Launching an e-commerce store: Complete legal guide

Launching an e-commerce store in France represents a major economic opportunity, with a market exceeding 160 billion euros in 2023 according to FEVAD. However, this entrepreneurial adventure is accompanied by a strict legal framework which does not tolerate any approximation. Between the Law for Trust in the Digital Economy (LCEN) of June 21, 2004, the General Data Protection Regulation (GDPR) and successive European directives, the online seller must master a complex regulatory ecosystem. This comprehensive guide supports you through the key steps to structuring your e-commerce project with complete legal security, from drafting legal notices to setting up PCI-DSS compliant payment processes, including returns management and delivery.

Mandatory legal notices on your site

Article 6-III of the LCEN requires any publisher of an e-commerce site to publish legal notices accessible from each page of the site. For a legal entity, these details must include the company name, head office, RCS number, share capital, intra-community VAT number, as well as the name of the publication director. For a sole trader, full identity and business address are required.

Failure to comply with these obligations may result in a fine of up to 75,000 euros and one year's imprisonment (article 6-VI-2 of the LCEN). Beyond the classic legal notices, your store must display the site host with their full contact details, information relating to consumer mediation (article L.616-1 of the Consumer Code) and, for regulated activities, the corresponding professional authorization number.

Drafting the e-commerce T&Cs

The General Conditions of Sale constitute the contract which binds the seller to the consumer. Article L.221-5 of the Consumer Code requires a precise list of pre-contractual information: essential characteristics of the product, price including tax, terms of payment, delivery and execution, delivery date, right of withdrawal, legal guarantees of conformity and hidden defects.

European Directive 2019/770 relating to contracts for the supply of digital content reinforces these obligations for digital goods and online services. Your General Terms and Conditions must be explicitly accepted by the consumer before validation of the order via a separate checkbox (not pre-checked according to CJEU judgment C-673/17). The double-click confirmation provided for in article 1127-2 of the Civil Code is also mandatory for any contract concluded electronically.

Secure payment and PCI-DSS compliance

Securing online payments meets the PCI-DSS standard (Payment Card Industry Data Security Standard) which imposes 12 technical and organizational requirements to protect bank card data. Since September 2019, the PSD2 directive (Payment Services Directive 2) requires strong customer authentication (SCA - Strong Customer Authentication) for any transaction over 30 euros, via the 3D Secure v2 protocol.

Choosing a certified payment service provider (PSP) such as Stripe, Mangopay, Adyen or Lyra partially relieves the merchant of the most complex technical obligations. However, legal liability in the event of fraud remains governed by article L.133-19 of the Monetary and Financial Code, which strongly protects the consumer in the event of an unauthorized transaction.

Delivery and right of withdrawal

Article L.216-1 of the Consumer Code requires delivery within 30 days maximum unless otherwise agreed by contract. The consumer has a withdrawal period of 14 calendar days from receipt of the good (article L.221-18), without having to justify his decision. Return costs may be borne by the customer if this is clearly mentioned in the General Terms and Conditions.

Certain categories of products are exempt from the right of withdrawal: personalized goods, perishable foods, digital content dematerialized after execution (article L.221-28). Reimbursement must be made within 14 days of withdrawal, under penalty of legal surcharge.