E-commerce Store Launch: Complete Legal Guide 2026

Launching an e-commerce store in France represents a major economic opportunity, with a market exceeding 160 billion euros in 2023 according to FEVAD. However, this entrepreneurial venture comes with a strict legal framework that tolerates no approximation. Between the Law for Trust in the Digital Economy (LCEN) of June 21, 2004, the General Data Protection Regulation (GDPR) and successive European directives, the online seller must master a complex regulatory ecosystem. This exhaustive guide accompanies you through the key steps to structure your e-commerce project with complete legal security, from drafting legal notices to implementing compliant PCI-DSS payment processes, through managing returns and delivery.

Mandatory legal notices on your site

Article 6-III of the LCEN requires any e-commerce website editor to publish legal notices accessible from every page of the site. For a legal entity, these notices must include the business name, registered office, RCS number, share capital, intra-community VAT number, and the name of the publication director. For a sole proprietor, complete identity and business address are required.

Non-compliance with these obligations exposes you to a penalty of up to 75,000 euros in fines and one year imprisonment (article 6-VI-2 of the LCEN). Beyond standard legal notices, your store must display the website host with complete contact information, information regarding consumer dispute resolution (article L.616-1 of the Consumer Code) and, for regulated activities, the corresponding professional authorization number.

Drafting e-commerce Terms and Conditions

General Terms and Conditions constitute the contract binding the seller to the consumer. Article L.221-5 of the Consumer Code imposes a precise list of pre-contractual information: essential product characteristics, price including VAT, payment, delivery and execution methods, delivery date, right of withdrawal, legal warranties of conformity and hidden defects.

European Directive 2019/770 on contracts for the supply of digital content strengthens these obligations for digital goods and online services. Your Terms and Conditions must be explicitly accepted by the consumer before order validation via a separate checkbox (not pre-checked according to CJEU ruling C-673/17). The double-click confirmation provided for in article 1127-2 of the Civil Code is also mandatory for any contract concluded electronically.

Secure Payment and PCI-DSS Compliance

Securing online payments complies with the PCI-DSS (Payment Card Industry Data Security Standard) which imposes 12 technical and organizational requirements to protect payment card data. Since September 2019, DSP2 Directive (Payment Services Directive 2) requires strong customer authentication (SCA - Strong Customer Authentication) for any transaction exceeding 30 euros, via the 3D Secure v2 protocol.

Choosing a certified payment service provider (PSP) such as Stripe, Mangopay, Adyen or Lyra partially relieves the merchant of the most complex technical obligations. However, legal responsibility in case of fraud remains governed by article L.133-19 of the Monetary and Financial Code, which strongly protects the consumer in case of unauthorized transaction.

Delivery and Right of Withdrawal

Article L.216-1 of the Consumer Code imposes delivery within a maximum of 30 days unless a different contractual agreement is reached. The consumer has a withdrawal period of 14 calendar days from receipt of the goods (article L.221-18), without having to justify the decision. Return costs may be charged to the customer if clearly mentioned in the Terms and Conditions.

Certain product categories are exempt from the right of withdrawal: customized goods, perishable foodstuffs, dematerialized digital content after execution (article L.221-28). Reimbursement must occur within 14 days following withdrawal, subject to statutory penalty.