when collecting, and a right of access, correction and deletion (sections 11, 13, 14)
The Communications (Telecommunications and Broadcasting) Law	Direct marketing by email, text message or fax	Express prior consent, unless the existing customer exception applies (section 30A)

For practical guides, see Fair use in copyright: the limits of the law, The Spam Law: electronic marketing and consent requirements and Privacy policy: what it must include, as well as the index of sections of the Copyright Act, the index of sections of the Communications Law and the index of sections of the Protection of Privacy Law.

Map of the topic

Law and technology cover the legal issues raised by digital products and services: who owns the outputs of artificial intelligence and who is responsible when it makes a mistake, what must appear in the terms of use of a website or an API, what the law is when information is stored in the cloud outside Israel, and what the accessibility duties require. A lawyer is needed mainly before launching a product or service, when drafting the agreements with suppliers and customers, and when an incident occurs — a leak, a claim or a regulator’s demand.

Trademarks, copyright and demand letters over content: Trademarks and copyright: a map of the area.

Artificial intelligence: ownership, liability and contracts

Copyright law was built around a human creator and a requirement of originality, so ownership of content created by artificial intelligence depends on the extent of the human contribution and on the terms of service; liability for damage caused by an algorithm may be divided between the developer, the operator and the user. See: ownership of content created by AI, AI clauses in contracts, legal liability of AI, generative AI, deepfake and voice assistants.

Cloud, data and IoT

Storing information in the cloud does not release the business from its duties under the Protection of Privacy Law and the data security regulations: it remains responsible for the information even when the server is abroad, and must regulate in the contract with the provider the security, the access and the reporting of incidents. See: cloud computing, data sovereignty in the cloud and the Internet of Things (IoT). For attacks on systems and online fraud — cyber offenses.

Websites, terms of use and accessibility

Terms of use are a contract between the website operator and the user, and a privacy policy is the accepted way to give the notice that section 11 of the Protection of Privacy Law requires when personal information is collected; an API requires terms of its own. A website that provides a service to the public must also make accessibility adjustments under the service accessibility regulations. See: website terms of use, API terms of use, website accessibility and standards, SaaS agreement, digital signature and a refund for an online purchase.

Whistleblowers and related articles

The category also includes the protection of whistleblowers and reward claims, and articles from other categories that concern technology businesses: fintech regulation, misleading advertising and assignment of rights in a contract.

The law of privacy sets what may be collected about a person, for what purpose, how the information must be kept and when it must be deleted. In Israel the framework is the Protection of Privacy Law and its regulations, and for companies that target the European market — also the GDPR. A lawyer is needed when setting up a database of customers or employees, before introducing cameras, biometric identification or tracking tools, when a security incident occurs, and when a person discovers that information about them was collected or published without their consent.

The Protection of Privacy Law and databases

Whoever asks for personal information must say for what purpose and to whom it will be provided, and the data subject has a right of access and correction. Amendment No. 13 to the Law, which came into force on 14 August 2025, narrowed the duty to register databases in the private sector, significantly expanded the enforcement tools of the Privacy Protection Authority and added a duty to appoint a privacy protection officer in certain bodies. See: a customer data leak — the company’s duties and exposure, privacy protection and the GDPR, privacy policy and compensation for invasion of privacy. The sections — in the Protection of Privacy Law.

Biometric information and facial recognition

A fingerprint, a face scan and a voice are information that cannot be replaced, so collecting it requires informed consent, a defined purpose and a high level of security; the use of facial recognition in public spaces and in the workplace is examined with extra strictness. See: biometric information, facial recognition and drones and privacy.

Privacy in the workplace

An employer has a legitimate interest in supervision, but it is subject to the principles of proportionality, transparency and consent: cameras require advance notice and a defined purpose, and access to the employee’s email inbox is limited. See: privacy in the workplace and security cameras.

Consent, children and Privacy by Design

Valid consent is informed consent, so consent interfaces must show clearly what is collected and why; information about minors requires extra care, and Privacy by Design builds protection into the product already at the planning stage. See: managing privacy consents, children’s privacy online, Privacy by Design, direct mailing and advertising and cross-border e-commerce.

By business stage

The same guides, by the stage the business is at:

Setting up and partners

Launching a website or a store

Customer and supplier contracts

Privacy and databases

Using AI in a business

Direct mailing and marketing

Raising funds or selling

The guides in this area (57)

All the indexed guides on the site in this area. Each guide states the legislation it relies on.

FAQ

What is “fair use” in copyright, and when does it apply?
Fair use (section 19 of the Copyright Act) allows the use of a protected work for purposes such as study, research, criticism or news reporting. The court examines the purpose of the use, the nature of the work, its scope and its effect on the market for the work. Full commercial use without credit will almost never be recognized as fair.

What information must an online store disclose to me when it collects my details?
Under section 11 of the Protection of Privacy Law, it must state whether providing the information is a legal duty or depends on my consent, for what purpose the information is requested and to whom it will be transferred. Under section 13 I also have a right of access to the information, and under section 14 - to ask that information that is not correct, complete, clear or up to date be corrected or deleted.

May a company send me marketing emails without asking me?
No, unless I am its “existing customer” in the narrow sense set by the law. Section 30A of the Communications Law prohibits sending advertising by email, text message or fax without express prior consent, and the court may award exemplary damages of up to NIS 1,000 for each message sent knowingly - and a message is presumed to have been sent knowingly - without proof of damage (section 30A(j)).

Who is legally responsible for content that AI created?
Israel has no dedicated law on artificial intelligence - rights to content created with it, or liability for damage caused by its output, are examined through the existing laws of privacy, copyright and torts.

Who owns content created with AI?
Israel has no dedicated statutory provision, and copyright law depends on an original work by a human; artificial intelligence is not an “author” and cannot hold rights. The more significant the human contribution — instructions, editing and selection — the greater the chance that the output will be protected. In practice, ownership and the license are also set in the tool’s terms of use and in the contract with the client, so it is important to settle them in writing. See: ownership of content created by AI.

Must a business website be accessible?
As a rule, yes. The Equal Rights for Persons with Disabilities (Service Accessibility Adjustments) Regulations require anyone who provides a service to the public — including a company or a licensed dealer — to make the website accessible under Israeli Standard IS 5568, which adopts the WCAG guidelines, subject to defined exemptions - including an exemption for an exempt dealer and for a business with a low average annual turnover (regulation 35F), and an exemption for an undue burden that can be requested from the Commission for Equal Rights of Persons with Disabilities. For a deviation from the requirements, a notice must first be sent, and it counts as a breach only if it was not corrected within a reasonable time and no later than 60 days (regulation 35A(d)); a breach exposes the business to a claim and to compensation without proof of damage. See: website accessibility.

What must appear in the terms of use of a website or an app?
The operator’s identity and contact details, a description of the service and its terms of use, intellectual property and the license to the user, limitation of liability, a cancellation and refund policy where there are sales, the governing law and jurisdiction — and alongside them a separate privacy policy that sets out what information is collected, for what purpose and to whom it is provided. See: website terms of use.

Is a business liable for information that leaked from its cloud provider?
Yes. The controller of the database remains responsible under the Protection of Privacy Law and the data security regulations even when the information is stored with an outside provider or abroad: it must choose a suitable provider, set out the security and reporting duties in the contract and keep a right of audit for itself. In databases at a medium or high security level, there is also a duty to report a severe security incident to the Privacy Protection Authority. See: cloud computing: legal issues.

Does my business still have to register a database?
In most cases, no. Since Amendment No. 13 came into force in August 2025, the duty to register in the private sector has been almost entirely abolished and remains mainly for databases whose main purpose is collecting information in order to provide it to others and that contain information on more than 10,000 people, and for databases of public bodies (section 8A(a)); a database that contains information of special sensitivity on more than 100,000 people requires a notice to the Authority (section 8A(b)). Abolishing the duty to register does not abolish the other duties — disclosure, data security, the right of access, and in certain bodies the appointment of a privacy protection officer. See: Amendment 13 to the Protection of Privacy Law: what a business must do now.

What do you do when a data leak is discovered?
Stop the leak and document the incident — what leaked, when and who was exposed; in databases at a medium or high security level, report a severe security incident to the Privacy Protection Authority, and the Authority may order that the data subjects be informed; and check whether additional reporting duties apply, for example under the GDPR for European customers. See: the duties of Israeli companies.

May cameras be installed in the workplace?
Yes, under conditions: a legitimate and defined purpose (for example security), informing the employees in advance that the cameras exist and what they are for, a location that does not invade privacy more than necessary — not in break rooms, toilets or changing rooms — and keeping the recordings for a limited time. Covert monitoring, or using the footage for another purpose, may make the evidence inadmissible and expose the employer to a claim. See: security cameras: privacy duties.

Does the GDPR apply to an Israeli company?
Yes, if it offers goods or services to people in the European Union or monitors their behavior — even without a branch in Europe. In such a case, duties apply in addition to those under Israeli law, including a legal basis for processing, expanded rights for data subjects and sometimes the appointment of a representative in the EU. See: privacy protection and the GDPR.

For collected answers in all practice areas, see the FAQ page, and for the map of services — all practice areas.

All the questions on the site about digital commerce and artificial intelligence, grouped by page, and each question links to its answer.

For short definitions with the section of the law, for example standard-form contract, advertising message and misleading, see the glossary of legal terms.

Template for refusing advertising messages, and more calculators and self-checks on the calculators and tools page.

Do you need legal support with digital commerce, artificial intelligence and privacy?

Yaron Meiri, Adv. & CPA — lawyer and CPA, an independent office in Kiryat Ono. Member of the Israel Bar Association and of the Institute of Certified Public Accountants in Israel.

Digital commerce and artificial intelligence · Frequently asked questions

The content of this page is general information, is not legal advice and does not create an attorney-client relationship. Translated: 12 November 2026 · Hebrew version updated: 4 October 2026.

A question about a website, privacy or AI? Leave your details for a first call

Your name and phone number are enough. Your message goes to the office’s email inbox and is read by Yaron Meiri, Adv. & CPA himself, not by a call center. I will get back to you within one business day. You can also write to me directly on WhatsApp.

After sending, you will return to this page. I will get back to you within one business day; you can also call: +972-50-431-3155.

Prefer to talk? +972-50-431-3155 · WhatsApp