PCI DSS 4.0 for Online Shops: Compliance Rules 2026
From 2026 all 64 new PCI DSS 4.x requirements are binding. Script management, MFA and tokenization for online shops, implemented pragmatically.
Insights on e-commerce, web development and digital solutions
Here you find our articles about online shops, websites and web tech. We explain new rules, tools and good ways of working. You can filter the articles by topic. At the top of an article you find a short version in plain words. Ask us if something is still not clear.
From 2026 all 64 new PCI DSS 4.x requirements are binding. Script management, MFA and tokenization for online shops, implemented pragmatically.
The transition period for issuing invoices is running out – here's how to prepare your online shop, choose between ZUGFeRD and XRechnung, and meet the requirements of German VAT law.
The new EU Consumer Credit Directive also covers BNPL offerings, applicable from November 20, 2026. What online retailers need to know about compliant payment integration.
The Green Claims Directive has been on hold since June 2025. What binds you is the EmpCo Directive: start of application 27 September 2026, with no grandfathering.
The cybersecurity obligations apply without a transition period and reach into the supply chain. Who is affected, which evidence is required and how to prepare reporting channels in time.
Since August 12, 2026, the new EU Packaging Regulation has applied: recycling standards, recyclate quotas, and maximum empty space quotas for shipping packaging.
The EU introduces the digital product passport step by step: for batteries from February 18, 2027, for other product groups per delegated act. What shop owners need to know and prepare now.
The European Accessibility Act applies to many online shops. This article sorts the requirements by effort, shows typical checkout barriers and where the obligation actually begins.
Larger targets, terms explained, input help, clear focus, no time limits
You decide which optional data processing to allow.
Our anonymous reach measurement runs without cookies and without IP storage, including campaign parameters in links – we do not ask for consent for it because none is legally required.
Strictly required: language preference, core site functions and storing your cookie choice. Without these the site does not work. Settings you choose yourself (light/dark appearance, accessibility) are kept in your browser's local storage only once you choose them; "Reset" in the accessibility settings removes them.
Records your interactions (clicks, scrolling, inputs) pseudonymously so we can spot usability issues. Form field inputs are masked automatically before storage; your IP address is not saved with the recording. Served from our own domain, no external tool. Opt-in, revocable any time.