E-commerce example: essential legal aspects 2026

E-commerce now accounts for more than 15% of retail trade in France, according to the latest figures from the FEVAD (the French e-commerce and distance selling federation). Yet many entrepreneurs start selling online without fully mastering their legal obligations. This lack of knowledge exposes them to considerable risks: sanctions from the DGCCRF (the French consumer protection and fraud control authority), disputes with consumers, blocking of bank accounts, or prosecution for unfair commercial practices. This guide sets out the essential legal aspects that every e-commerce project owner needs to know before launching an online shop, from the formalities of setting up to the rules specific to digital platforms.

Legal status and set-up formalities

Choosing the right legal form

The choice of legal status determines all future obligations. For an online selling business, several options are open to entrepreneurs:

The sole trader under the micro-entrepreneur regime (auto-entrepreneur) remains attractive for testing a business with turnover capped at €188,700 for the sale of goods in 2026. This regime simplifies filings but limits the possibilities for deducting expenses. The steps for setting up an auto-entreprise and the tax obligations attached to it are detailed in our guide to this regime.

The EURL (single-member limited liability company, entreprise unipersonnelle à responsabilité limitée) suits an individual business with protection of personal assets. The manager who is the sole shareholder falls under the self-employed social security regime and may opt for corporate income tax.

The SARL (private limited company) is the natural choice as soon as several people join together. It offers a flexible structure and effective protection of the shareholders' personal assets.

The SAS (simplified joint stock company, société par actions simplifiée) appeals through its flexibility in its articles of association and the favourable social security regime of the president (treated as an employee). It also makes it easier for investors to come in.

Registration and mandatory filings

Any commercial activity, even one carried on exclusively online, requires registration with the Trade and Companies Register (registre du commerce et des sociétés, RCS) kept by the registry of the commercial court. This formality is now carried out through the INPI electronic one-stop shop (the French intellectual property office) since 1 January 2023. The full process of setting up a company through the one-stop shop of the INPI is set out in our guide to company formation.

Registration automatically results in the allocation of a SIRET number and entry in the INSEE files. The APE code allocated must correspond precisely to the activity carried on: 47.91A for distance selling from a general catalogue, 47.91B for distance selling from a specialised catalogue.

Beware of sector-specific declarations. The sale of food products requires a declaration to the DDPP (the departmental consumer protection directorate). Cosmetics require registration on the CPNP (Cosmetic Products Notification Portal) with the ANSM (the French medicines and health products agency).

Legal notices and mandatory information

Identification of the professional seller

Article L. 121-18 of the French Consumer Code imposes strict identification information on every e-commerce site. This information must appear clearly and be easily accessible:

The full company name or corporate name, without fanciful abbreviation. For an individual trader, the surname and forenames are sufficient, but where a trade name is used it must be stated.

The geographical address of the registered office, and not a mere post office box. This requirement is intended to allow consumers to identify their counterparty precisely and, where necessary, to bring proceedings.

The RCS registration number, in the form "RCS [city] [number]". This information authenticates the lawful nature of the commercial activity.

The intra-Community VAT number where the business is subject to VAT. It begins with "FR" followed by two digits and then the SIRET number.

Contact and customer service

Contact details are a major obligation that is often overlooked. The site must display a telephone number and an email address through which the business can actually be reached.

Article L. 221-5 of the French Consumer Code provides that this information must allow "direct and effective communication" with the professional. A simple contact form is therefore not sufficient.

For paid services, displaying a premium-rate number is prohibited by Article L. 121-19 of the French Consumer Code. The cost of the call may not exceed that of a call to a geographical or mobile number.

General terms and conditions of sale and consumer protection

Drafting and enforceability of the general terms and conditions of sale (CGV)

The general terms and conditions of sale (conditions générales de vente, CGV) form the contractual foundation of every e-commerce transaction. Their drafting requires particular attention because they bind the consumer once the consumer has had notice of them before confirming the order.

Article 1119 of the French Civil Code sets out the principle that contractual clauses are enforceable if "brought to the attention of the person against whom they are relied upon". In e-commerce, this knowledge is established by displaying a link to the CGV on the order page and by requiring a confirmation box to be ticked.

The CGV must cover the whole commercial process: description of the goods or services, price and payment terms, delivery times, conditions for exercising the right of withdrawal, statutory and commercial warranties.

Detailed pre-contractual information

Article L. 221-5 of the French Consumer Code lists fifteen items of mandatory information to be provided to the consumer before the contract is concluded. This list, which transposes European Directive 2011/83/EU, applies in full to online sales.

Among this information is the detailed description of the essential characteristics of the goods or service. This description engages the seller's liability: any significant discrepancy between the description and the product delivered is a lack of conformity giving a right to redress.

The price must be stated "in a clear and unambiguous manner", inclusive of all taxes. Delivery costs must be stated separately. Failure to give information on these costs makes them unenforceable against the consumer under Article L. 221-15 of the French Consumer Code.

The ordering process and the double click

Article 1127-2 of the French Civil Code, arising from the ordinance of 16 June 2005, governs the conclusion of electronic contracts through a strict process. This mechanism, known as the "double click", protects the consumer against unintended orders.

Before final confirmation, the site must present an order summary allowing the detail and the total price to be checked, and any errors to be corrected. This summary page is a mandatory step that cannot be bypassed.

Confirmation is made by a button whose label must be explicit. Article L. 221-14 of the French Consumer Code requires the wording "order with obligation to pay" or an equivalent unambiguous formulation for paid purchases.

The right of withdrawal and statutory time limits

Time limit and how the right is exercised

The right of withdrawal is a fundamental consumer protection in distance selling. Article L. 221-18 of the French Consumer Code sets a period of fourteen calendar days from receipt of the goods.

This period is extended to one year where the consumer was not informed of the existence and terms of exercise of the right of withdrawal. The information must be provided in accordance with the model instructions annexed to the Consumer Code.

The right of withdrawal is exercised by an unambiguous statement. The consumer may use the standard form provided by the professional, but is not obliged to do so. A simple email stating the wish to withdraw is sufficient.

Exceptions to the right of withdrawal

Certain goods and services are excluded from the right of withdrawal under Article L. 221-28 of the French Consumer Code. These exceptions, which are interpreted strictly, concern in particular:

Goods made to the consumer's specifications or clearly personalised. This exception covers made-to-measure products, but does not extend to mere personalisation options (engraving a first name, choice of colour).

Perishable goods or goods liable to deteriorate rapidly. The assessment varies according to the nature of the product: a bouquet of flowers clearly falls into this category, unlike food products with a distant consumption date.

Audio or video recordings and computer software where the physical medium has been unsealed by the consumer. This exception protects intellectual property while preserving the consumer's rights as long as the packaging remains intact.

Personal data management and the GDPR

Legal basis for processing

The processing of personal data in the context of an online shop generally finds its legal basis in the performance of the contract under Article 6(1)(b) of the GDPR. This basis covers the data strictly necessary for performing the order: identity, delivery address, contact details.

Processing for direct marketing purposes requires the consumer's consent or relies on the legitimate interest of the controller. Legitimate interest is assessed case by case according to the proportionality test defined by the guidelines of the European Data Protection Board (EDPB).

Beware of advertising cookies and trackers, which require prior consent that is freely given, specific, informed and unambiguous under Article 82 of the amended French Data Protection Act (loi Informatique et Libertés). The CNIL recommendations of 4 July 2019 specify the practical arrangements for collecting this consent.

Informing data subjects

Article 13 of the GDPR requires complete information to be given to the individuals whose data is collected. This information, generally provided through a privacy policy, must cover the identity of the controller, the purposes pursued, the legal basis, the recipients and the retention period.

Retention periods must be determined and proportionate to the purposes. For order data, practice generally retains three years after the end of the commercial relationship, in line with the rules on commercial warranty.

The contact details of the data protection officer (DPO) must be provided where appointing one is mandatory. This obligation concerns mainly public bodies and businesses whose core activities consist of regular and systematic monitoring on a large scale.

Payment security and fraud prevention

Security obligations

The European Payment Services Directive (PSD2), transposed into French law by the ordinance of 27 July 2017, strengthens the security requirements for electronic payments. Strong customer authentication becomes mandatory for most transactions, subject to limited exceptions.

This authentication relies on at least two elements belonging to different categories: knowledge (password), possession (mobile phone) or inherence (biometric fingerprint). The technical arrangements are specified by the regulatory technical standards of the European Banking Authority of 13 March 2018.

E-commerce sites must also comply with the PCI DSS (Payment Card Industry Data Security Standard) security standards where they store, process or transmit bank card data. These technical requirements often exceed in-house skills and justify using certified payment providers.

Liability in the event of fraud

The allocation of liability in the event of a fraudulent payment follows a complex regime defined by Articles L. 133-18 et seq. of the French Monetary and Financial Code. The general principle places the burden of proof on the credit institution to demonstrate the authentication and authorisation of the transaction.

The merchant engages its liability in the event of negligence in verifying the cardholder's identity. This negligence is assessed in particular in light of the verification systems in place: CVV code check, address verification, behavioural analysis.

Payment platforms generally offer fraud insurance for an additional commission. These guarantees deserve careful examination because they often contain exclusions for certain business sectors or types of product.

Statutory warranties and product liability

The warranty of conformity

The statutory warranty of conformity, reformed by the ordinance of 17 February 2016 and the decree of 18 March 2016, applies to all goods sold to consumers. This warranty covers defects existing at the time of delivery and may be exercised for two years.

Conformity is assessed according to several cumulative criteria defined in Article L. 217-5 of the French Consumer Code: correspondence with the description, fitness for the use habitually expected, presentation of the qualities advertised. The professional seller bears a presumption that defects pre-date delivery for twenty-four months.

In the event of a lack of conformity, the consumer chooses between repair and replacement, unless the option chosen proves impossible or disproportionate. Failing bringing the goods into conformity, the consumer may demand a price reduction or rescission of the sale.

The warranty against latent defects

The warranty against latent defects (vices cachés), governed by Articles 1641 et seq. of the French Civil Code, coexists with the warranty of conformity. It covers hidden defects that make the goods unfit for their intended use or reduce their use so much that the buyer would not have bought them.

The claim must be brought within two years of discovery of the defect. This period, distinct from that of the warranty of conformity, may prove more favourable to the consumer for certain defects that appear late.

The consumer may choose between return of the price (rescissory action, action rédhibitoire) and a proportionate reduction (price-reduction action, action estimatoire), plus damages if the seller knew of the defects.

Rules specific to digital platforms

Host or publisher status

The distinction between host and publisher determines the liability regime applicable to platforms. Article 6 of the French Law for Confidence in the Digital Economy (LCEN) of 21 June 2004 defines the host as the person who provides storage of content supplied by third parties.

Intermediary platforms (marketplaces) generally have host status as long as they merely bring sellers and buyers together without intervening in the transaction. This status limits their liability for unlawful content, provided they act promptly after notification. On the contractual issues raised by marketplaces and the European regulation of these platforms, see our article on their legal definition.

However, certain practices tip a platform into publisher status: active selection of sellers, editorial presentation of offers, involvement in price setting. This characterisation engages wider liability for the content published.

Transparency obligations

The Law for a Digital Republic of 7 October 2016 imposes enhanced information obligations on platforms. Article L. 111-7 of the French Consumer Code requires in particular the disclosure of the general terms of use and of the listing arrangements.

Intermediary platforms must state clearly whether or not there is a contractual relationship with the professionals listed. This information avoids any confusion about the identity of the consumer's counterparty.

The European P2B (Platform to Business) Regulation of 20 June 2019, applicable since July 2020, strengthens transparency towards business users. It requires in particular the publication of clear terms and conditions and the setting up of internal complaint-handling systems.

Delivery and carrier liability

Transfer of ownership and of risk

Article 1196 of the French Civil Code, arising from the 2016 reform, maintains the principle of transfer of ownership by the mere exchange of consents. However, for the sale of generic goods, the transfer takes place when the goods are individualised.

For sales with delivery, the parties may agree a deferred transfer of risk. The general terms and conditions of sale generally set this transfer at handover to the carrier or at actual delivery, depending on the arrangements chosen.

This distinction is of major practical importance in the event of loss or damage during transport. A seller who transfers risk as soon as the goods are handed to the carrier is relieved of such incidents, except for fault in the choice of carrier or in the instructions given to the carrier.

Delivery times and penalties

Article L. 216-2 of the French Consumer Code requires the professional to deliver the goods within thirty days of the conclusion of the contract, unless otherwise agreed. This statutory period applies in the absence of a different contractual stipulation.

Exceeding the agreed or statutory period entitles the consumer to serve a formal notice to deliver within an additional reasonable period. Failing delivery within that period, the contract is terminated by operation of law.

Penalty clauses providing for fixed compensation for late delivery must comply with Articles 1231-5 and 1231-6 of the French Civil Code. The judge may revise these penalties if they are manifestly excessive or derisory.

E-commerce taxation

VAT on online sales

The VAT regime applicable to online sales follows the general rules with some specific features. For sales of goods to individuals, VAT applies at the rate of the country of departure up to certain turnover thresholds per Member State.

Since 1 July 2021, the e-commerce VAT package has significantly changed these rules. The VAT exemption of €22 for imports has been abolished. Platforms become responsible for collecting VAT on sales of imported goods valued at less than €150.

The OSS (One Stop Shop) mechanism makes it possible to declare and pay the VAT due in all Member States through a single national portal. This simplification applies to services and, since 2021, to distance sales of goods.

Specific reporting obligations

Sales made through platforms give rise to particular reporting obligations. Platforms must send the tax authorities each year the information relating to professional sellers under Article 242 bis of the French General Tax Code.

This reporting concerns the identity of the sellers, the gross amount of transactions and the commissions charged. The aim is to combat tax fraud by sellers using these distribution channels.

Occasional sellers exceeding certain thresholds (€3,000 and 20 transactions per year) are also reported. This measure extends tax monitoring to individuals developing a regular online selling activity.

Frequently asked questions

Can I sell online as an auto-entrepreneur?

Yes, the auto-entrepreneur regime allows online selling up to the ceiling of €188,700 of annual turnover for the sale of goods. You must declare the activity of "distance selling" and comply with all legal obligations: legal notices, general terms and conditions of sale, right of withdrawal and personal data protection. The absence of RCS registration does not exempt you from any obligation under the Consumer Code.

Which legal notices are mandatory on an e-commerce site?

Your site must display the company name, the address of the registered office, the RCS number, the intra-Community VAT number, a telephone number and an email address. This information must be easily accessible, generally through a "Legal notices" link in the footer. Omitting these details exposes you to a fine of €1,500 under Article R. 121-1 of the French Consumer Code.

Does the 14-day right of withdrawal apply to all products?

No, certain goods are excluded from the right of withdrawal: personalised products, perishable foodstuffs, dematerialised digital content or unsealed goods that cannot be returned for hygiene reasons. For other products, the period runs from receipt of the goods and may be exercised without giving a reason or incurring a penalty. You must refund within 14 days of the withdrawal, but may wait until you receive the goods before refunding.

How can I comply with the GDPR for an online shop?

You must inform your customers clearly about the use of their data through a detailed privacy policy. Collect only the data necessary for the transaction (legal basis: performance of the contract). For marketing, obtain explicit consent through an unticked checkbox. Implement a cookie banner that complies with the CNIL recommendations and appoint a DPO if your activity requires it. Keep order data for a maximum of 3 years after the end of the commercial relationship.

What are my obligations when selling to the European Union?

Since July 2021, the e-commerce VAT package imposes new rules. For B2C sales, you must charge the VAT of the country of destination from the first euro through the OSS (One Stop Shop) mechanism. Platforms collect VAT directly for imported goods worth less than €150. You must also comply with each country's regulations on product conformity and labelling, which are particularly strict in Germany and the Netherlands.

Who is liable if there is a delivery problem?

Your liability depends on the moment of transfer of risk set in your general terms and conditions of sale. If you transfer risk at handover to the carrier, you are no longer liable for losses or damage during transport. However, you remain responsible for meeting the maximum 30-day delivery period (unless otherwise agreed) and must offer a solution if the carrier fails. The consumer retains all remedies against you, and it is for you to take recourse against the carrier.

Can I refuse an order after payment has been confirmed?

In principle no: an order that has been confirmed and paid forms a binding contract. You may refuse only on legitimate grounds: insufficient stock, technical problem, proven suspicion of fraud. You must then refund immediately and in full, without deducting any charges. Abusive cancellation exposes you to damages for breach of contract. Include in your CGV a retention of title clause until actual payment and check availability in real time to avoid overselling.

E-commerce imposes a demanding but manageable legal framework. Regulatory compliance is not an obstacle to commercial development but a guarantee of durability and trust. In view of the growing complexity of the obligations, in particular on data protection and European taxation, being assisted by an adviser who focuses on this area often becomes indispensable. Before any launch, have your processes and contractual documents audited by a digital law professional in order to secure your business and concentrate calmly on your commercial development.