E-commerce Shop Launch: Complete Legal Guide 2026

Launching an e-commerce shop represents a major economic opportunity, with a market exceeding 160 billion euros in 2023 according to FEVAD. However, this entrepreneurial venture comes with a strict legal framework that tolerates no approximation. Between the Law on Confidence in the Digital Economy (LCEN) of 21 June 2004, the General Data Protection Regulation (GDPR) and successive European directives, the online seller must master a complex regulatory ecosystem. This comprehensive guide accompanies you through the key steps to structure your e-commerce project with complete legal security, from drafting legal notices to implementing PCI-DSS compliant payment processes, including return management and delivery.

Mandatory legal notices on your website

Article 6-III of the LCEN requires any e-commerce website editor to publish legal notices accessible from each page of the site. For a legal entity, these notices must include the corporate name, registered office, RCS number, share capital, intra-community VAT number, as well as the name of the publisher director. For a sole proprietor, complete identity and professional address are required.

Non-compliance with these obligations exposes you to a penalty of up to 75,000 euros in fines and one year imprisonment (article 6-VI-2 of the LCEN). Beyond standard legal notices, your shop must display the website host with complete contact details, information relating to consumer mediation (article L.616-1 of the Consumer Code) and, for regulated activities, the corresponding professional authorisation number.

Drafting e-commerce terms and conditions

General Terms and Conditions constitute the contract binding the seller to the consumer. Article L.221-5 of the Consumer Code imposes a precise list of pre-contractual information: essential characteristics of the product, price including VAT, payment terms, delivery and performance methods, delivery date, right of withdrawal, legal guarantees of conformity and hidden defects.

European Directive 2019/770 on contracts for the supply of digital content strengthens these obligations for digital goods and online services. Your terms and conditions must be explicitly accepted by the consumer before order validation via a distinct checkbox (not pre-ticked according to CJEU ruling C-673/17). The double-click confirmation provided for in article 1127-2 of the Civil Code is also mandatory for any contract concluded electronically.

Secure payment and PCI-DSS compliance

The security of online payments complies with the PCI-DSS standard (Payment Card Industry Data Security Standard) which imposes 12 technical and organisational requirements to protect bank card data. Since September 2019, the DSP2 Directive (Directive on Payment Services 2) requires strong customer authentication (SCA - Strong Customer Authentication) for any transaction exceeding 30 euros, via the 3D Secure v2 protocol.

The choice of a certified payment service provider (PSP) such as Stripe, Mangopay, Adyen or Lyra partially relieves the merchant of the most complex technical obligations. However, legal responsibility in the event of fraud remains governed by article L.133-19 of the Monetary and Financial Code, which strongly protects the consumer in case of unauthorised transaction.

Delivery and right of withdrawal

Article L.216-1 of the Consumer Code imposes delivery within a maximum of 30 days unless a different contractual agreement is made. The consumer has a withdrawal period of 14 calendar days from receipt of the goods (article L.221-18), without having to justify their decision. Return costs may be charged to the customer if clearly mentioned in the terms and conditions.

Certain categories of products are exempt from the right of withdrawal: personalised goods, perishable foodstuffs, dematerialised digital content after performance (article L.221-28). Reimbursement must take place within 14 days following withdrawal, subject to legal surcharge penalties.