Launching an E-commerce Store: Complete Legal Guide 2026

Launching an e-commerce store in France represents a major economic opportunity, with a market exceeding 160 billion euros in 2023 according to FEVAD. However, this entrepreneurial venture comes with a strict legal framework that tolerates no approximation. Between the Law for Confidence in the Digital Economy (LCEN) of 21 June 2004, the General Data Protection Regulation (GDPR) and successive European directives, the online seller must master a complex regulatory ecosystem. This comprehensive guide accompanies you through the key steps to structure your e-commerce project with complete legal security, from drafting legal notices to implementing PCI-DSS compliant payment processes, including returns management and delivery.

Mandatory Legal Notices on Your Site

Article 6-III of the LCEN requires every e-commerce website editor to publish legal notices accessible from each page of the site. For a legal entity, these notices must include the company name, registered address, RCS number, share capital, intra-community VAT number, and the name of the publication manager. For a sole trader, complete identity and professional address are required.

Non-compliance with these obligations exposes you to a penalty of up to 75,000 euros in fines and one year's imprisonment (article 6-VI-2 of the LCEN). Beyond standard legal notices, your store must display the website host with complete contact details, information relating to consumer dispute resolution (article L.616-1 of the Consumer Code) and, for regulated activities, the corresponding professional authorisation number.

Drafting E-commerce Terms and Conditions

General Terms and Conditions constitute the contract binding the seller to the consumer. Article L.221-5 of the Consumer Code imposes a precise list of pre-contractual information: essential product characteristics, price including VAT, payment methods, delivery and execution arrangements, delivery date, right of withdrawal, legal guarantees of conformity and hidden defects.

European Directive 2019/770 on contracts for the supply of digital content strengthens these obligations for digital goods and online services. Your terms and conditions must be explicitly accepted by the consumer before order validation via a distinct checkbox (not pre-ticked according to CJEU ruling C-673/17). The double-click confirmation provided for in article 1127-2 of the Civil Code is also mandatory for any contract concluded electronically.

Secure Payment and PCI-DSS Compliance

Securing online payments complies with the PCI-DSS standard (Payment Card Industry Data Security Standard) which imposes 12 technical and organisational requirements to protect bank card data. Since September 2019, the DSP2 Directive (Payment Services Directive 2) requires strong customer authentication (SCA - Strong Customer Authentication) for any transaction exceeding 30 euros, via the 3D Secure v2 protocol.

Choosing a certified payment service provider (PSP) such as Stripe, Mangopay, Adyen or Lyra partially relieves the trader of the most complex technical obligations. However, legal responsibility in case of fraud remains governed by article L.133-19 of the Monetary and Financial Code, which strongly protects the consumer in case of unauthorised transaction.

Delivery and Right of Withdrawal

Article L.216-1 of the Consumer Code requires delivery within a maximum of 30 days unless a different contractual agreement applies. The consumer has a withdrawal period of 14 calendar days from receipt of the goods (article L.221-18), without having to justify their decision. Return costs may be charged to the customer if this is clearly stated in the terms and conditions.

Certain categories of products are exempt from the right of withdrawal: personalised goods, perishable foodstuffs, dematerialised digital content after execution (article L.221-28). The refund must take place within 14 days following withdrawal, subject to legal interest.