E-commerce Shop Launch: Complete Legal Guide 2026

Opening an online store requires no prior authorisation. However, it immediately triggers a series of obligations whose non-compliance can be detected from the outside, without any on-site inspection: incomplete legal notices, unenforceable terms and conditions, non-compliant consent banners, missing information on the right of withdrawal. It is these visible failures that account for most formal notices, well before any substantive issues arise.

Before opening: structure and registration

The choice of legal structure determines the liability, the manager's social security regime and taxation. The micro-enterprise regime suits a low-volume start-up, with simplified accounting but no possibility of deducting expenses or reclaiming VAT. A company protects personal assets and allows for the deduction of expenses, at the cost of full accounting obligations — a trade-off developed in our article on business taxation.

Registration is carried out with the single business formalities window. An activity involving the sale of goods falls under the trade and companies register.

Two points often overlooked at this stage: checking the availability of the trade name and domain name, including against already registered trademarks, and taking out insurance suited to the activity.

Mandatory information on the website

This can be checked in a minute, making it the first point of control.

The following must appear in an accessible manner on all pages: the corporate name, legal form and share capital, the registered office address, the registration number, the intra-Community VAT number, contact details enabling direct contact, the name of the publication director and the identity of the hosting provider.

Depending on the activity, the following must also be added: membership of a professional body, the authorisation number where required, and, where applicable, membership of a consumer mediation scheme — this last item being mandatory for any professional selling to consumers.

The general terms and conditions of sale

These are mandatory for sales to consumers, and their content is regulated. They must in particular specify the essential characteristics of the goods, prices inclusive of all taxes, delivery costs, payment and delivery terms, timeframes, the existence and conditions of the right of withdrawal, the legal warranties, and dispute resolution arrangements.

The decisive factor is not their drafting but their enforceability: it must be possible to establish that the customer became aware of them and accepted them before committing. A checkbox that is not pre-ticked, whose action is timestamped and retained, satisfies this condition; a link in the footer does not. This acceptance mechanism is the subject of our dedicated article on acceptance of general terms and conditions.

Two legal warranties must be mentioned and cannot be excluded: the warranty of conformity and the warranty against hidden defects. A commercial warranty may be added on top of these, but can never replace them.

The order process

The regulations impose a precise sequence, known as the double-click process. The customer must be able to check the details of their order and its total price, correct any errors, and then confirm to express their final acceptance.

The validation button must carry an explicit statement indicating that placing the order entails an obligation to pay. An ambiguous wording of this button is a clear breach.

The professional must then acknowledge receipt of the order without undue delay, and provide confirmation of the contract on a durable medium, including all pre-contractual information and the standard withdrawal form.

Withdrawal, delivery and payment

The right of withdrawal of fourteen days applies, subject to its exhaustively listed exceptions. The main point requiring vigilance remains the penalty for failure to provide information, which extends the period by a further twelve months — a topic covered in our article on the right of withdrawal.

The delivery must take place on the date indicated or, failing that, within a maximum period set by law. The professional is automatically liable for proper performance, even when using a carrier: the customer does not need to take action against the carrier. The corresponding obligations are detailed in our article on logistics and returns.

The payment process requires strong authentication of the payer for most transactions, and prohibits the storage of card data without specific consent. Compliance with industry standards falls under the secure payment standards.

Personal data and trackers

Two distinct regimes apply in parallel, and confusing them is the most common mistake.

Data protection requires a record of processing activities, clear information for individuals, a legal basis for each processing operation, defined retention periods, and contractual oversight of subcontractors — hosting provider, payment service provider, emailing tool.

The trackers fall under a separate text, which requires prior consent even when the information collected is not personal. Refusal must be as simple as acceptance, and the choice must be logged so that it can be demonstrated. This specific regime is the subject of our article on cookies and trackers.

Use-case scenarios

Opening a first online store. Address in order: structure and registration, legal notices, terms and conditions and acceptance mechanism, compliant order tunnel, consent banner. The last three points are those that can be checked from the outside.

International sales. The consumer protection rules of the buyer's country of residence generally apply, as does the VAT of the destination country beyond certain thresholds. The drafting of the terms and conditions must anticipate this point.

Adding a marketing tool. Check the impact on the trackers deployed and on data transfers, before going live. This is the most common source of discrepancy between declared compliance and the actual state of the site.

Frequently asked questions

Is authorisation required to open an online store? No, unless it is a regulated activity. Registration with the single window is sufficient, but it immediately triggers information and compliance obligations.

Are the general terms and conditions mandatory? Yes, for sales to consumers, with regulated content. Their mere existence is not enough: their enforceability requires demonstrable acceptance before commitment.

What wording is required on the order button? An explicit statement indicating that placing the order entails an obligation to pay. Ambiguous wording constitutes a breach.

Can withdrawal be refused? Only in the exhaustively provided exception cases, and provided the customer has been informed beforehand. In the absence of information, the period is extended by twelve months.

Who is liable for a lost parcel? The seller, automatically, even when transport is entrusted to a third party. The customer does not need to take action against the carrier.

Is a cookie banner enough? No, if it deploys trackers before any choice is made, or if refusing requires more effort than accepting. Both points are verifiable from the outside within a few minutes.

Key takeaways

Four obligations can be verified without any internal access to the site: legal notices, the mechanism for accepting the terms and conditions, the wording of the order button, and the behaviour of the consent banner. These are what trigger proceedings, and they can be resolved upstream at low cost.

The rest — right of withdrawal, legal warranties, liability for delivery — involves substantive obligations where the key issue is traceability: being able to establish, months later, what information was provided, when, and what the customer accepted. A store that retains this timestamped evidence handles disputes on a case-by-case basis. One that does not will face them repeatedly.