E-commerce Store Launch: Complete Legal Guide 2026

Opening an online store requires no prior authorization. However, it immediately triggers a series of obligations whose non-compliance can be detected from the outside, without any on-site inspection: incomplete legal notices, unenforceable terms and conditions, a non-compliant consent banner, missing information on the right of withdrawal. These visible shortcomings are what drive most formal notices, well before any substantive issues arise.

Before Opening: Structure and Registration

The choice of legal structure determines liability, the manager's social security regime, and taxation. The micro-entreprise regime is suitable for a low-volume start, with simplified accounting but no ability to deduct expenses or reclaim VAT. A company structure protects personal assets and allows for expense deductions, at the cost of full accounting obligations — a trade-off covered in our article on business taxation.

Registration is carried out through the single business formalities window (guichet unique). An activity involving the sale of goods falls under the trade and companies register.

Two points often overlooked at this stage: checking the availability of the trade name and domain name, including against already registered trademarks, and taking out insurance suited to the activity.

Mandatory Information on the Site

These can be checked in a minute, making them the first point of control.

The following must be accessible on all pages: the company name, legal form and share capital, registered office address, registration number, intra-community VAT number, contact details allowing direct communication, the name of the publication director, and the identity of the hosting provider.

Depending on the activity, the following must also be added: membership in a professional body, the authorization number where required, and, where applicable, participation in a consumer mediation scheme — this last item being mandatory for any professional selling to consumers.

General Terms and Conditions of Sale

These are mandatory for sales to consumers, and their content is regulated. They must in particular specify the essential characteristics of the goods, prices inclusive of all taxes, delivery costs, payment and delivery terms, timeframes, the existence and conditions of the right of withdrawal, legal warranties, and dispute resolution procedures.

The decisive point is not their drafting but their enforceability: it must be possible to establish that the customer was made aware of them and accepted them before committing. An unchecked checkbox, whose action is time-stamped and retained, satisfies this condition; a footer link does not. This acceptance mechanism is covered in our dedicated article on the acceptance of general terms and conditions.

Two legal warranties must be mentioned and cannot be excluded: the conformity warranty and the warranty against hidden defects. A commercial warranty may be added on top of these, but can never replace them.

The Ordering Process

Regulations require a precise sequence, known as the double-click process. The customer must be able to review the details of their order and its total price, correct any errors, and then confirm to express their final acceptance.

The confirmation button must bear an explicit statement indicating that the order entails an obligation to pay. Ambiguous wording on this button constitutes a clear violation.

The merchant must then acknowledge receipt of the order without undue delay, and provide confirmation of the contract on a durable medium, including all pre-contractual information and the standard withdrawal form.

Withdrawal, Delivery, and Payment

The right of withdrawal of fourteen days applies, subject to a limited list of exceptions. The main point requiring vigilance remains the penalty for failing to provide information, which extends the period by an additional twelve months — a topic covered in our article on the right of withdrawal.

The delivery must take place on the date indicated or, failing that, within a maximum period set by law. The merchant is automatically liable for proper performance, even when using a carrier: the customer does not need to pursue the carrier directly. The corresponding obligations are detailed in our article on logistics and returns.

The payment process requires strong authentication of the payer for most transactions, and prohibits storing card data without specific consent. Compliance with industry standards falls under secure payment standards.

Personal Data and Trackers

Two distinct regulatory regimes apply in parallel, and confusing them is the most common mistake.

Data protection requires a record of processing activities, clear information for individuals, a legal basis for each processing operation, defined retention periods, and contractual oversight of subprocessors — hosting provider, payment provider, email marketing tool.

​​ Trackers fall under a separate regulation, which requires prior consent even when the information collected is not personal. Refusal must be as simple as acceptance, and the choice must be logged to be demonstrable. This specific regime is covered in our article on cookies and trackers.

Usage Scenarios

Launching a First Store. Address these in order: structure and registration, legal notices, terms and conditions along with the acceptance mechanism, a compliant checkout flow, and the consent banner. The last three points are those that can be checked from the outside.

Selling Internationally. The consumer protection rules of the buyer's country of residence generally apply, as does the destination country's VAT beyond certain thresholds. The terms and conditions must be drafted with this in mind.

Adding a Marketing Tool. Check the impact on trackers deployed and on data transfers before going live. This is the most common source of discrepancy between declared compliance and the actual state of the site.

Frequently Asked Questions

Do you need authorization to open an online store? No, unless the activity is regulated. Registration through the single business formalities window is sufficient, but it immediately triggers information and compliance obligations.

Are general terms and conditions mandatory? Yes, for sales to consumers, with regulated content. Their mere existence is not enough: their enforceability requires demonstrable acceptance before commitment.

What wording is required on the order button? An explicit statement indicating that the order entails an obligation to pay. Ambiguous wording constitutes a violation.

Can withdrawal be refused? Only in the limited exceptions provided for, and provided the customer was informed beforehand. Absent such information, the period is extended by twelve months.

Who is liable for a lost package? The seller, automatically, even when shipping is entrusted to a third party. The customer does not need to take action against the carrier.

Is a cookie banner enough? No, if it deploys trackers before any choice is made, or if refusing requires more effort than accepting. Both of these points can be verified from the outside within minutes.

Key Takeaways

Four obligations can be verified without any internal access to the site: legal notices, the terms and conditions acceptance mechanism, the wording of the order button, and the behavior of the consent banner. These are what trigger enforcement actions, and they can be addressed upfront at low cost.

The rest — right of withdrawal, legal warranties, liability for delivery — involves substantive obligations where the real stake is traceability: being able to establish, months later, what information was provided, when, and what the customer accepted. A store that retains this time-stamped evidence handles disputes on a case-by-case basis. One that does not ends up facing them in bulk.