Johan Anzora
On June 24, Law No. 10,946, known as the “Digital Services Governance and E-Commerce Law,” was published in Costa Rica’s official gazette, La Gaceta. Broadly, this law aims to regulate e-commerce in Costa Rica, the responsibilities of intermediaries and merchants, and consumers’ rights.
The newly published law will enter into force 12 months after its publication. This means that companies have that period to adapt their business practices and their terms and conditions to the new regulatory requirements. The key points to bear in mind about the new legislation are set out below:
I- Scope of application
The law applies to information society services (a service provided for consideration, at a distance, at the individual request of the recipient), intermediary services (infrastructure for data transmission, including mere-conduit services, temporary data copying or caching, data hosting, or online search engines), and e-commerce (the purchase and sale of goods and services through the internet, virtual platforms, apps, and social networks). Despite the breadth of this definition, the law clearly establishes public procurement as an exception, which remains governed by Law No. 9,986.
From a subjective standpoint, the law provides that it applies to any natural or legal person, whether public or private, that carries out or provides the aforementioned services.
II- Rules on digital advertising
Under the law, advertising carried out by merchants over the internet must be clearly identifiable as such. In addition, the name of the company or person on whose behalf the advertising is carried out must be clearly stated. Furthermore, the law establishes the obligation for information about the advertised products or services to be consistent and truthful, so that it reflects their actual features, access, and use.
Advertising must state the final price of the good or service, including all items that make it up. When advertising includes recommendations, these must be well founded, reflect the opinions and experience of those who make them, and disclose whether there is any connection between the recommender and the company.
Finally, advertising directed at minors must, above all, respect their dignity and well-being. Likewise, companies are asked to take the necessary measures to prevent minors from accessing goods and services that are legally unsuitable for them, and to refrain from advertising that shows children in dangerous situations or from presenting situations that encourage minors to engage in improper or illegal conduct.
III- Consumer protection
The law strengthens the protections granted to consumers by Law No. 7,472, the Law on the Promotion of Competition and Effective Consumer Defense. First, the principle of functional equivalence is expanded, in the sense that the protection granted to consumers in the digital sphere may not be less than that recognized in physical or traditional commerce.
Article 11 provides that any digital platform that enables e-commerce must comply with the obligation to supply relevant information for making an informed purchasing decision, comply with personal data protection regulations, and guarantee the rights held by consumers in general. In addition, as a safeguard for consumers, electronic communications and their form and manner of delivery are regulated; in particular, companies are required to clearly identify their communications as advertising, an offer, or an invitation.
Consumers are entitled to receive clear, precise, and easily accessible information, written in plain, easy-to-understand language. They are also entitled to obtain reliable information about the merchant—its identity, location, points of contact, and more. In addition, merchants must inform consumers about the claims and complaints system, payment procedures, the delivery date of the good or provision of the service, the terms of the contract in Spanish, the conditions for exercising the right of withdrawal, the warranty reminder, the duration of the contract and, where applicable, the existence of after-sales support services.
IV- Responsibilities of intermediaries
The law delimits the liability of intermediary service providers by establishing, as a general principle, that they have no general obligation to monitor the information they transmit or store on their platforms. Furthermore, no judicial or administrative authority may prevent intermediaries from providing end-to-end encryption services.
Nevertheless, this exemption from liability applies only where intermediary service providers meet certain conditions, depending on the specific intermediary activity. For example, the regulation requires that they have no knowledge of unlawful activity or content and that they are not the ones who originate the transmission of unlawful data, among other conditions. Additionally, the exemption is lost if the intermediary obtains actual knowledge of any illegality and fails to take corrective action.
V- Due diligence for intermediaries
The law introduces certain due diligence obligations applicable to intermediary service providers. Broadly, the regulation requires all intermediaries to ensure that their terms and conditions meet certain parameters, and it prohibits them from using manipulative designs or dark patterns that mislead consumers.
In addition, special obligations are established for data hosting services and online platforms. The law understands an online platform to be a data hosting service that, at a user’s request, stores and disseminates information to the public. This definition covers not only cloud storage services but also social networks, websites for buying and selling products, environments designed for teaching and education, tools for teamwork or collaboration, and others.
Among the due diligence obligations for online platforms are the duty to make efforts to enable consumers to identify the merchant selling the product or service, to offer safe products to consumers, and to suspend the provision of services to a merchant when there are reasonable doubts about their true identity or the legality of the goods or services offered. In addition, online platforms must provide an effective system for handling complaints.
VI- Conclusions
In conclusion, it is important to note that the law provides for fines ranging from 10 to 50 base salaries—that is, from ₡4,622,000 to ₡23,110,000—for companies that fail to comply with the obligations established by the regulations.
In this context, merchants and digital service providers should take advantage of the 12-month period to review their terms and conditions, privacy policies, complaint-handling mechanisms, digital advertising practices, and consumer information verification processes.
This review will help identify compliance gaps, implement operational adjustments, and reduce the risk of penalties once the law takes effect.
If you would like advice on this topic, please get in touch with us at janzora@consortiumlegal.com and jmgodoy@consortiumlegal.com