# Study: 500 French online shops tested for legal compliance in 2026

> Of 500 online shops on .fr domains visited on 7 and 8 October 2026, 274 (54.8%) set an advertising or audience measurement cookie before the visitor clicked anything, and 77 banners out of 335 (23%) offered no way to refuse on the first screen. Only 185 legal notice pages out of 364 (50.8%) gave a SIREN or RCS number, the host, the publication director and a contact, and 18 sets of terms of sale out of 397 (4.5%) described the online withdrawal function mandatory since 19 June 2026. These figures describe the sample, mostly mid-sized and small sites, and measure whether something is mentioned, not whether it is legally compliant.

Source: https://legalnest.io/en/guides/french-ecommerce-compliance-study-2026/
Updated on 8 October 2026. Checked against the law in force on 08/10/2026.
General information, not personalised legal advice.

On 7 and 8 October 2026, our crawler opened the home page of 500 online shops on .fr domains and clicked nothing. On 274 of them, a non-exempt advertising or audience measurement cookie was already in place before the visitor could say yes or no. On the contract side, the big change of the year is almost absent from the « CGV » (terms of sale): the online withdrawal function, mandatory since 19 June 2026, appears in just 18 sets of terms out of 397. Here is what we measured, how we measured it, and what these figures do not tell you.

If you sell to French customers, whether from a Shopify brand abroad or a French company, this is a snapshot of how .fr shops handle the rules that apply in France.

## What are the key findings of the study?

More than one shop in two in the sample sets trackers before any choice, and one legal notice page in two lacks at least one of the four items we looked for. Old rules are better covered in terms of sale than new ones: 360 sets of terms out of 397 (90.7%) mention the right of withdrawal, 18 out of 397 (4.5%) the 2026 withdrawal function.

| Finding | Sites concerned | Result |
|---|---|---|
| Non-exempt advertising or measurement cookie set before any choice | 274 out of 500 | 54.8% |
| Tracker set while no banner is visible | 107 out of 500 | 21.4% |
| Banner with no refuse button on the first layer | 77 out of 335 | 23% |
| Complete legal notice (SIREN or RCS, host, publication director, contact) | 185 out of 364 | 50.8% |
| Terms of sale that identify a consumer mediator | 196 out of 397 | 49.4% |
| Terms of sale that describe the 2026 online withdrawal function | 18 out of 397 | 4.5% |
| Privacy policy that mentions the right to complain to the CNIL | 106 out of 344 | 30.8% |
| “Accessibility” link or mention from the home page | 73 out of 492 | 14.8% |

Denominators vary: an unreadable page (error, PDF, missing link) is removed from the calculation rather than counted as non-compliant.

## Do French online shops set cookies before consent?

Yes, more than half of the sample does: 274 sites out of 500 (54.8%) set at least one non-exempt advertising or audience measurement cookie within 9 to 15 seconds of landing, with no click at all. Yet [article 82 of the « loi Informatique et Libertés »](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) (the French Data Protection Act) makes these trackers conditional on the user’s prior consent. The rule itself is EU-wide (article 82 is France’s transposition of the ePrivacy Directive); in France, the CNIL (the French data protection authority) enforces it.

The most common cookies come from Google Analytics (`_ga`, 186 sites out of 500, or 37.2%), the Meta pixel (`_fbp`, 113 out of 500, or 22.6%) and Google Ads (`_gcl_au`, 110 out of 500, or 22%). The indicator is conservative: it only counts a closed list of cookies known not to be exempt.

**The banner.** 335 sites out of 500 (67%) display a visible banner. Of the other 165, 107 (64.8%) still set a non-exempt tracker. And a banner is no guarantee: 167 of the 335 sites that display one (49.9%) have already set such a cookie before the visitor chooses.

**Refusing on the first screen.** The CNIL expects refusing to be as easy as accepting, from the first layer ([CNIL cookie FAQ, questions 37 and 38](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ), in French). Of the 335 visible banners, 258 (77%) offer a refuse button on the first layer and 77 (23%) do not (the study does not judge whether that button is as visible as the accept button). The most common labels: « Continuer sans accepter » (continue without accepting, 71 out of 258, or 27.5%), « Refuser » (refuse, 51 out of 258, or 19.8%) and « Tout refuser » (refuse all, 32 out of 258, or 12.4%).

**What was not measured.** With no click, we did not test whether a refusal is respected, although the CNIL fines businesses that ignore it (see our [database of CNIL fines](/en/guides/cnil-fines/)). And 101 sites out of 500 (20.2%) send measurement or advertising requests without setting a cookie from our list, notably through Google Consent Mode in its “denied” state: they are not counted among the 274, even though this mode calls for caution (see our guide to a [CNIL-compliant cookie banner](/en/guides/cookie-banner-france-cnil/)).

## Are French online shops’ legal notices complete?

Only one in two: of 364 « mentions légales » (legal notice) pages analysed, 185 (50.8%) contain all four items we looked for, namely a SIREN (company registration number) or RCS (trade and companies register) number, the host, the publication director and a means of contact. The item missing most often is the publication director.

[Article 1-1 of the « LCEN »](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568614) (the French Law on Confidence in the Digital Economy) requires every professional publisher to give its identity, phone number, registration number in the RCS or the national business register if it is subject to registration, the name of the publication director and the host’s contact details. An online shop adds the information in [article 19](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000032236011), including an email address and, if it is liable for VAT, its VAT number. What the sample shows:

- a “legal notice” link is reachable from the home page on 394 sites out of 492 (80.1%);
- SIREN or RCS number: 307 pages out of 364 (84.3%);
- host identified: 270 out of 364 (74.2%);
- publication director: 229 out of 364 (62.9%);
- an email address or phone number: 342 out of 364 (94%), but a phone number on only 253 (69.5%);
- EU VAT number: 180 out of 364 (49.5%), without our knowing which publishers are liable for VAT.

This “complete notice” is a benchmark, not a certificate of compliance: it checks neither the accuracy of the information, nor the registered office, nor the share capital. The exact list for your status is in our guide to the [legal notice for a website in France](/en/guides/legal-notice-website-france/).

## Are terms of sale up to date with the 2026 withdrawal button?

On the old rules, largely; on the 2026 one, barely. 360 sets of terms out of 397 (90.7%) mention the right of withdrawal and 326 (82.1%) state the 14-day period, but only 18 (4.5%) describe the online withdrawal function mandatory since 19 June 2026.

The fourteen-day period comes from [article L221-18 of the « Code de la consommation »](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226842) (Consumer Code). The function was added to article L221-21 by [« ordonnance » (government order) No. 2026-2](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000053298845), which transposes Directive (EU) 2023/2673: the obligation exists across the EU, the wording below is the French one.

**What the law says**

> Pour les contrats conclus à distance au moyen d’une interface en ligne, le professionnel met à la disposition du consommateur, sans frais pour ce dernier, une fonctionnalité lui permettant d’exercer gratuitement son droit de rétractation avant l’expiration du délai prévu à l’article L. 221-18.
> 
> *Unofficial translation:* For contracts concluded at a distance by means of an online interface, the trader shall make available to the consumer, at no cost to the consumer, a function enabling them to exercise their right of withdrawal free of charge before the expiry of the period provided for in article L. 221-18.
>
> Source: [Code de la consommation, art. L221-21, alinéa 3 (Consumer Code, art. L221-21, paragraph 3)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520)

[Article L221-5](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) also requires the pre-contractual information, in practice the terms of sale, to state that this function exists and where it is, labelled « renoncer au contrat ici » (withdraw from the contract here) or an equally clear wording ([art. D. 221-5](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000053299001)). A link of this kind is visible on the home page of only 27 sites out of 500 (5.4%). All 18 detections in terms of sale were checked by hand.

**Terms of sale rarely dated.** Only 105 sets of terms out of 397 (26.4%) show a readable update date. Of those, 30 out of 105 (28.6%) are dated 19 June 2026 or later, and 25 out of 105 (23.8%) predate 2024.

**The mediator.** The trader must give the consumer the contact details of the competent consumer mediator ([art. L616-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762), [Entreprendre Service Public factsheet](https://entreprendre.service-public.gouv.fr/vosdroits/F33338), in French). 214 sets of terms out of 397 (53.9%) mention mediation, and 196 (49.4%) identify the mediator by name, website or address.

**The legal guarantee of conformity.** General terms must mention the legal guarantees, “in particular” the legal guarantee of conformity ([art. L211-2](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044142459)). It appears in 214 sets of terms out of 397 (53.9%). In addition, 34 sets of terms (8.6%) still cite articles L211-4 et seq., the old numbering of the guarantees from before the 2016 recodification of the Consumer Code.

The full expected content is set out in our guide to [terms of sale in France](/en/guides/terms-of-sale-france/), and the 2026 function in our guide to the [EU withdrawal button](/en/guides/withdrawal-button-eu/).

## Do privacy policies tell customers about their rights?

Poorly when it comes to complaints: of 344 privacy policies analysed, 106 (30.8%) mention the right to lodge a complaint with the CNIL, although article 13 of the GDPR requires this to be stated when the data is collected. A policy that refers to a “supervisory authority” without naming the CNIL is not counted. A privacy page is reachable from the home page on 383 sites out of 492 (77.8%).

[Article 13 of the GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679), which applies across the EU, lists what individuals must be told at collection, including their right to lodge a complaint with a supervisory authority and, “where applicable”, the contact details of the data protection officer. The CNIL is named in 155 policies out of 344 (45.1%). A data protection officer appears in 91 policies out of 344 (26.5%), which is not a breach in itself: only organisations that have appointed one must give their contact details.

Our annotated [privacy policy template](/en/guides/privacy-policy-france/) gives the structure.

## Do French online shops say anything about accessibility?

Rarely, except the largest sites: an “Accessibility” link or mention appears on 73 sites out of 492 (14.8%). The share reaches 28 sites out of 46 (60.9%) between ranks 10,000 and 100,000, but only 41 out of 442 (9.3%) beyond rank 100,000.

This low rate is not evidence of a breach, because the obligation depends on the site:

- [article 47 of Law No. 2005-102](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037388867/) requires a clearly visible mention on the home page and an accessibility statement from public bodies and from companies whose turnover exceeds a threshold set by decree;
- since 28 June 2025, e-commerce services also fall within the scope of the accessibility requirements ([Decree No. 2023-931](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000048178349), art. D. 412-50, part of France’s transposition of the European Accessibility Act) and their providers must publish information about that accessibility ([art. D412-57](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000048180389));
- but article L412-13 of the Consumer Code, created by [article 16 of Law No. 2023-171](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000047281814), exempts businesses employing fewer than ten people that provide services and whose annual turnover or balance sheet total does not exceed €2 million.

Some of the shops in the sample are probably covered by this exemption, but we know neither their headcount nor their turnover. Of the 66 accessibility pages read, 43 state a status: 18 « non conforme » (non-compliant), 24 « partiellement conforme » (partially compliant) and just 1 « totalement conforme » (fully compliant).

## Do results differ between Shopify, PrestaShop and WooCommerce, and by site size?

Yes, clearly: the least visited sites set trackers before consent more often (259 out of 450 beyond rank 100,000, or 57.6%, against 15 out of 46 between ranks 10,000 and 100,000, or 32.6%), and Shopify, PrestaShop and WooCommerce shops do so more often than the rest. Some groups are small: read these as trends.

| Indicator | Shopify (117 sites) | PrestaShop (158) | WooCommerce (32) | Other or unidentified (193) |
|---|---|---|---|---|
| Tracker before any choice | 78/117 (66.7%) | 95/158 (60.1%) | 19/32 (59.4%) | 82/193 (42.5%) |
| Visible banner | 71/117 (60.7%) | 96/158 (60.8%) | 13/32 (40.6%) | 155/193 (80.3%) |
| Refusal on the first layer, among banners | 54/71 (76.1%) | 71/96 (74%) | 9/13 (69.2%) | 124/155 (80%) |
| Complete legal notice | 43/88 (48.9%) | 67/125 (53.6%) | 16/27 (59.3%) | 59/124 (47.6%) |
| Mediator identified in terms of sale | 49/102 (48%) | 57/127 (44.9%) | 8/22 (36.4%) | 82/146 (56.2%) |
| 2026 withdrawal function in terms of sale | 4/102 (3.9%) | 3/127 (2.4%) | 0/22 (0%) | 11/146 (7.5%) |
| Link to the privacy policy | 107/116 (92.2%) | 91/153 (59.5%) | 29/31 (93.5%) | 156/192 (81.3%) |

The “other” group includes Magento or Adobe Commerce (57 sites) and sites with no recognised platform (105). Platform-specific statistics cookies or potentially exempt ones are not counted as trackers (found on 58 Shopify shops out of 117, or 49.6%), and 13 shops were excluded because their robots.txt disallows their policy pages.

| Indicator | Top 10,000 (4 sites) | Ranks 10,000 to 100,000 (46) | Ranks 100,000 to 1 million (450) |
|---|---|---|---|
| Tracker before any choice | 0/4 | 15/46 (32.6%) | 259/450 (57.6%) |
| Visible banner | 4/4 | 40/46 (87%) | 291/450 (64.7%) |
| Refusal on the first layer, among banners | 4/4 | 38/40 (95%) | 216/291 (74.2%) |
| 2026 withdrawal function in terms of sale | 0/2 | 4/38 (10.5%) | 14/357 (3.9%) |
| “Accessibility” link or mention | 4/4 | 28/46 (60.9%) | 41/442 (9.3%) |

With 4 sites, the first column cannot be interpreted on its own; with 46, the second is indicative only.

## Where can I find all the study’s indicators?

In the filterable table below: every overall indicator, with its result, numerator and denominator. Type “Terms of sale” or “Cookies”, for example.

```datatable title="Compliance of 500 online shops on .fr domains: all indicators (October 2026)" filter
Indicator,Result,n/N,Topic
Home page served over HTTPS,99.8%,499/500,Security
At least one cookie set on arrival,97.6%,488/500,Cookies
Non-exempt advertising or measurement cookie before any choice,54.8%,274/500,Cookies
Third-party cookie set before any choice,42.2%,211/500,Cookies
Google Analytics cookie (_ga) before any choice,37.2%,186/500,Cookies
Meta pixel cookie (_fbp) before any choice,22.6%,113/500,Cookies
Google Ads cookie (_gcl_au) before any choice,22%,110/500,Cookies
Measurement or advertising script loaded,84.2%,421/500,Cookies
Measurement or advertising request sent before any choice,71.6%,358/500,Cookies
Measurement requests without a tracking cookie (not counted),20.2%,101/500,Cookies
Consent management tool detected,61.4%,307/500,Banner
Consent banner visible,67%,335/500,Banner
Refusal on the first layer (among banners),77%,258/335,Banner
Strict refusal on the first layer (among banners),74.3%,249/335,Banner
Banner with no refusal on the first layer,23%,77/335,Banner
Tracker before any choice (sites with a banner),49.9%,167/335,Banner
Tracker before any choice (sites without a banner),64.8%,107/165,Banner
Active tracker with no visible banner,21.4%,107/500,Banner
Link to a cookie policy,37.2%,183/492,Banner
Legal notice link from the home page,80.1%,394/492,Legal notice
SIREN or RCS number,84.3%,307/364,Legal notice
Host identified,74.2%,270/364,Legal notice
Publication director,62.9%,229/364,Legal notice
Email or phone,94%,342/364,Legal notice
Phone number,69.5%,253/364,Legal notice
EU VAT number,49.5%,180/364,Legal notice
Complete notice (SIREN or RCS + host + director + contact),50.8%,185/364,Legal notice
Terms of sale link from the home page,92.9%,457/492,Terms of sale
Right of withdrawal mentioned,90.7%,360/397,Terms of sale
14-day period mentioned,82.1%,326/397,Terms of sale
Consumer mediation mentioned,53.9%,214/397,Terms of sale
"Mediator identified (name, website or address)",49.4%,196/397,Terms of sale
Legal guarantee of conformity mentioned,53.9%,214/397,Terms of sale
Old reference to articles L211-4 et seq.,8.6%,34/397,Terms of sale
Online withdrawal function described,4.5%,18/397,Terms of sale
Online withdrawal link visible on the home page,5.4%,27/500,Terms of sale
Readable update date,26.4%,105/397,Terms of sale
Dated 19 June 2026 or later (among dated terms),28.6%,30/105,Terms of sale
Dated before 2024 (among dated terms),23.8%,25/105,Terms of sale
Link to the privacy policy,77.8%,383/492,Privacy
CNIL named,45.1%,155/344,Privacy
Right to complain to the CNIL,30.8%,106/344,Privacy
Data protection officer mentioned,26.5%,91/344,Privacy
Accessibility link or mention,14.8%,73/492,Accessibility
Accessibility status stated (among pages read),65.2%,43/66,Accessibility
Status: non-compliant,27.3%,18/66,Accessibility
Status: partially compliant,36.4%,24/66,Accessibility
Status: fully compliant,1.5%,1/66,Accessibility
```

## How was the study carried out?

With a dedicated automated crawler that, on 7 and 8 October 2026, visited each site’s home page without interacting, then the legal pages linked from it. The 500 sites come from the public Tranco list and were reviewed by hand.

**The sample.** We started from the [Tranco list 26Y29](https://tranco-list.eu/list/26Y29), generated on 6 October 2026 from five rankings covering 7 September to 6 October 2026. We kept its 10,184 .fr domains, minus 132 .gouv.fr domains, and split the 10,052 candidates into three rank tiers:

| Tier | Candidate .fr domains | Candidates examined | Sites selected |
|---|---|---|---|
| Ranks 1 to 10,000 | 88 | 88 (all) | 4 |
| Ranks 10,001 to 100,000 | 886 | 886 (all) | 46 |
| Ranks 100,001 to 1,000,000 | 9,078 | 2,956 (drawn at random) | 450 |
| Total | 10,052 | 3,930 | 500 |

We aimed for a third of the sample per tier and fell short: the first two tiers are mostly media, public services, banks and telecom operators, and large shopping sites block bots more often. Examined in full, they yield only 50 sites; the third tier supplies 450 out of 500, or 90%.

A site is selected if it is in French and clearly a shop (a shopping platform or a visible basket, with a price). The 604 sites classified this way were reviewed one by one: 97 were removed (business-to-business sales, non-commercial sites, marketplaces…), then the last 7 of the third tier, in random draw order, were dropped.

```mermaid
flowchart TD
  A["10,052 candidate .fr domains (Tranco 26Y29, excluding .gouv.fr)"] --> B["3,930 candidates examined"]
  B --> X1["2,207 non-commercial sites"]
  B --> X2["615 blocked: anti-bot (501) or robots.txt (114)"]
  B --> X3["345 unreachable, in error or too slow"]
  B --> X4["159 other exclusions: adult, gambling, public sites, duplicates…"]
  B --> C["604 sites classified as shops"]
  C --> D["97 removed at manual review"]
  C --> E["507 available after review"]
  E --> F["500 sites analysed: 4 + 46 + 450"]
```

**Data collection.** A headless Chromium browser, a fresh context for each site (no pre-existing cookies), French as the browser language and an IP address in the European Union. The crawler identified itself as “LegalnestBot” with a link to this study, respected robots.txt (sites that disallowed the home page or a legal page were excluded), bypassed no anti-bot protection and sent no more than one navigation request per second per domain. No forms, no basket, no clicks.

On the home page, it looks for the banner across the whole page, frames included, then records cookie names (never their values) 9 to 15 seconds after landing. The 169 sites with no banner detected were reloaded with a 25-second wait: a late banner appeared on 4 of them. The legal pages linked from the home page are then read by keyword detectors.

**Denominators.** Terms of sale are assessed on 397 sites: 43 with no terms of sale link found, 32 with access denied, 13 pages that were not terms of sale, 8 PDFs and 7 other errors. Legal links cover 492 sites, as 8 footers could not be captured.

**Quality control.** 25 randomly drawn sites were checked by hand, detector by detector, then 10 more after correction. The banner, refusal and cookie detectors made almost no errors; the text detectors made 8 errors in about 170 decisions before correction, and one known error remains: a host’s SIRET (establishment registration number) counted in place of the publisher’s, which was missing.

## What are the study’s limitations?

The figures describe 500 .fr sites, mostly mid-sized or small, observed without interaction: they cannot be extrapolated to French e-commerce as a whole and do not say whether a site is legally compliant.

- **The sample.** .fr domains only, so no retailers on .com; sites that block bots (501) or disallow them in robots.txt (114) excluded; 450 sites out of 500 beyond rank 100,000, with no weighting. Foreign brands selling on a .fr domain are included, although some French obligations do not apply to them in the same way.
- **The home page only**, with no clicks: trackers set after acceptance, whether a refusal is respected and the checkout flow were not tested.
- **A time window.** A late banner or cookie is not seen: trackers are more likely underestimated.
- **Google Consent Mode** and cookieless requests are not counted; the configuration of potentially exempt measurement tools was not checked.
- **Whether something is mentioned, not whether it complies.** A named mediator may not be the competent one; a “complete notice” in the study’s sense does not amount to compliance with the LCEN. PDFs and text in images are not read: presence rates are lower bounds.
- **One page per category.** Legal notice details placed in the terms of sale may escape the measurement.
- **Revisits.** To correct the measurement, about a hundred sites had their home page visited 2 to 4 times; only the last complete measurement is kept.
- **The manual review** of the 604 sites relies on judgement, and every reason was logged.

## How do I check my own online shop against the study?

Run the study’s checks on your own site: private browsing window, home page, no clicks, then a read-through of your legal pages. Each point links to the guide that explains how to fix it.

**The study’s checks, applied to your shop**

- [ ] No non-exempt advertising or measurement cookie is set **before** the visitor chooses ([cookie banner guide](/en/guides/cookie-banner-france-cnil/))
- [ ] The banner offers a **refuse option on the first screen**, as visible as the accept button
- [ ] The **legal notice** gives the SIREN or RCS number, phone number, publication director and host ([full list](/en/guides/legal-notice-website-france/))
- [ ] The **terms of sale** state the 14-day period, the legal guarantee of conformity and the **mediator** by name and contact details ([terms of sale guide](/en/guides/terms-of-sale-france/))
- [ ] A **« Renoncer au contrat ici »** (withdraw from the contract here) link, or an equally clear wording, is visible and the terms of sale say where to find it ([withdrawal button guide](/en/guides/withdrawal-button-eu/))
- [ ] The terms of sale carry an **update date** and have been reviewed since 19 June 2026
- [ ] The **privacy policy** mentions the right to complain to the CNIL ([annotated template](/en/guides/privacy-policy-france/))
- [ ] Your **record of processing activities** is up to date ([record guide](/en/guides/gdpr-record-of-processing/))
- [ ] You know whether the **accessibility** obligation applies to you, or whether you are exempt as a microenterprise providing services

For everything else, the [website compliance quiz](/en/guides/website-compliance-quiz/) runs through your site in a few questions, and our [table of mandatory documents](/en/guides/mandatory-legal-documents-france/) lists what your company must keep up to date.

**With Legalnest**: Legalnest’s [free tools](/en/tools/), with no account and a report by email, run some of these checks on your own site: the [website audit](https://app.legalnest.io/tools/website-audit?lang=en) (legal links on the home page, HTTPS, consent mechanism), the [cookie checker](https://app.legalnest.io/tools/cookies?lang=en) (cookies set on first load) and the [legal notice checker](https://app.legalnest.io/tools/legal-notice?lang=en). The study itself was carried out with a dedicated crawler, not with these tools.

**Reusing the data:** you may quote it freely, provided you credit Legalnest with a link to [this page](/en/guides/french-ecommerce-compliance-study-2026/) and keep, for each percentage, its numerator and denominator.

## Frequently asked questions

### How many online shops in France set cookies without consent?

In our sample of 500 online shops on .fr domains, visited on 7 and 8 October 2026, 274 sites (54.8%) set at least one non-exempt advertising or audience measurement cookie before the visitor clicked anything. The most common came from Google Analytics (186 sites out of 500), the Meta pixel (113 out of 500) and Google Ads (110 out of 500). This figure describes the sample, mostly mid-sized and small sites, and cannot be extrapolated to French e-commerce as a whole.

### Have online shops added the withdrawal button mandatory in France since 19 June 2026?

Very few, as far as can be measured from the outside. Of the 397 sets of terms of sale analysed, 18 (4.5%) describe the online withdrawal function required by article L221-21 of the French Consumer Code, and a link of this kind is visible on the home page of only 27 sites out of 500 (5.4%). The function may exist in the customer account without being visible from outside, so these figures are lower bounds.

### How were the 500 sites in the study chosen?

They come from the Tranco list 26Y29, a public ranking of the most visited domains. We kept the .fr domains, examined 3,930 candidates and selected French-language consumer shopping sites, after a manual review. The sample includes 4 sites from the top 10,000, 46 sites ranked between 10,000 and 100,000 and 450 sites ranked between 100,000 and 1 million.

### Does a detected mention mean the site is compliant?

No. The study records whether something is mentioned in a text (a named mediator, a 14-day period, a named host), not whether it is legally compliant: a named mediator may not be the competent one, a withdrawal clause may be badly drafted. Conversely, information held in a PDF or an image was not read. The presence rates are therefore best read as lower bounds.

### Is my online shop in the sample?

We publish neither the list of sites nor any individual result: the study is aggregated and anonymous. The crawler identified itself as LegalnestBot and respected robots.txt files. To see where your own site stands, Legalnest’s free tools (website audit, cookie checker, legal notice checker) repeat some of these checks, and the website compliance quiz takes stock in a few questions.

### Can I reuse the figures from this study?

Yes, freely, provided you credit Legalnest and link to this page. Please quote each percentage with its denominator (for example “274 sites out of 500”) and refer to the sample studied, not to French e-commerce as a whole.


## Sources

- [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) (Légifrance)
- [Questions-réponses sur les lignes directrices modificatives et la recommandation « cookies et autres traceurs » de la CNIL (CNIL cookie FAQ, in French)](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ) (CNIL)
- [Cookies et traceurs : comment mettre mon site web en conformité ? (making your website compliant, in French)](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) (CNIL)
- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN, Law on Confidence in the Digital Economy), art. 1-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568614) (Légifrance)
- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN, Law on Confidence in the Digital Economy), art. 19](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000032236011) (Légifrance)
- [Code de la consommation, art. L221-18 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226842) (Légifrance)
- [Code de la consommation, art. L221-21 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) (Légifrance)
- [Code de la consommation, art. L221-5 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) (Légifrance)
- [Ordonnance n° 2026-2 du 5 janvier 2026 (Order No. 2026-2 of 5 January 2026 on the distance marketing of financial services to consumers)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000053298845) (Légifrance)
- [Décret n° 2026-3 du 5 janvier 2026, art. 2 (Decree No. 2026-3 of 5 January 2026, art. 2, creating article D. 221-5 of the Consumer Code)](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000053299001) (Légifrance)
- [Code de la consommation, art. L211-2 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044142459) (Légifrance)
- [Code de la consommation, art. L616-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762) (Légifrance)
- [Médiation des litiges de la consommation (consumer dispute mediation, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F33338) (Entreprendre Service Public)
- [RGPD, chapitre III : droits de la personne concernée (GDPR, Chapter III: rights of the data subject, art. 13, in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre3) (CNIL)
- [Regulation (EU) 2016/679 (General Data Protection Regulation), art. 13](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) (EUR-Lex)
- [Loi n° 2005-102 du 11 février 2005 pour l’égalité des droits et des chances, la participation et la citoyenneté des personnes handicapées (Law of 11 February 2005 on equal rights and opportunities, participation and citizenship of disabled people), art. 47](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037388867/) (Légifrance)
- [Loi n° 2023-171 du 9 mars 2023 portant diverses dispositions d’adaptation au droit de l’Union européenne (Law of 9 March 2023 adapting French law to EU law), art. 16, creating article L. 412-13 of the Consumer Code](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000047281814) (Légifrance)
- [Décret n° 2023-931 du 9 octobre 2023 relatif à l’accessibilité aux personnes handicapées des produits et services (Decree of 9 October 2023 on the accessibility of products and services for disabled people)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000048178349) (Légifrance)
- [Code de la consommation, art. D412-57 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000048180389) (Légifrance)
- [Tranco list 26Y29, generated on 6 October 2026 (source of the sample)](https://tranco-list.eu/list/26Y29) (Tranco)