Most guides to website requirements in the Philippines are really guides to registering a business. This one assumes your papers are done. The question is narrower: once the site is live, what does the law expect to see on it?
Four rule sets reach the page itself: the BIR, the Data Privacy Act, the Internet Transactions Act, and the browser's own demand for HTTPS. A one-page checklist sits at the end.
This is general information, not legal advice. Where a rule matters to you, read the source we link and ask your accountant or lawyer.
Website requirements in the Philippines: the short version
A registered online business website in the Philippines needs, at minimum: the BIR Registration Seal Badge posted on a visible page, a plain-language privacy notice linked from every form, your business name, physical address, mobile or landline number and email on the homepage, prices on every listing, a complaints and returns process, and HTTPS on every page.
The BIR Registration Seal Badge (deadline 31 October 2026)
If you sell or earn online, the BIR expects proof of registration on your site. That used to mean your Certificate of Registration. It no longer does.
Section 5(H) of Revenue Regulations No. 7-2024 and Section 7 of RR No. 15-2024 told online businesses to post proof of registration online. People posted the whole COR, TIN and home address included, and the complaints followed. On 29 April 2026 the BIR issued Revenue Memorandum Circular No. 38-2026, replacing the COR with a BIR Registration Seal Badge posted "in lieu of the BIR COR/eCOR."
Who it covers, in the circular's words: not only online sellers of goods but "persons engaged in providing services through digital or electronic means or with online presence," down to bloggers, vloggers and influencers. If your site takes bookings or quote requests, assume you're in.
What to post: only the badge, cropped from the COR. Annex B says, in capitals, that the full COR "will show your TIN and address." Keep the badge clear, readable and unaltered. Where: "any page or link in the website, such as: About Page, Company, Government Compliance, Business Permits," plus your shop page on any marketplace you sell through.
How to get it: free, through the BIR's Online Registration and Update System (ORUS) or your Revenue District Office. A COR without a QR code stays valid, but you'll need to update your registration to get a badge, and the update carries a ₱30 loose documentary stamp tax. RMC No. 64-2026 covers taxpayers with nothing else to update; Annex C of RMC 38-2026 is the click-by-click guide. The badge carries a QR code that resolves to https://verify.bir.gov.ph/correspondence/, where anyone can confirm the registration is current.
Deadline: RMC No. 99-2026, published 24 September 2026, gives everyone who hasn't posted the badge until 31 October 2026, "without the imposition of penalties arising solely from the non-display thereof." After that it's less clear: earlier reporting on RR 15-2024 cited a ₱1,000 penalty per violation, but RMC 99-2026 restates no figure. Treat the October date as firm.
The pattern we use: on our own About page the cropped badge sits inside a link to the BIR verification page, so a visitor who can't scan their own screen can still check. One image, one link.
Data Privacy Act website requirements: the privacy notice
Any form on your site collects personal information. A name and a mobile number is enough to make you a personal information controller under Republic Act No. 10173, the Data Privacy Act of 2012.
Section 16(b) says the data subject must be told, before their information enters your system or "at the next practical opportunity":
- What personal information you're collecting.
- Why you're processing it.
- The scope and method of the processing.
- Who will receive it (your email provider, your CRM, a delivery partner).
- Whether automated access is involved.
- The identity and contact details of the controller, meaning your business.
- How long you'll keep it.
- Their rights to access and correct it, and to complain to the National Privacy Commission.
That list is your privacy notice. The NPC's Advisory No. 2021-01 says it should be "in clear and plain language." A 4,000-word template copied from a foreign site doesn't do that. "We collect your name, number and email to call you back about your quote, we keep it two years, we share it with nobody, here's how to ask us to delete it" does. Footer of every page, beside every form.
The penalties aren't small: unauthorized processing under Section 25 carries one to three years' imprisonment and a fine of ₱500,000 to ₱2,000,000. Nobody is going to jail over a contact form. An abandoned site holding an unprotected customer list is a different story.
Consent on forms
Consent is one of six lawful bases in Section 12. For a quote form, "steps at the request of the data subject prior to entering into a contract" (Section 12(b)) usually fits better than consent, because the visitor asked you to call. You still owe them the notice.
Consent becomes the basis once you add a newsletter box or anything the visitor didn't ask for. NPC Circular No. 2023-04, issued 7 November 2023, sets the bar: freely given, specific, informed, and shown by a clear affirmative act. Pre-ticked boxes don't count. Silence doesn't count. One box covering "marketing, partners and analytics" doesn't count either; each purpose gets its own. Withdrawing must be as easy as giving, and you keep a record.
The practical version: one unticked box reading "Send me occasional updates" beside the submit button, a link to the notice, and a backend that stores the box's state with the submission.
Cookies: the rule that still isn't written
As of this writing the NPC has no cookie-specific circular. In February 2024 it told BusinessWorld it was drafting rules on tracking technologies, with consent as "the key step." We couldn't find that advisory published since; the numbered 2024 advisories cover AI systems and child-oriented transparency instead.
What exists is older. NPC Advisory Opinion No. 2017-063 reasoned that cookie data combined with other information can identify a person, so it can be personal information, and Circular 2023-04 then governs the consent. The defensible position in 2026: strictly necessary cookies (session, form security) get a line in the notice; analytics and advertising cookies get a real opt-in before they load.
Our take: a service site with one analytics tag and no ad pixels doesn't need a wall that blocks the page. A short banner with "accept" and "only necessary" that actually withholds the script until "accept" covers the law as it stands and the rule the NPC said it was writing.
The NPC Seal of Registration (only if you must register)
NPC Circular No. 2022-04 makes NPC registration mandatory for controllers with 250 or more employees, those holding sensitive personal information of 1,000 or more people, those whose processing poses a likely risk, and any system doing automated decision-making or profiling. A ten-person service company with a quote form is under every threshold.
If you're over them, the NPC's advisory of 13 November 2023 says the Seal must be visible to website visitors, "either embedding it as a link within your Privacy Notice or prominently displaying it on your webpage." Non-display risks the registration, fines, or a cease-and-desist order. Clinics, schools, lenders and HR platforms should read that one twice.
The Internet Transactions Act: what goes on the homepage
Republic Act No. 11967, the Internet Transactions Act of 2023, finished its 18-month transition in June 2025, and the DTI's E-Commerce Bureau now enforces it in full. The implementing rules are Joint Administrative Order No. 24-03 of 24 May 2024.
If you sell through your own site (an "e-retailer" in the Act's language), Section 23 is the part to read. It requires you to:
- Indicate the price of goods and services offered (Section 23(a)). "Message us for the price" on a listing is the thing this clause was written against.
- Publish on your homepage your corporate or trade name, the physical place of business, and contact details that "must include a mobile or landline number and a valid e-mail address" (Section 23(f)(1)).
- Issue a paper or electronic invoice or receipt for every sale (Section 23(h)).
- Keep "an accessible and efficient redress mechanism for handling complaints" (Section 23(i)). Under Section 24 the customer must use it first, and it counts as exhausted if nothing is resolved after seven calendar days.
On returns, the Act sets no window. Section 20 gives the buyer the Consumer Act's remedies of repair, replacement or refund, so publish a returns page that says what you'll do and how long it takes. The law wants it findable, not generous.
Even if you only take enquiries online, build the homepage block anyway. The BIR badge, the privacy notice and the ITA disclosure all land in the same footer: name, address, mobile, email, badge, link to the notice.
The DTI E-Commerce Trustmark (optional for now)
Section 11 of the ITA told the DTI to "encourage the development of" an E-Commerce Philippine Trustmark, and the DTI launched it under Department Administrative Order 25-12. It was to become mandatory on 30 September 2025. After pushback on the ₱1,130 fee the DTI made it voluntary to the end of 2025, then extended the voluntary period to 31 December 2026 while it finishes a fee scale by business size.
So in 2026 the Trustmark is a badge you may add, not one you must, and the DTI itself says it isn't a licence or permit. If you sell to strangers, it's a cheap trust signal. If your customers come from referrals, skip it this year and watch for the DTI's review in December.
HTTPS: not a statute, still mandatory in practice
No Philippine law says "use HTTPS." Two things make it a requirement anyway.
Section 20 of the Data Privacy Act requires reasonable and appropriate security measures for the personal information you hold. A quote form sent over plain HTTP, name and number in clear text, is hard to call reasonable when a certificate is free.
And Google has used HTTPS as a ranking signal since August 2014, "a very lightweight signal" then, "a positive search quality indicator" in its current guidance. Browsers flag plain HTTP as not secure, and a customer who sees that beside your form doesn't fill it in.
Every site on our web hosting gets a certificate that renews itself. If yours doesn't, it's the first fix below.
Philippine website requirements checklist
| Item | Where on the site | Source |
|---|---|---|
| BIR Registration Seal Badge, cropped, unaltered, linked to verify.bir.gov.ph | About, compliance page or footer | RMC 38-2026; RMC 99-2026 (31 Oct 2026) |
| Privacy notice covering the eight Section 16 items | Footer on every page, beside every form | RA 10173 s.16; NPC Advisory 2021-01 |
| Business or trade name, physical address, mobile or landline, email | Homepage (footer counts) | RA 11967 s.23(f)(1) |
| Prices on every product or service listing | Product and service pages | RA 11967 s.23(a) |
| Returns, refunds and complaints page with a 7-day internal process | Footer and checkout | RA 11967 s.20, s.23(i), s.24 |
| Unticked, per-purpose consent boxes; consent stored with the submission | Every form | NPC Circular 2023-04 |
| Cookie banner that holds analytics and ad tags until "accept" | Site-wide | DPA + Circular 2023-04 (no cookie circular yet) |
| Invoice or receipt for every online sale | Checkout and email | RA 11967 s.23(h) |
| NPC Seal of Registration | Privacy notice or homepage | Only if registered under Circular 2022-04 |
| DTI Trustmark badge | Footer | Optional through 31 Dec 2026 |
| HTTPS everywhere, HTTP redirected | Hosting | DPA s.20; Google |
FAQ
Do I have to post my BIR Certificate of Registration on my website?
Not any more. Since RMC 38-2026 (29 April 2026) you post the BIR Registration Seal Badge instead, cropped so the TIN and address aren't shown. The badge is free from ORUS. The compliance deadline under RMC 99-2026 is 31 October 2026.
Does a small business need a privacy policy on its website in the Philippines?
If the site has any form, yes. The Data Privacy Act applies to anyone processing personal information, and Section 16 lists what you must tell people before collecting it. A short, plain privacy notice in the footer and beside the form satisfies it.
Is a cookie banner required in the Philippines?
There's no cookie-specific NPC rule yet. Under the Act and NPC Circular 2023-04, analytics and advertising cookies that identify people need an opt-in that withholds the script until the visitor accepts. Strictly necessary cookies only need a mention in your notice.
What does the Internet Transactions Act require on my homepage?
Your corporate or trade name, your physical place of business, a mobile or landline number and a valid email address (Section 23(f)(1) of RA 11967). Prices go on every listing, and you need a complaints process that resolves within seven days.
If you'd rather have all of this built in from launch, our web development sites ship with the privacy notice, the consent boxes, the badge slot and HTTPS in place. Choosing the address first? Read .ph vs .com vs .com.ph. Or get started.
