Electronic signature for B2C contracts: validity in 2026

The commercial relationship between a business and an individual is based on a fundamental pillar: consent. At a time when the digitalisation of customer journeys is accelerating, electronic signature for B2C contracts has become an essential lever for streamlining sales, reducing timescales and strengthening the legal certainty of commitments. However, signing electronically with a consumer is not something that can be improvised: strict rules govern legal validity, the level of signature required and the traceability of consent. This article reviews the regulatory obligations in force in 2026, the best practices to adopt and the pitfalls to avoid so that your B2C approach remains unassailable in court.

What changes in the B2C context for electronic signature

Individual vs professional: distinct legal frameworks

In a B2B relationship, both parties generally have sufficient expertise to appreciate the scope of an electronic signature. The B2C context is radically different: the consumer benefits from a protected status under French and European law. The Consumer Code imposes enhanced information obligations, a right of withdrawal (14 days for contracts concluded at a distance, article L221-18), and increased vigilance over the clarity of consent.

The legal validity of an electronic signature in a contract with an individual therefore depends on two intertwined dimensions: compliance with the technical requirements of the eIDAS regulation and its developments in 2026, and compliance with consumer law at national level. A deficiency in either dimension exposes the company to a challenge to the contract.

The principle of non-discrimination of electronic signatures

Article 25 of the eIDAS Regulation No 910/2014 establishes a founding principle: an electronic signature cannot be refused as evidence in court solely on the grounds that it is in electronic form. This principle applies in full to B2C contracts. In practice, this means that a simple electronic signature (SES) – such as a checkbox or SMS code – may be sufficient for the vast majority of routine transactions (subscriptions, terms and conditions, order forms), provided that the process is traceable and that consent is unequivocal.

Conversely, certain B2C transactions require a qualified signature (QES) or at least an advanced signature (AES): consumer credit contracts, acts relating to residential property, or certain powers of attorney. To navigate this hierarchy, please consult our comprehensive electronic signature guide which details the three levels of signature and their scope of application.

Legal validity and customer consent: the conditions to be met

Identification of the individual signatory

The main difficulty in B2C lies in identifying the consumer. Unlike in the B2B context where identity can be verified via a business register or institutional professional email, the individual is committing from their home, often via a simple web browser. The level of signature chosen must reflect this reality:

• Simple electronic signature (SES): appropriate for acts of low stakes (acceptance of terms and conditions, standard e-commerce orders). Consent is proven by email address, timestamp and IP address.
• Advanced electronic signature (AES): recommended for long-term subscription contracts, insurance contracts or services exceeding several thousand euros. It requires a unique link between the signatory and the signature, as well as a check of the integrity of the document.
• Qualified electronic signature (QES): mandatory for electronic notarial acts, mortgage contracts and certain formal legal acts. It requires face-to-face identity verification or verification by a trusted service provider qualified under eIDAS.

The choice of signature level must be systematically documented in your internal signature policy. If you wish to compare the solutions available on the market, our comparison of electronic signature solutions will help you select the service provider best suited to your B2C flows.

Collection of customer consent: formalities and evidence

The individual's consent must be free, informed, specific and unequivocal. These four criteria, stemming from the GDPR (article 4(11) of Regulation 2016/679) but taken up in the assessment of contractual consent, impose several best practices:

1. Clear presentation of the document: the consumer must have access to the full content of the document before signing. A solution that hides essential clauses behind non-scrollable PDFs exposes the company to a challenge for consent defects.
2. Traceability of the signature act: the exact time, IP address, device used and any authentication codes (SMS OTP) must be logged in an infalsifiable audit trail.
3. Preservation of evidence: the audit trail must be retained for a sufficient period (minimum 5 years for most commercial contracts, 10 years for acts that may engage decennial liability).
4. Information about the electronic nature of the signature: the consumer must know that he or she is signing electronically and that this act has the same value as a handwritten signature.

GDPR and biometric data: double vigilance

When the signature process includes identity verification by facial recognition or capture of identity documents (ID card, passport), the data processed may fall into the category of biometric data within the meaning of article 9 of the GDPR. In this case, a data protection impact assessment (DPIA) may be mandatory, and the signature service provider must act as a data processor within the meaning of article 28 of the GDPR, with a formally signed DPA (Data Processing Agreement).

This dimension is often overlooked in B2C digitalisation projects. However, the CNIL has issued several formal notices between 2023 and 2025 against companies that have collected identity data without a valid legal basis in the context of their customer signature journey.

The B2C sectors most affected in 2026

Residential property and property management

The property sector is probably the one where B2C electronic signature has experienced the strongest growth since 2020. Tenancy agreements, inventory reports, management mandates, promises to sell: all these acts can now be signed electronically. The ALUR law and the ELAN law have gradually opened the way to the dematerialisation of property management acts. For authentic acts (definitive sale deed), QES is mandatory when the act is drawn up by a notary.

Our dedicated section on electronic signature in property details the sector-specific particularities and the levels of signature required act by act.

Insurance, banking and consumer credit

The Consumer Credit Directive (Directive 2008/48/EC, revised in 2023) and French transposition texts require that the credit contract be provided to the consumer on a durable medium. Advanced electronic signature is generally required for these contracts, with strong identification of the signatory. Financial institutions must also comply with AML-CFT requirements (anti-money laundering and counter-terrorist financing) which require certified remote identity verification.

Healthcare, telemedicine and consent to care

In the healthcare sector, the patient's electronic signature (informed consent, care contract, teleconsultation) is subject to even stricter rules. Consent to care is a strictly personal act, non-delegable, which must be traced irrefutably. HDS certification (Health Data Host) of the platform used is essential. Certyneo offers a dedicated offering for healthcare professionals that incorporates these specific constraints.

Setting up a compliant B2C signature flow: key steps

Mapping your acts and choosing the right level of signature

The first step in a B2C signature project is to draw up an inventory of the acts concerned and to classify their level of legal risk. A simple dashboard, crossing the financial value of the act, its irreversibility and the potential vulnerability of the consumer, allows you to determine the appropriate eIDAS level for each flow. This mapping must be validated by your legal department and updated whenever there is a regulatory change.

Integrating signature into the customer journey without friction

One of the paradoxes of B2C is that the more you secure the signature, the more you risk prolonging the journey and losing the customer along the way. Best practices for 2026 recommend:

• Mobile-first: an increasing proportion of B2C signatures are initiated from a smartphone. The signature flow must be natively optimised for mobile.

To calculate the return on investment of your signature project, use our dedicated ROI calculator which incorporates parameters specific to B2C flows.

Archiving and probative value over time

An electronic signature has value only if it is archived in conditions that guarantee its integrity over time. The ETSI EN 319 132 standard (XAdES) and long-term archival profiles (LTA — Long Term Archival) make it possible to preserve the probative value of a signed document well beyond the validity period of the certificate used at the time of signing. For B2C contracts, this requirement is crucial: a dispute can arise years after the contract is concluded.

Legal framework applicable to electronic signature in B2C contracts

Electronic signature in contracts concluded with individuals is part of a multi-layered legal framework that links European law and French national law.

eIDAS Regulation No 910/2014 and eIDAS 2.0 (EU Regulation 2024/1183)

The eIDAS Regulation, directly applicable in all Member States, defines three levels of electronic signature (simple, advanced, qualified) and establishes the principle of non-discrimination in its article 25: an electronic signature cannot be rejected as evidence solely on the grounds that it is electronic. eIDAS Regulation 2.0, which came into force in May 2024, strengthens the trust framework with the introduction of the European digital identity wallet (EUDIW), which should progressively simplify the identification of individuals in B2C flows by 2026-2027.

French Civil Code — Articles 1366 and 1367

Article 1366 of the French Civil Code provides that "an electronic document has the same probative force as a document on paper, provided that the person from whom it emanates can be duly identified and it is established and preserved in such a way as to guarantee its integrity". Article 1367 specifies that the signature necessary to perfect a legal act identifies its author and manifests consent. These two articles form the basis of the validity of dematerialised B2C contracts.

Consumer Code — Consumer protection

Articles L221-1 to L221-29 of the Consumer Code govern contracts concluded at a distance. The company must provide the consumer with a copy of the signed contract on a durable medium and comply with the 14-day withdrawal period. Case law has clarified that automatic sending of the signed document by email constitutes delivery on a durable medium within the meaning of these provisions.

GDPR — EU Regulation 2016/679

The processing of personal data in the context of signature (email, telephone, IP address, identity document) is subject to the GDPR. The legal basis is generally the performance of the contract (article 6(1)(b)) for data strictly necessary for the signature, and legitimate interest for the preservation of the audit trail. Any biometric data that may be collected falls under article 9 and requires explicit consent or a specific legal obligation.

ETSI Standards

ETSI standards EN 319 132 (XAdES), EN 319 122 (CAdES) and EN 319 162 (JAdES) define the formats for advanced and qualified electronic signatures. The LTA (Long Term Archival) profile of these standards is essential to guarantee the probative value of contracts over long periods. Qualified trust service providers listed on national trust lists (eIDAS Trust Lists) are subject to regular compliance audits according to ETSI EN 319 401 and EN 319 411 standards.

Legal risks in case of non-compliance

Non-compliant B2C signature exposes the company to several risks: relative nullity of the contract (enforceable by the consumer), inability to oppose the document in court as proof of commitment, CNIL sanctions in the event of a breach of GDPR (up to 4 % of global turnover), and the company's civil liability may be engaged if the consumer suffers loss.

Illustrative usage scenarios: B2C electronic signature

Scenario 1 — A mobile telecommunications operator managing several million customer contracts per year

These scenarios are illustrative: they describe typical situations and do not report any measured outcome for a client. A telecoms operator offering mobile and internet subscriptions to individual customers has to process a constant stream of subscription contracts, tariff amendments and direct debit mandates. Without digitisation, the process involves posting a duplicate copy by mail, with a signed-contract return rate that remains limited and contracting times of several days.

With a simple electronic signature (SES) using OTP authentication by SMS, combined with a timestamped audit log, the operator can shorten the signing time and increase the proportion of contracts taken through to completion. From a legal standpoint, each signature is linked to the customer ID, the device's IMEI and the UNIX timestamp, which constitutes a body of evidence sufficient for SES. Postal and document-handling costs weigh all the more heavily on a base of several million subscribers: the scale of the gain should be measured on your own scope, before and after a pilot.

Scenario 2 — A network of property agencies managing residential tenancy agreements

A network of property agencies managing several thousand rental properties per year faces a strong operational constraint: inventory reports and agreements must be signed quickly, often on the same day as the visit, by tenants who may not return to the agency. Residential lease agreements under the law of 6 July 1989 do not require QES but require rigorous traceability.

By deploying an advanced electronic signature (AES) solution on tablet and smartphone, consultants send the lease to the tenant via a secure link, which they sign from their phone with identity verification through ID document capture and a selfie. The identity data collected is covered by a DPA with the signature provider and is deleted at the end of the retention period defined with the group's DPO, in accordance with the GDPR retention policy. The time between the viewing and the signing of the lease can thus be noticeably shortened, and incomplete contracts (missed initials, missing signatures) become rarer. The scale of the gain should be measured on your own scope, before and after a pilot.

Scenario 3 — A teleconsultation platform for informed consent

A medical teleconsultation platform offering consultations to individual patients must obtain the patient's informed consent before each telemedicine act, in accordance with article L1111-4 of the French Public Health Code. This consent must be traced, preserved in HDS-certified storage and enforceable in the event of dispute.

The platform can integrate an advanced electronic signature module directly into its patient interface, with identification via France Connect ("substantial" level of assurance). Each consent form is signed within seconds, archived in a certified HDS digital vault, and linked to the patient's medical record. In the event of an inspection by the Ordre des médecins or a dispute, the audit trail can be exported in an ETSI-compliant format. This approach limits disputes over contested consents and meets the expectations of partner health insurers who require this level of traceability as a prerequisite for cover. The scale of the gain should be measured on your own scope, before and after a pilot.

Conclusion

Electronic signature in B2C contracts is no longer an option: it is an operational and legal requirement that any company dealing with individuals must master in 2026. Legal validity rests on three inseparable pillars: choosing the right level of signature according to the nature of the act, collecting customer consent that is traceable and unequivocal, and preserving evidence in accordance with ETSI standards and GDPR.

Ignoring these rules means exposing yourself to non-enforceable contracts, regulatory sanctions and loss of customer trust. Conversely, a well-structured B2C signature reduces contractualisation timescales, increases completion rates and strengthens your brand image.

Ready to secure your B2C flows? Create your Certyneo account free of charge and find out how our eIDAS-compliant solution adapts to all your customer journeys, from SES to QES.