Launching an e-commerce store: Complete legal guide 2026

Launching an e-commerce store in France represents a major economic opportunity, with a market exceeding 160 billion euros in 2023 according to FEVAD. However, this entrepreneurial venture comes with a strict legal framework that tolerates no approximation. Between the Law for Confidence in the Digital Economy (LCEN) of 21 June 2004, the General Data Protection Regulation (GDPR) and successive European directives, the online seller must master a complex regulatory ecosystem. This comprehensive guide accompanies you through the key steps to structure your e-commerce project with complete legal security, from drafting legal notices to implementing compliant payment processes (PCI-DSS), including returns management and delivery.

Mandatory legal notices on your website

Article 6-III of the LCEN requires every e-commerce website editor to publish legal notices accessible from every page of the site. For a legal entity, these notices must include the business name, registered office, company registration number, share capital, intra-community VAT number, as well as the name of the publishing director. For a sole trader, complete identity and professional address are required.

Non-compliance with these obligations exposes you to a penalty of up to 75,000 euros in fines and one year's imprisonment (Article 6-VI-2 of the LCEN). Beyond standard legal notices, your store must display the website host with full contact details, information relating to consumer dispute resolution (Article L.616-1 of the Consumer Code) and, for regulated activities, the corresponding professional authorisation number.

Drafting e-commerce terms and conditions

The General Terms and Conditions constitute the contract that binds the seller to the consumer. Article L.221-5 of the Consumer Code imposes a precise list of pre-contractual information: essential characteristics of the product, all-inclusive price, payment methods, delivery and execution terms, delivery date, right of withdrawal, legal guarantees of conformity and hidden defects.

European Directive 2019/770 on contracts for the supply of digital content strengthens these obligations for digital goods and online services. Your terms and conditions must be explicitly accepted by the consumer before order validation via a separate, unticked checkbox (according to CJEU ruling C-673/17). The double-click confirmation provided for in Article 1127-2 of the Civil Code is also mandatory for any contract concluded electronically.

Secure payment and PCI-DSS compliance

The security of online payments complies with the PCI-DSS standard (Payment Card Industry Data Security Standard) which imposes 12 technical and organisational requirements to protect payment card data. Since September 2019, the DSP2 Directive (Payment Services Directive 2) requires strong customer authentication (SCA - Strong Customer Authentication) for any transaction exceeding 30 euros, via the 3D Secure v2 protocol.

The choice of a certified payment service provider (PSP) such as Stripe, Mangopay, Adyen or Lyra partially relieves the merchant of the most complex technical obligations. However, legal responsibility in case of fraud remains governed by Article L.133-19 of the Monetary and Financial Code, which strongly protects the consumer in case of unauthorised transaction.

Delivery and right of withdrawal

Article L.216-1 of the Consumer Code requires delivery within a maximum of 30 days unless a different contractual agreement is reached. The consumer has a 14-day calendar withdrawal period from receipt of the goods (Article L.221-18), without having to give reasons for their decision. Return costs may be charged to the customer if this is clearly stated in the terms and conditions.

Certain categories of products are exempt from the right of withdrawal: personalised goods, perishable foodstuffs, dematerialised digital content after performance (Article L.221-28). The refund must be made within 14 days following withdrawal, failing which a legal surcharge applies.