Study: 500 French online shops tested for legal compliance in 2026

On 7 and 8 October 2026, our crawler opened the home page of 500 online shops on .fr domains and clicked nothing. On 274 of them, a non-exempt advertising or audience measurement cookie was already in place before the visitor could say yes or no. On the contract side, the big change of the year is almost absent from the « CGV » (terms of sale): the online withdrawal function, mandatory since 19 June 2026, appears in just 18 sets of terms out of 397. Here is what we measured, how we measured it, and what these figures do not tell you.

If you sell to French customers, whether from a Shopify brand abroad or a French company, this is a snapshot of how .fr shops handle the rules that apply in France.

What are the key findings of the study?

More than one shop in two in the sample sets trackers before any choice, and one legal notice page in two lacks at least one of the four items we looked for. Old rules are better covered in terms of sale than new ones: 360 sets of terms out of 397 (90.7%) mention the right of withdrawal, 18 out of 397 (4.5%) the 2026 withdrawal function.

Denominators vary: an unreadable page (error, PDF, missing link) is removed from the calculation rather than counted as non-compliant.

Do French online shops set cookies before consent?

Yes, more than half of the sample does: 274 sites out of 500 (54.8%) set at least one non-exempt advertising or audience measurement cookie within 9 to 15 seconds of landing, with no click at all. Yet article 82 of the « loi Informatique et Libertés » (the French Data Protection Act) makes these trackers conditional on the user’s prior consent. The rule itself is EU-wide (article 82 is France’s transposition of the ePrivacy Directive); in France, the CNIL (the French data protection authority) enforces it.

The most common cookies come from Google Analytics (_ga, 186 sites out of 500, or 37.2%), the Meta pixel (_fbp, 113 out of 500, or 22.6%) and Google Ads (_gcl_au, 110 out of 500, or 22%). The indicator is conservative: it only counts a closed list of cookies known not to be exempt.

The banner. 335 sites out of 500 (67%) display a visible banner. Of the other 165, 107 (64.8%) still set a non-exempt tracker. And a banner is no guarantee: 167 of the 335 sites that display one (49.9%) have already set such a cookie before the visitor chooses.

Refusing on the first screen. The CNIL expects refusing to be as easy as accepting, from the first layer (CNIL cookie FAQ, questions 37 and 38, in French). Of the 335 visible banners, 258 (77%) offer a refuse button on the first layer and 77 (23%) do not (the study does not judge whether that button is as visible as the accept button). The most common labels: « Continuer sans accepter » (continue without accepting, 71 out of 258, or 27.5%), « Refuser » (refuse, 51 out of 258, or 19.8%) and « Tout refuser » (refuse all, 32 out of 258, or 12.4%).

What was not measured. With no click, we did not test whether a refusal is respected, although the CNIL fines businesses that ignore it (see our database of CNIL fines). And 101 sites out of 500 (20.2%) send measurement or advertising requests without setting a cookie from our list, notably through Google Consent Mode in its “denied” state: they are not counted among the 274, even though this mode calls for caution (see our guide to a CNIL-compliant cookie banner).

Are French online shops’ legal notices complete?

Only one in two: of 364 « mentions légales » (legal notice) pages analysed, 185 (50.8%) contain all four items we looked for, namely a SIREN (company registration number) or RCS (trade and companies register) number, the host, the publication director and a means of contact. The item missing most often is the publication director.

Article 1-1 of the « LCEN » (the French Law on Confidence in the Digital Economy) requires every professional publisher to give its identity, phone number, registration number in the RCS or the national business register if it is subject to registration, the name of the publication director and the host’s contact details. An online shop adds the information in article 19, including an email address and, if it is liable for VAT, its VAT number. What the sample shows:

• a “legal notice” link is reachable from the home page on 394 sites out of 492 (80.1%);
• SIREN or RCS number: 307 pages out of 364 (84.3%);
• host identified: 270 out of 364 (74.2%);
• publication director: 229 out of 364 (62.9%);
• an email address or phone number: 342 out of 364 (94%), but a phone number on only 253 (69.5%);
• EU VAT number: 180 out of 364 (49.5%), without our knowing which publishers are liable for VAT.

This “complete notice” is a benchmark, not a certificate of compliance: it checks neither the accuracy of the information, nor the registered office, nor the share capital. The exact list for your status is in our guide to the legal notice for a website in France.

Are terms of sale up to date with the 2026 withdrawal button?

On the old rules, largely; on the 2026 one, barely. 360 sets of terms out of 397 (90.7%) mention the right of withdrawal and 326 (82.1%) state the 14-day period, but only 18 (4.5%) describe the online withdrawal function mandatory since 19 June 2026.

The fourteen-day period comes from article L221-18 of the « Code de la consommation » (Consumer Code). The function was added to article L221-21 by « ordonnance » (government order) No. 2026-2, which transposes Directive (EU) 2023/2673: the obligation exists across the EU, the wording below is the French one.

Article L221-5 also requires the pre-contractual information, in practice the terms of sale, to state that this function exists and where it is, labelled « renoncer au contrat ici » (withdraw from the contract here) or an equally clear wording (art. D. 221-5). A link of this kind is visible on the home page of only 27 sites out of 500 (5.4%). All 18 detections in terms of sale were checked by hand.

Terms of sale rarely dated. Only 105 sets of terms out of 397 (26.4%) show a readable update date. Of those, 30 out of 105 (28.6%) are dated 19 June 2026 or later, and 25 out of 105 (23.8%) predate 2024.

The mediator. The trader must give the consumer the contact details of the competent consumer mediator (art. L616-1, Entreprendre Service Public factsheet, in French). 214 sets of terms out of 397 (53.9%) mention mediation, and 196 (49.4%) identify the mediator by name, website or address.

The legal guarantee of conformity. General terms must mention the legal guarantees, “in particular” the legal guarantee of conformity (art. L211-2). It appears in 214 sets of terms out of 397 (53.9%). In addition, 34 sets of terms (8.6%) still cite articles L211-4 et seq., the old numbering of the guarantees from before the 2016 recodification of the Consumer Code.

The full expected content is set out in our guide to terms of sale in France, and the 2026 function in our guide to the EU withdrawal button.

Do privacy policies tell customers about their rights?

Poorly when it comes to complaints: of 344 privacy policies analysed, 106 (30.8%) mention the right to lodge a complaint with the CNIL, although article 13 of the GDPR requires this to be stated when the data is collected. A policy that refers to a “supervisory authority” without naming the CNIL is not counted. A privacy page is reachable from the home page on 383 sites out of 492 (77.8%).

Article 13 of the GDPR, which applies across the EU, lists what individuals must be told at collection, including their right to lodge a complaint with a supervisory authority and, “where applicable”, the contact details of the data protection officer. The CNIL is named in 155 policies out of 344 (45.1%). A data protection officer appears in 91 policies out of 344 (26.5%), which is not a breach in itself: only organisations that have appointed one must give their contact details.

Our annotated privacy policy template gives the structure.

Do French online shops say anything about accessibility?

Rarely, except the largest sites: an “Accessibility” link or mention appears on 73 sites out of 492 (14.8%). The share reaches 28 sites out of 46 (60.9%) between ranks 10,000 and 100,000, but only 41 out of 442 (9.3%) beyond rank 100,000.

This low rate is not evidence of a breach, because the obligation depends on the site:

• article 47 of Law No. 2005-102 requires a clearly visible mention on the home page and an accessibility statement from public bodies and from companies whose turnover exceeds a threshold set by decree;
• since 28 June 2025, e-commerce services also fall within the scope of the accessibility requirements (Decree No. 2023-931, art. D. 412-50, part of France’s transposition of the European Accessibility Act) and their providers must publish information about that accessibility (art. D412-57);
• but article L412-13 of the Consumer Code, created by article 16 of Law No. 2023-171, exempts businesses employing fewer than ten people that provide services and whose annual turnover or balance sheet total does not exceed €2 million.

Some of the shops in the sample are probably covered by this exemption, but we know neither their headcount nor their turnover. Of the 66 accessibility pages read, 43 state a status: 18 « non conforme » (non-compliant), 24 « partiellement conforme » (partially compliant) and just 1 « totalement conforme » (fully compliant).

Do results differ between Shopify, PrestaShop and WooCommerce, and by site size?

Yes, clearly: the least visited sites set trackers before consent more often (259 out of 450 beyond rank 100,000, or 57.6%, against 15 out of 46 between ranks 10,000 and 100,000, or 32.6%), and Shopify, PrestaShop and WooCommerce shops do so more often than the rest. Some groups are small: read these as trends.

The “other” group includes Magento or Adobe Commerce (57 sites) and sites with no recognised platform (105). Platform-specific statistics cookies or potentially exempt ones are not counted as trackers (found on 58 Shopify shops out of 117, or 49.6%), and 13 shops were excluded because their robots.txt disallows their policy pages.

With 4 sites, the first column cannot be interpreted on its own; with 46, the second is indicative only.

Where can I find all the study’s indicators?

In the filterable table below: every overall indicator, with its result, numerator and denominator. Type “Terms of sale” or “Cookies”, for example.

How was the study carried out?

With a dedicated automated crawler that, on 7 and 8 October 2026, visited each site’s home page without interacting, then the legal pages linked from it. The 500 sites come from the public Tranco list and were reviewed by hand.

The sample. We started from the Tranco list 26Y29, generated on 6 October 2026 from five rankings covering 7 September to 6 October 2026. We kept its 10,184 .fr domains, minus 132 .gouv.fr domains, and split the 10,052 candidates into three rank tiers:

We aimed for a third of the sample per tier and fell short: the first two tiers are mostly media, public services, banks and telecom operators, and large shopping sites block bots more often. Examined in full, they yield only 50 sites; the third tier supplies 450 out of 500, or 90%.

A site is selected if it is in French and clearly a shop (a shopping platform or a visible basket, with a price). The 604 sites classified this way were reviewed one by one: 97 were removed (business-to-business sales, non-commercial sites, marketplaces…), then the last 7 of the third tier, in random draw order, were dropped.

flowchart TD
  A["10,052 candidate .fr domains (Tranco 26Y29, excluding .gouv.fr)"] --> B["3,930 candidates examined"]
  B --> X1["2,207 non-commercial sites"]
  B --> X2["615 blocked: anti-bot (501) or robots.txt (114)"]
  B --> X3["345 unreachable, in error or too slow"]
  B --> X4["159 other exclusions: adult, gambling, public sites, duplicates…"]
  B --> C["604 sites classified as shops"]
  C --> D["97 removed at manual review"]
  C --> E["507 available after review"]
  E --> F["500 sites analysed: 4 + 46 + 450"]

Data collection. A headless Chromium browser, a fresh context for each site (no pre-existing cookies), French as the browser language and an IP address in the European Union. The crawler identified itself as “LegalnestBot” with a link to this study, respected robots.txt (sites that disallowed the home page or a legal page were excluded), bypassed no anti-bot protection and sent no more than one navigation request per second per domain. No forms, no basket, no clicks.

On the home page, it looks for the banner across the whole page, frames included, then records cookie names (never their values) 9 to 15 seconds after landing. The 169 sites with no banner detected were reloaded with a 25-second wait: a late banner appeared on 4 of them. The legal pages linked from the home page are then read by keyword detectors.

Denominators. Terms of sale are assessed on 397 sites: 43 with no terms of sale link found, 32 with access denied, 13 pages that were not terms of sale, 8 PDFs and 7 other errors. Legal links cover 492 sites, as 8 footers could not be captured.

Quality control. 25 randomly drawn sites were checked by hand, detector by detector, then 10 more after correction. The banner, refusal and cookie detectors made almost no errors; the text detectors made 8 errors in about 170 decisions before correction, and one known error remains: a host’s SIRET (establishment registration number) counted in place of the publisher’s, which was missing.

What are the study’s limitations?

The figures describe 500 .fr sites, mostly mid-sized or small, observed without interaction: they cannot be extrapolated to French e-commerce as a whole and do not say whether a site is legally compliant.

• The sample. .fr domains only, so no retailers on .com; sites that block bots (501) or disallow them in robots.txt (114) excluded; 450 sites out of 500 beyond rank 100,000, with no weighting. Foreign brands selling on a .fr domain are included, although some French obligations do not apply to them in the same way.
• The home page only, with no clicks: trackers set after acceptance, whether a refusal is respected and the checkout flow were not tested.
• A time window. A late banner or cookie is not seen: trackers are more likely underestimated.
• Google Consent Mode and cookieless requests are not counted; the configuration of potentially exempt measurement tools was not checked.
• Whether something is mentioned, not whether it complies. A named mediator may not be the competent one; a “complete notice” in the study’s sense does not amount to compliance with the LCEN. PDFs and text in images are not read: presence rates are lower bounds.
• One page per category. Legal notice details placed in the terms of sale may escape the measurement.
• Revisits. To correct the measurement, about a hundred sites had their home page visited 2 to 4 times; only the last complete measurement is kept.
• The manual review of the 604 sites relies on judgement, and every reason was logged.

How do I check my own online shop against the study?

Run the study’s checks on your own site: private browsing window, home page, no clicks, then a read-through of your legal pages. Each point links to the guide that explains how to fix it.

For everything else, the website compliance quiz runs through your site in a few questions, and our table of mandatory documents lists what your company must keep up to date.

Reusing the data: you may quote it freely, provided you credit Legalnest with a link to this page and keep, for each percentage, its numerator and denominator.