You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 15, 2025

Vietnam’s E-Commerce Legal Framework: A Deep Dive into the Draft E-Commerce Law

More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing.

To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025.

In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future.

Platform Classification: Toward a More Nuanced Framework

Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop.

While this approach reflects the growing complexity of the digital/e-commerce landscape, it currently lacks clear criteria or thresholds for distinguishing between categories. This ambiguity may create uncertainty for platforms that operate across multiple functions, such as combining direct sales, third-party marketplaces, and social commerce features. While such models may potentially fall under the “Multi-Service Integrated Platforms” category, the Draft Law does not currently provide clear criteria to distinguish between overlapping platform types. As a result, it remains unclear how these platforms should be classified and which set of compliance obligations would apply.

Operator Responsibilities: Broader Scope and Heightened Compliance Burden

While Decree 52 required platform registration and basic post-facto monitoring, the Draft Law significantly expands the scope of responsibilities imposed on platform operators. Under the Draft Law, platforms must conduct identity verification for all sellers, including foreign sellers; however, the types of documents deemed legally sufficient for verifying foreign entities have not yet been clarified.

Furthermore, the Draft Law introduces the implementation of automated content moderation tools to screen seller-generated content prior to display, marking a notable advancement beyond the requirements of Decree 52. While the obligation to remove unlawful content within 24 hours upon request from competent authorities remains consistent with Decree 52, the Draft Law imposes additional responsibilities for proactive monitoring and enhanced compliance, particularly in light of heightened regulatory concerns regarding counterfeit goods and consumer protection.

Livestream and Affiliate Regulation: New Obligations to Fill Regulatory Gaps

Previously unregulated under Decree 52, livestream selling and affiliate marketing are now expressly addressed under the Draft Law. These provisions reflect growing regulatory concern over KOLs and influencers promoting products without clear origin and/supporting documentation.

While the new requirements are intended to improve transparency and strengthen consumer protection, they also introduce additional compliance burdens, not only for individual marketers, but also for platform operators. In particular, platforms must implement mechanisms to (i) warn users/viewers of content that is unsuitable for children and (ii) monitor livestream content in real time, enabling the removal of prohibited information and the termination of livestreams containing violating content.

Cross-Border Rules: From Local Presence to Legal Accountability

Under Decree 52, foreign e-commerce platforms targeting Vietnam via Vietnamese domain names, language interfaces, or a high volume of domestic transactions are required to register with the authorities and either establish a representative office or appoint an authorized local representative. While the existing regulations do not fully ensure enforcement against violating foreign platforms, this requirement ensured that authorities had a local point of contact.

The Draft Law retains these jurisdictional thresholds but introduces a significant shift. Accordingly, the appointed local entity is now subject to joint liability for the platform’s compliance with Vietnamese law. This change reflects the MOIT’s efforts to close enforcement loopholes, particularly in relation to counterfeit goods, consumer protection, and cross-border tax compliance.

Supporting Services: Strengthening Oversight Across the E-commerce Chain

Decree 52 made only general references to supporting services such as logistics and payment, without defining their legal responsibilities or integrating them into the compliance framework. The Draft Law takes a more structured approach by explicitly identifying four categories of supporting services: technical infrastructure, logistics, payment, and electronic contract authentication. Providers of these services are now subject to specific obligations, including coordination with platforms and regulators, and implementation of internal inspection and monitoring mechanisms.

This shift seems to reflect the MOIT’s growing concern that the lack of regulation over third-party service providers has contributed to the circulation of counterfeit goods and tax evasion. By formally incorporating these service providers into the compliance framework, the Draft Law aims to close enforcement gaps and strengthen accountability across the digital supply chain.

Algorithm Disclosure: A New Compliance Burden for Platforms

For the first time, the Draft Law introduces provisions requiring e-commerce platforms to disclose information about their algorithms, such as logic, design, and modeling, upon request by competent authorities during violation inspections. While intended to enhance transparency and prevent abuse, this requirement would raise significant concerns for platform operators. Specifically, algorithms are often a company’s core intellectual property developed through substantial investment, and the Draft Law has not yet addressed the scope, format, or confidentiality protections surrounding such disclosures.

Outlook

Compared to the current regime, the Draft Law reflects a more structured and expansive approach, touching not only on core platform activities but also on affiliated functions such as payment, logistics, livestreaming, and data handling. While several provisions await further clarification, the direction of the government is clear: Vietnam is moving toward a more comprehensive, compliance-driven model of digital commerce regulation. Businesses are thus recommended to proactively review how the new obligations may impact their structures, operations, and risk exposure. Companies that adapt early will be best positioned to navigate the transition smoothly and maintain regulatory confidence in an increasingly complex e-commerce environment.

RELATED INSIGHTS​ 

July 24, 2025
Vietnam’s Ministry of Public Security recently released a draft version of the 2025 Cybersecurity Law, which is intended to replace both the existing 2018 Cybersecurity Law and the 2015 Law on Network Information Security (LNIS). This consolidation reflects a broader effort by the Vietnamese government to streamline and centralize the legal framework governing cybersecurity, data protection, and information security to be under the sole authority of the Ministry of Public Security, moving away from the previous sharing of responsibility with the former Ministry of Information and Communications (which ceased operations earlier this year and merged with the Ministry of Science and Technology). This shift aims to eliminate overlaps and improve enforcement efficiency. The draft law is built upon the foundation of principles and provisions of both the 2018 Cybersecurity Law and the 2015 LNIS, while also introducing a wide range of amendments and new regulations. By merging the two laws, the government seeks to reduce legal fragmentation and ensure consistency in definitions, obligations, and enforcement mechanisms across related domains like data protection, IT system classification, and cybercrime prevention. The newly introduced amendments include enhanced obligations for service providers, stricter controls on information transmission, classification of IT systems, designation and protection of nationally important information systems, and sector-specific violations and compliance requirements. Highlights of the draft law are discussed below. Definition and Obligations of Service Providers The draft law clearly defines and significantly broadens the scope of entities considered “service providers” under its jurisdiction. This now includes businesses and individuals offering products or services in cyberspace, including both infrastructure and content online services, such as: Internet service providers (ISPs) and providers of telecommunications, hosting, servers, domain names, VPNs, proxy services, and cloud computing; Providers of social networks, websites, and online gaming; Financial institutions, banks, foreign bank branches in Vietnam, e-wallet
July 23, 2025
On July 4, 2025, Thailand’s Electronic Transactions Development Agency (ETDA) issued two significant notifications that introduce new compliance requirements for ride-hailing platforms operating in the country. The notifications formally designate these platforms as high-impact digital services under section 18(3) of the Royal Decree on Digital Platform Service Businesses and impose a comprehensive set of additional operational obligations. These measures are designed to address regulatory gaps and enhance oversight of digital platforms providing public passenger vehicle or motorcycle ride-hailing services. First, the Notification on the Designation of Ride-Hailing Platforms under section 18(3) formally designates all ride-hailing platforms that have notified the ETDA of their operations as high-impact digital platform services under section 18(3) of the royal decree. Unlike high-risk marketplace platforms, which are named individually, any ride-hailing platform that has notified the ETDA of its operations is automatically subject to these new requirements. Next, the Notification on Additional Obligations for Ride-Hailing Platforms imposes further obligations on ride-hailing platforms, supplementing the general requirements under section 21 of the royal decree. These notifications will come into force 90 days from their publication in the Government Gazette. New Compliance Obligations The new regulatory framework introduces a range of operational, technical, and reporting requirements for ride-hailing platforms, particularly concerning the issues described below. Vehicle and Driver Compliance Operators must: Ensure that all vehicles used on the platform are registered as public vehicles in accordance with Department of Land Transport requirements Verify all drivers hold valid public driving licenses Collect service fees in compliance with applicable fare regulations under the Vehicle Law Digital Platform Features and User Verification Operators must implement robust digital platform features for both drivers and riders, including: Comprehensive identity verification and confirmation processes for drivers and riders, utilizing both face-to-face and non-face-to-face methods, including biometric and digital ID checks Real-time GPS
July 17, 2025
On July 9, 2025, Thailand issued a notification that introduces comprehensive operational requirements for digital platform service providers operating as goods marketplaces, effective December 31, 2025 (i.e., 180 days after its publication in the Government Gazette). The regulation’s official name is Notification of the Electronic Transactions Committee Re: Other Actions for Digital Platform Service Operators in the Category of Marketplace for Goods with Specific Characteristics under Section 18(2) of the Royal Decree on the Operation of Digital Platform Service Businesses that are Subject to Prior Notification B.E. 2565 (2022), B.E. 2568 (2025). Scope of Application The notification applies exclusively to goods marketplace operators formally designated by the Electronic Transactions Development Agency (ETDA), which on the same day designated 19 platforms that had previously notified the ETDA of their operations. The goods requiring enhanced oversight by these operators are limited to those regulated by the Thai Food and Drug Administration (FDA) and the Thai Industrial Standards Institute (TISI). Development from Earlier Draft An earlier draft of the notification had included a requirement for offshore platforms to establish a local entity, but this requirement was removed from the final notification. Key Obligations Despite the removal of the local entity requirement, the notification imposes a range of additional obligations on designated goods marketplace operators: Transparency. Operators must implement robust transparency measures, including clear, accessible, and understandable disclosures to users in Thai. These disclosures must cover all relevant terms and conditions, comprehensive product information, and complaint management procedures. Operators must also submit an annual compliance report to the ETDA within 60 days after the end of their accounting period, including statistics on regulated goods. Business user registration and identity verification. Before permitting the sale or advertisement of regulated goods, operators must collect and verify business user information, including contact details, identification documents, registration
July 15, 2025
Thailand has established new safe harbor rules that require social media platforms to remove specified content within 24 hours of government notification. On July 5, 2025, the Notification of the Electronic Transactions Commission on Measures to Prevent Technological Crimes for Social Media Service Providers was issued and took effect. This followed a hearing in May 2025 where only a select group of social media and online communication platform operators were invited to attend and comment on draft rules that could exempt social media platform operators from joint liability under the amended Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes in cases involving victims of technological crimes. Safe Harbor Rules The notification stipulates procedures that must be followed in order to receive the protection of the safe harbor rules. Upon being notified by the Division of Prevention and Suppression of Cybercrime, Office of the Permanent Secretary of the Ministry of Digital Economy and Society (MDES) of the presence of false or misleading information that may lead to the commission of a technological crime, social media service providers must immediately take down the specified content, with a maximum allowable turnaround time of 24 hours from the time of receiving the notification. Social media service providers are required to promptly report the outcome of each takedown to the MDES Division of Prevention and Suppression. This shift in Thailand’s regulatory approach to social media content moderation establishes clear government oversight mechanisms while providing platforms with liability protection for compliance. As the new rules took immediate effect, social media platforms need to ensure that they have adequate systems and processes in place to comply with the requirements.