Launching an e-commerce store: Complete legal guide 2026

Opening an online shop requires no prior authorisation. However, it immediately triggers a series of obligations whose non-compliance can be observed from the outside, without any on-site inspection: incomplete legal notices, terms and conditions that cannot be enforced against the customer, a non-compliant consent banner, missing information on the right of withdrawal. It is these visible failings that account for most formal notices, well before any substantive issues arise.

Before launch: structure and registration

The choice of legal structure determines liability, the manager's social security regime and taxation. The micro-entrepreneur scheme is suitable for a low-volume start, with simplified accounting but no possibility of deducting expenses or recovering VAT. A company protects personal assets and allows expenses to be deducted, at the cost of full accounting obligations — a trade-off covered in our article on corporate taxation.

Registration is carried out through the single business formalities window (guichet unique). An activity involving the sale of goods falls under the trade and companies register.

Two points are often overlooked at this stage: checking the availability of the trading name and domain name, including against already registered trade marks, and taking out insurance appropriate to the activity.

Mandatory information on the site

This can be checked in a minute, making it the first point of control.

The following must appear accessibly on every page: the company name, legal form and share capital, the registered office address, the registration number, the intra-Community VAT number, contact details allowing direct contact, the name of the publication director and the identity of the host.

Depending on the activity, the following must also be added: membership of a professional body, the authorisation number where required, and any membership of a consumer mediation scheme — this last item being mandatory for any professional selling to consumers.

General terms and conditions of sale

These are mandatory for sales to consumers, and their content is regulated. They must in particular specify the essential characteristics of the goods, prices inclusive of all taxes, delivery charges, payment and delivery terms, timeframes, the existence and conditions of the right of withdrawal, the statutory guarantees, and the dispute resolution arrangements.

The decisive point is not their drafting but their enforceability: it must be possible to establish that the customer was made aware of them and accepted them before committing. A checkbox that is not pre-ticked, whose action is timestamped and retained, meets this requirement; a link in the footer does not. This acceptance mechanism is covered in our dedicated article on acceptance of terms and conditions.

Two statutory guarantees must be mentioned and cannot be excluded: the guarantee of conformity and the guarantee against hidden defects. A commercial warranty may be added on top, but can never replace them.

The order process

Regulations impose a precise sequence, known as the double-click process. The customer must be able to check the details of their order and its total price, correct any errors, then confirm to express their final acceptance.

The confirmation button must carry an explicit statement indicating that placing the order involves an obligation to pay. An ambiguous wording of this button constitutes a clear breach.

The trader must then acknowledge receipt of the order without undue delay, and provide confirmation of the contract on a durable medium, including all pre-contractual information and the standard withdrawal form.

Withdrawal, delivery and payment

The right of withdrawal of fourteen days applies, subject to its exhaustively listed exceptions. The main point requiring attention remains the penalty for failing to provide information, which extends the period by a further twelve months — a subject covered in our article on the right of withdrawal.

Delivery must take place on the date indicated or, failing that, within a maximum period set by law. The trader is automatically liable for proper performance, including when using a carrier: the customer does not need to take action against the latter. The corresponding obligations are detailed in our article on logistics and returns.

Payment requires strong authentication of the payer for most transactions, and prohibits the storage of card data without specific consent. Compliance with industry standards falls under the secure payment standards.

Personal data and trackers

Two separate regimes apply in parallel, and confusing them is the most common mistake.

Data protection requires a record of processing activities, clear information for data subjects, a legal basis for each processing operation, defined retention periods, and contractual arrangements governing subprocessors — host, payment provider, emailing tool.

Trackers fall under a separate piece of legislation, which requires prior consent even when the information collected is not personal in nature. Refusal must be as simple as acceptance, and the choice must be logged so that it can be demonstrated. This specific regime is covered in our article on cookies and trackers.

Usage scenarios

Opening a first online shop. Address in order: structure and registration, legal notices, terms and conditions and the acceptance mechanism, a compliant order tunnel, and the consent banner. The last three points are those that can be checked from the outside.

Selling internationally. The consumer protection rules of the buyer's country of residence generally apply, as does the VAT of the destination country beyond certain thresholds. The drafting of the terms and conditions must anticipate this.

Adding a marketing tool. Check the impact on trackers deployed and on data transfers before going live. This is the most common source of discrepancy between declared compliance and the actual state of the site.

Frequently asked questions

Is authorisation required to open an online shop? No, except for regulated activities. Registration with the single window is sufficient, but it immediately triggers information and compliance obligations.

Are terms and conditions mandatory? Yes for sales to consumers, with regulated content. Their mere existence is not enough: their enforceability requires demonstrable acceptance before commitment.

What wording is required on the order button? An explicit statement indicating that placing the order involves an obligation to pay. Ambiguous wording constitutes a breach.

Can a withdrawal be refused? Only in the exhaustively provided exceptions, and provided the customer was informed beforehand. In the absence of such information, the period is extended by twelve months.

Who is liable for a lost parcel? The seller, automatically, including when transport is entrusted to a third party. The customer does not need to take action against the carrier.

Is a cookie banner enough? No, if it deploys trackers before any choice is made, or if refusing requires more effort than accepting. Both points can be checked from the outside within minutes.

Key takeaways

Four obligations can be observed without any internal access to the site: the legal notices, the mechanism for accepting the terms and conditions, the wording of the order button, and the behaviour of the consent banner. These are what trigger proceedings, and they can be resolved upfront at low cost.

The rest — right of withdrawal, statutory guarantees, liability for delivery — involves substantive obligations where the key issue is traceability: being able to establish, months later, what information was provided, when, and what the customer accepted. A shop that retains this timestamped evidence handles disputes on a case-by-case basis. One that lacks it faces them in bulk.