E-commerce 2026: essential legal obligations

The rise of electronic commerce is radically transforming commercial practices, but this development comes with an ever more complex body of regulation. Faced with the challenges of consumer protection and fair competition, businesses entering e-commerce must navigate a legal labyrinth, ignorance of which can prove costly. The legal obligations of electronic commerce, far from being limited to mere legal notices, now cover fields as varied as personal data protection, digital accessibility and even environmental responsibility.

Definition and legal framework of electronic commerce

What is e-commerce: a legal approach

Electronic commerce, commonly known as e-commerce, legally means any economic activity by which a person offers or provides, at a distance and by electronic means, the supply of goods or services. This definition, which comes from the European e-commerce directive, covers not only traditional online sales but also digital services, intermediation platforms and marketplaces. The terms of this definition in French law and the obligations that flow from it are analysed in our article on the legal definition of e-commerce.

The legal particularity of e-commerce lies in its cross-border and dematerialised dimension, which complicates the application of the traditional rules of commercial law. Unlike physical commerce, e-commerce necessarily involves technical intermediation, which creates new legal relationships between the seller, the buyer and the technical service providers.

Applicable sources of law

The regulation of electronic commerce draws on several complementary bodies of law. At European level, the Digital Services Act and the Digital Markets Act are now the reference texts, supplemented by the GDPR for the protection of personal data. In French law, the Consumer Code, the Commercial Code and the Law for confidence in the digital economy form the main legal architecture.

This multiplicity of sources calls for a systematic approach in order to identify all the obligations that apply according to the type of activity carried on, the size of the business and its sales territory.

Pre-contractual obligations and consumer information

Mandatory legal notices

Every e-commerce activity must comply with pre-contractual information obligations that are stricter than for traditional commerce. These e-commerce obligations include the full identification of the trader, with its company name, geographical address, telephone number and email address. These particulars are covered, together with the legal status and the general terms of sale, in our article on the essential legal aspects of e-commerce.

Article L. 111-1 of the French Consumer Code also requires the disclosure of the registration number in the trade and companies register, the share capital for companies, and the intra-Community VAT number. This information must be easily accessible and permanently available on the website.

Traders subject to an authorisation or prior declaration regime must also state the supervisory authority and the corresponding authorisation number. This requirement applies in particular to banking, insurance or financial investment advice activities.

Information on the characteristics of goods and services

The dematerialisation of exchanges strengthens the obligations to provide information on the essential characteristics of the goods and services offered. This information must be clear, comprehensible and adapted to the electronic means of communication used.

For goods, the obligation covers the main technical characteristics, the conditions of use, the functionalities available and the compatibility requirements. For services, the information must cover the precise nature of the service, the methods of performance and any geographical or technical limitations.

Price information is particularly important in e-commerce. The price must be stated clearly and unambiguously, inclusive of all taxes, including delivery costs where they can be determined. The statement "prices from" or the display of prices excluding tax are strictly regulated and may be used only under precise conditions.

Ordering process and formation of the electronic contract

Technical architecture of the ordering process

The formation of the electronic contract is governed by specific rules designed to guarantee the integrity of the buyer's consent. The ordering process must follow a precise technical architecture, commonly called the "double click", which requires the consumer to confirm the order after having had the opportunity to check and amend the elements of the order.

This technical obligation goes together with the obligation to provide a summary before final confirmation. The summary must set out the essential characteristics of the goods or services ordered, the total price, the payment and delivery terms, and the period of validity of the offer.

Acknowledgement of receipt and order confirmation

The electronic acknowledgement of receipt is a fundamental legal obligation on which the legal validity of the transaction depends. This acknowledgement must be sent without undue delay by electronic means and confirm receipt of the order and its essential elements.

The order confirmation, which is distinct from the acknowledgement of receipt, must be given within a reasonable time and confirm the trader's acceptance of the order. This step legally marks the final formation of the contract and the starting point of the parties' respective obligations.

Right of withdrawal and consumer protection

How the right of withdrawal is exercised

The right of withdrawal is a protection specific to distance contracts, allowing the consumer to go back on the commitment without having to give any reason or bear any penalty. This right may be exercised within fourteen clear days from receipt of the goods or, for services, from the conclusion of the contract.

Information on this right must be provided clearly and comprehensibly before the contract is concluded, failing which the withdrawal period is extended by twelve months. This particularly severe sanction underlines the importance the legislature attaches to this pre-contractual information.

The trader must make a standard withdrawal form available to the consumer, although the consumer is not obliged to use it. The right of withdrawal may be exercised by any unambiguous statement expressing the wish to withdraw.

Exceptions to the right of withdrawal

Certain categories of goods and services are excluded from the right of withdrawal because of their particular nature. These exceptions concern in particular goods made to the consumer's specifications, perishable goods, unsealed audio or video recordings, and services fully performed before the end of the withdrawal period with the consumer's prior agreement.

Contracts for the supply of digital content not supplied on a tangible medium are also excluded from the right of withdrawal once performance has begun with the consumer's prior express consent and express waiver of the right of withdrawal.

Protection of personal data and the GDPR

Fundamental principles of data processing

GDPR compliance is a major issue for e-commerce players who collect and process personal data on a large scale. The principles of lawfulness, fairness and transparency require clear and complete information on the purposes of the processing, the data retention period and the rights of the data subjects.

The principle of data minimisation requires collecting only the data strictly necessary for the purposes pursued. This requirement calls for careful thought about the design of collection forms and about which data are actually indispensable for carrying out the commercial transaction.

The legal basis for the processing must be clearly identified for each purpose pursued. While performance of the contract justifies processing the data necessary for delivery and invoicing, direct marketing operations generally require the explicit consent of the data subject.

Individuals' rights and technical measures

Exercising the rights of data subjects requires suitable procedures and technical tools to be put in place. The rights of access, rectification, erasure and data portability must be capable of being exercised simply and within reasonable time limits.

Implementing these rights often involves specific technical development, in particular for extracting and transmitting data in a structured and commonly used format. E-commerce platforms must also provide for procedures for the permanent deletion of data, including in backup systems.

Tax and reporting obligations

VAT and electronic commerce

VAT management in e-commerce presents particular complexities linked to the international dimension of transactions and the applicable rules on place of supply. Since July 2021, the new VAT rules on electronic commerce have considerably changed businesses' reporting obligations.

For intra-Community B2C sales, the One Stop Shop scheme makes it possible to declare and pay the VAT due in all the Member States of consumption through a single portal. This scheme, which is optional but strongly recommended, simplifies reporting obligations while requiring rigorous accounting.

Imports of low-value goods (below €150) are now subject to VAT from the first euro, with specific obligations for the platforms facilitating these transactions. These obligations include collecting the VAT on behalf of the tax authorities and transmitting detailed information on the transactions concerned.

Specific returns and registers

Beyond the traditional tax obligations, e-commerce generates specific reporting obligations. The obligation to file a declaration of exchanges of goods (DEB) concerns intra-Community movements of goods above certain thresholds.

Electronic commerce businesses must also keep specific registers enabling them to justify the application of particular tax regimes and to respond to administrative audits. These registers include in particular the traceability of flows of goods, the precise identification of customers and the geographical location of transactions.

Liability and disputes in e-commerce

Applicable liability regimes

The liability of e-commerce players is built around several legal regimes depending on the nature of the activity carried on. Online sellers bear strict liability for latent defects and lack of conformity, reinforced by the provisions specific to distance selling.

Intermediation platforms benefit from the status of host provider defined by the Law for confidence in the digital economy, provided that they have no actual knowledge of the unlawfulness of the content they host. This regime of reduced liability nevertheless entails obligations of vigilance and prompt reaction when a report is made. On the classification of these platforms and the European regulation that governs them, see our analysis of the marketplace, its legal definition and its stakes.

Liability may also arise in respect of personal data in the event of a breach of the GDPR, with penalties of up to 4% of worldwide annual turnover. This liability extends to processors and calls for particular care in the choice of technical service providers.

Dispute resolution and mediation

Dispute resolution in e-commerce benefits from specific mechanisms designed to facilitate consumers' access to justice. The European online dispute resolution (ODR) platform offers a single entry point for consumers wishing to resolve a cross-border dispute.

Traders must inform consumers of the existence of this platform and state their email address on the ODR site. This obligation goes together with the appointment of a consumer mediator competent for domestic disputes.

Regulatory developments and outlook for 2026

Digital Services Act and new obligations

The gradual entry into application of the Digital Services Act is transforming the regulatory environment of e-commerce, with stricter obligations for large platforms. These obligations include the assessment and mitigation of systemic risks, algorithmic transparency and cooperation with regulatory authorities.

Very large online platforms, defined by a threshold of 45 million monthly active users in the European Union, are subject to particularly strict obligations, including annual independent audits and six-monthly transparency reports.

Artificial intelligence and automation

The growing use of artificial intelligence in e-commerce raises new legal questions relating to the transparency of automated decision-making systems and algorithmic liability. The forthcoming European regulation on artificial intelligence will impose specific obligations for high-risk AI systems.

Chatbots and virtual assistants used in customer relations will have to comply with obligations to disclose their automated nature and their limits. This development calls for adaptation of user interfaces and customer service processes.

The constant evolution of electronic commerce regulation requires businesses to carry out permanent legal monitoring and to be able to adapt their operational processes quickly. The growing complexity of these obligations, combined with the major economic stakes of regulatory compliance, fully justifies seeking support from legal professionals who focus on the field. Faced with these multiple legal challenges, anticipating and structuring compliance processes are lasting competitive advantages for businesses in the digital sector.