eCommerce & Marketplaces Compliance in France
How DSA seller traceability, criminal penalties for unchecked sellers, DAC7 tax reporting and product-specific age checks shape identity checks for marketplaces in France.
Key takeaways
- Selling online in France needs no special e-commerce licence, but a marketplace must check who its sellers are (name, contact details, an identity document or electronic ID, payment account and company registration) before they can list anything.
- In France, a marketplace that fails to do these seller checks commits a criminal offence: up to two years' imprisonment and a fine of €300,000, which can rise to 6% of worldwide turnover for a company.
- Platforms that pay out to sellers must also collect sellers' tax details, report their sales to the tax authority every year by 31 January, and close the account of a seller who still refuses to provide the data after two reminders.
- Most online shops are not covered by anti-money laundering (AML) law. The exceptions are sellers of art, antiques, jewellery, watches, precious metals or other goods paid for in cash or e-money above €10,000, which must identify the customer and report suspicions.
- Age checks depend on the product: adult sites must use an independent age-verification provider that meets the regulator's technical standard (sites based elsewhere in the EU only once the government designates them), alcohol sellers must obtain proof of majority, and tobacco may not be sold online at all. A general ban on social media for under-15s was struck down in August 2026 and is not law.
France is open to online retail and to marketplaces from anywhere in the European Union, and most of the rules come from EU regulations that apply directly: the Digital Services Act (DSA) for platforms, the General Product Safety Regulation for product listings and the Directive on administrative cooperation (DAC7) for platform tax reporting. French law adds criminal sanctions, consumer-code duties and its own age-verification regime.
The principal regulators are the Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), which enforces consumer law and the DSA marketplace rules against platforms established in France; the Autorité de régulation de la communication audiovisuelle et numérique (Arcom), the national Digital Services Coordinator and age-verification regulator; and the Commission nationale de l'informatique et des libertés (CNIL) for personal data.
The biggest obstacle for a new marketplace is operational: building a seller onboarding flow that collects, checks and keeps the DSA traceability data and the DAC7 tax data before the first listing goes live, while keeping buyer-side age checks proportionate.
1. Who regulates this sector
| Regulator | Remit for e-commerce | Level | Official site |
|---|---|---|---|
| DGCCRF | Consumer code, distance selling, product safety online; DSA marketplace obligations for platforms established in France | National | economie.gouv.fr/dgccrf |
| Arcom | Digital Services Coordinator; age verification for pornographic content; blocking orders | National | arcom.fr |
| CNIL | Data protection, including age-verification and identity data; DSA competent authority in its field | National | cnil.fr |
| European Commission | DSA supervision of very large online platforms; EU age-verification framework | Supranational | DSA on EUR-Lex |
| Tracfin | Financial intelligence unit; receives suspicious transaction reports from AML-obliged sellers | National | economie.gouv.fr/tracfin |
| ANSM and Ordre national des pharmaciens | Online sale of medicines; list of authorised pharmacy websites | National | ansm.sante.fr |
The tax administration (Direction générale des finances publiques) receives platform reports, and customs supervises AML compliance by art, antiques, precious-metal and auction businesses (Code monétaire et financier (CMF), article L561-36).
2. Licensing and authorisation
There is no general licence to sell goods online or to operate a marketplace in France. Obligations attach instead to the activity and the product:
- Marketplaces and comparison sites owe consumers fair, clear and transparent information on their terms, ranking criteria, paid relationships that influence ranking, and whether the counterparty is a professional or a private seller (Code de la consommation, article L111-7, version in force since 17 February 2024).
- Platforms that enable sales between users must give sellers information on their tax and social security obligations at each transaction (Code général des impôts, article 242 bis) and report seller data annually (articles 1649 ter A to E).
- Medicines may be sold online only from the website of a licensed pharmacy, only by its pharmacist, and only for medicines not subject to prescription; the site requires prior declaration to the regional health agency (Code de la santé publique, articles L5125-33 to L5125-36). The Ordre national des pharmaciens publishes the list of authorised sites (869 at its 28 October 2026 update).
- Manufactured tobacco may not be sold or bought at a distance to, from or within France (Code de la santé publique, article L3512-14-1, in force since 1 July 2025).
Collecting buyers' payments for sellers as a regular business is a payment service reserved to authorised providers (CMF article L521-2). The commercial-agent exclusion covers only an intermediary authorised to negotiate or conclude sales for the payer alone or the payee alone (L314-1, III, 3°), so a marketplace acting for both sides needs its own authorisation or a licensed payment provider, which is itself AML-obliged (L561-2, 1° bis and 1° ter).
3. AML, KYC and customer due diligence
A retailer or marketplace is not, as such, an obliged entity under French AML law. The list in CMF article L561-2 (version in force since 5 August 2026) brings specific sellers into scope:
| Seller | Trigger | Provision |
|---|---|---|
| Art and antiques dealers and intermediaries | Transaction or linked transactions of €10,000 or more | L561-2, 10° |
| Watch, jewellery and silverware traders | Goods worth more than €10,000 | L561-2, 11° |
| Any trader in goods | Payments in cash or e-money above €10,000 per operation or linked operations | L561-2, 11°; D561-10-1 |
| Precious metals and stones traders | Transaction or linked transactions of €10,000 or more | L561-2, 11° bis |
| Voluntary auction operators | Transaction or linked transactions of €10,000 or more | L561-2, 14° |
An obliged seller must identify the customer (for a natural person: surnames, first names, date and place of birth, under R561-5) and verify identity under R561-5-1 or R561-5-2, keep records for five years after the relationship ends (L561-12), and report suspicions to Tracfin (L561-15). For occasional customers, verification is required before the operation when it is settled in cash or e-money above €10,000, exceeds €15,000 in any other form, or is suspicious (R561-10). Customs supervises art, antiques, precious-metal and auction businesses; DGCCRF agents inspect the 11° traders (L561-36 and L561-36-2). The Commission nationale des sanctions can impose warnings, temporary bans and fines of up to €5 million or twice the benefit obtained (L561-40).
Separately from AML scope, every merchant is bound by the cash payment ceiling: €1,000 in cash and €3,000 in e-money when the payer is resident in France for tax purposes or acts for business purposes, and €15,000 for a non-resident consumer paying an obliged person (CMF D112-3). Asset-freeze measures bind every legal person established in France or carrying out an operation there, not only obliged entities: they must be applied without delay and reported to the Minister of the Economy (CMF L562-4). The Treasury publishes the national freeze register for screening.
4. Identity verification and onboarding
On a marketplace, the identity obligation runs mainly to the seller, not the buyer. Article 30 of the DSA (Regulation (EU) 2022/2065, applicable since 17 February 2024) requires any online platform that lets consumers conclude distance contracts with traders to obtain, before a trader may offer products or services to consumers in the EU:
- name, address, telephone number and email address;
- a copy of the trader's identification document, or any other electronic identification as defined in Article 3 of the eIDAS Regulation (EU) 910/2014;
- payment account details;
- trade register and registration number, where the trader is registered;
- a self-certification that the trader will offer only products or services that comply with EU law.
The platform must make best efforts to assess whether the information is reliable and complete, using freely accessible official online databases or interfaces of a Member State or the EU, or supporting documents from reliable sources. It must request correction when it has indications that data are inaccurate and swiftly suspend a trader who fails to correct them. Name, contact details, registration and self-certification must be displayed to buyers on the product page. Micro and small platforms are excluded from these duties (Article 29). In France, the national business register (Registre national des entreprises) is kept and disseminated by the INPI; beneficial-owner data there have been restricted since 31 July 2024 to supervisors, AML-obliged persons and people showing a legitimate interest.
The DAC7 tax layer runs in parallel. Under CGI article 1649 ter D, the platform must collect each seller's tax residence and tax identification number, verify the reliability of what it collects, and keep a register of its steps for ten years. Sellers of goods with fewer than 30 sales totalling no more than €2,000 in the reporting period are not reportable (1649 ter C).
On the buyer side, the Commission's guidelines on DSA Article 28 (C/2025/5519, adopted 2 July 2025) consider age verification appropriate for platforms selling alcohol, tobacco or nicotine products, or giving access to pornographic or gambling content. They describe verification as a separate process that should not let the platform store more than the user's age group, and point to anonymised age tokens issued by an independent third party.
For AML-obliged sellers the methods are prescribed: an electronic identification means at eIDAS "substantial" or "high" level, or the original photo document when the customer is present (CMF R561-5-1); otherwise at least two complementary measures, such as a document copy plus a first payment from an account in the customer's name, or a remote identity-verification service certified by the Agence nationale de la sécurité des systèmes d'information (ANSSI) (R561-5-2).
5. Digital channels: what's different
Bottom line: selling through an online platform adds duties that have no shop-counter equivalent: seller traceability before the first listing, platform tax reporting, a one-click withdrawal function and, for adult content, certified independent age verification.
| Requirement | In person / land-based | Online / remote | Difference |
|---|---|---|---|
| Seller identity checks | No intermediary duty | Marketplace collects and checks trader data before listing (DSA Art. 30) | Differs |
| Seller tax reporting | None | Annual platform report on sellers (CGI 1649 ter A) | Differs |
| Alcohol to minors | Sale banned; seller demands proof of majority (CSP L3342-1) | Same statutory rule; Commission guidelines expect platforms to use age verification | Differs |
| Tobacco | Sale with proof of majority | Distance sale prohibited (CSP L3512-14-1) | Differs |
| Medicines | Pharmacy counter, prescription and non-prescription | Non-prescription only, from authorised pharmacy sites | Differs |
| Pornographic content | Offence to expose minors, any medium (Code pénal 227-24) | Arcom technical standard, independent provider, double anonymity | Differs |
| Withdrawal right | Statutory withdrawal regime covers only distance and off-premises contracts (L221-1) | 14 days, plus an online withdrawal function since 19 June 2026 | Differs |
| AML thresholds for high-value goods | €10,000 triggers (L561-2; R561-10) | Same triggers; no online-specific rule | Same |
Seller traceability is a platform duty
A marketplace must know who sells through it before the first offer (DSA Article 30), backed in France by criminal penalties (L133-1). An eIDAS electronic identification can replace the document copy, so the flow can be fully electronic.
Age verification depends on content and product
For pornographic content, law n° 2004-575 (article 10, as amended by law n° 2024-449, the "SREN" law) requires sites to show no explicit content until age is verified, using systems that meet Arcom's technical standard. Arcom's October 2024 standard requires a provider legally and technically independent of the site, bars the site from collecting identity or date of birth, requires a "double anonymity" option after a transition period and state-of-the-art liveness and deepfake resistance for facial estimation, and ends a verification with the session or after an hour of inactivity. Under article 227-24 of the Code pénal, a minor's simple declaration of being 18 does not prevent the offence. For alcohol, proof of majority is required but no online method is prescribed.
These adult-content rules apply directly to sites established in France or outside the EU. A site established in another EU Member State is covered only once a ministerial arrêté designates it (law n° 2004-575, article 10-2). The arrêté of 26 February 2025 designates 17 services, including Pornhub, xHamster, XVideos and LiveJasmin, bound since 6 June 2025. On 16 June 2026 the Court of Justice of the EU held that France may not apply a general criminal-law obligation to providers established in other Member States, but may, case by case under the e-Commerce Directive's derogation procedure, require a given service to introduce age verification (Joined Cases C-188/24 and C-190/24).
One-click withdrawal
Since 19 June 2026, any distance contract concluded through an online interface must offer a free withdrawal function (Code de la consommation L221-21, amended by ordonnance n° 2026-2). Décret n° 2026-3 (article D221-5) requires it to be labelled "renoncer au contrat ici" or equivalent, visible throughout the withdrawal period, with a "confirmer la rétractation" step and an acknowledgement on a durable medium.
Pending
Commission Recommendation (EU) 2026/1035 [Adopted, non-binding] asks Member States to offer an EU age-verification solution by 31 December 2026, as an app or in the European Digital Identity Wallet.
6. Data protection and biometrics
The General Data Protection Regulation and law n° 78-17 (Informatique et Libertés) apply to every check, and CGI article 1649 ter D expressly subjects DAC7 processing to law n° 78-17. Each data set has its own rule:
| Data | Rule | Source |
|---|---|---|
| DSA trader data | Store securely; delete six months after the relationship ends | DSA Art. 30(5) |
| DAC7 register | Keep for ten years | CGI 1649 ter D |
| Copies of identity documents | Keep only where the law requires it or as evidence for disputes, for at most six years; reduce image quality or add a watermark with the collection date and the organisation's name | CNIL reference framework on commercial activities (deliberation n° 2021-131) |
| Stored payment cards | Separate prior consent to keep a card for later purchases (accepting the terms of sale is not enough); security code never kept after the first transaction; card number and expiry date kept 13 months for disputes (15 for deferred-debit cards) | CNIL deliberation n° 2018-303 |
| Minors' consent | A minor can consent alone from 15; below 15, jointly with a parent | Law n° 78-17, art. 45 |
| Detecting minors | No obligation to process additional personal data to work out whether a user is a minor | DSA Art. 28(3) |
| Age checks under DSA Art. 28 | Art. 28 can be a legal basis (GDPR Art. 6(1)(c)) only where the check is necessary and proportionate; on that basis alone, avoid mechanisms that identify the user, such as uploading a government ID; record only whether the user meets the condition, not the age or age range; avoid biometric identification, especially of children | EDPB Guidelines 3/2025 on the DSA and the GDPR, v2.0, paras 99 to 101 |
| Age assurance in general | Use the least intrusive effective method, carry out an impact assessment before processing, and keep no record of the data used once age is verified | EDPB Statement 1/2025 on age assurance, paras 13 and 36 |
Biometrics
In its recommendation on multi-factor authentication (20 March 2025), the CNIL states that, unless a legal norm requires or expressly authorises it, biometrics is possible only with the person's consent, cannot be imposed without an alternative, and should rely on templates kept on devices under the person's exclusive control. For age checks, it rejects comparing a selfie with an identity-document photo, considers facial recognition disproportionate, and accepts facial age estimation only through a trusted third party, preferably on the user's device. In July 2025 it judged age-estimating cameras in tobacco shops disproportionate, since the seller must still obtain proof of age, and its opinion n° 2024-067 on Arcom's standard favours age proofs users keep locally.
7. Sector-specific obligations
Compliance by design and product safety
Marketplaces must design their interface so traders can give pre-contractual and product-safety information (DSA Article 31). Under the General Product Safety Regulation (EU) 2023/988, applicable since 13 December 2024, online marketplaces must register on the Safety Gate Portal, designate single points of contact for authorities and consumers, and act on orders to remove dangerous product offers within two working days (Article 22).
Platform tax reporting (DAC7)
Platform operators resident or established in France, or non-EU operators that choose France, report by 31 January each seller's identification, residence, quarterly consideration, transaction count, fees retained and payout account (CGI 1649 ter A and B). A seller who ignores two reminders is closed after at least 60 days and barred from re-registering (1649 ter D).
8. Risk indicators and red flags
Marketplace seller and payment red flags
- Unverifiable trader: registration number absent from the official business register or details that do not match it.
- Payment account mismatch: payout account held by someone other than the seller, which DAC7 requires the platform to identify.
- Data refusal: seller ignores repeated requests for tax residence or identification data.
- Cash or e-money split: linked payments structured around the €10,000 AML trigger or the €1,000 cash ceiling.
- Listed person: seller or beneficial owner matching an entry in the national freeze register.
- Dangerous or banned goods: listings matching products already flagged as unsafe, or tobacco offered for distance sale.
- Unlicensed pharmacy: medicines offered by a site absent from the Ordre national des pharmaciens list.
9. Enforcement and penalties
| Breach | Maximum penalty | Basis |
|---|---|---|
| Marketplace breach of DSA Articles 25, 30, 31 or 32 | Two years' imprisonment and €300,000, raised in proportion to the benefit up to 6% of worldwide turnover for a company; activity bans up to five years | Code de la consommation L133-1, L133-3 |
| Non-compliance after DGCCRF referral | Court injunction with a daily penalty of up to 5% of average daily worldwide turnover | L133-2 |
| Platform information duties | Administrative fine of €75,000 (individual) or €375,000 (company) | L131-4 |
| Withdrawal-right breaches | €15,000 or €75,000; up to 4% of average annual turnover in EU-wide cases | L242-13, L242-14-1 |
| Adult site not complying with Arcom's standard after formal notice | €150,000 or 2% of worldwide turnover (€300,000 or 4% if repeated) | Law 2004-575, art. 10 |
| Adult site letting minors access content after formal notice | €250,000 or 4% of worldwide turnover (€500,000 or 6% if repeated), plus blocking by internet providers | Law 2004-575, art. 10-1 |
| Making pornographic content accessible to minors | Three years' imprisonment and €75,000 | Code pénal 227-24 |
| Platform failing to file the DAC7 report or run seller due diligence | Fixed fine of up to €50,000; non-EU operators can lose their registration | CGI 1736 XI, 1740 E |
| AML failures by obliged sellers | Up to €5 million or twice the benefit, bans | CMF L561-40 |
On 3 July 2025 the DGCCRF announced a €40 million fine against Infinite Style E-commerce Ltd, which sells SHEIN-brand products, for misleading price reductions and environmental claims; on 1 September 2025 the CNIL fined Infinite Styles Services Co. Limited, which runs shein.com in Europe, €150 million for placing advertising cookies without valid consent. After the Conseil d'État refused to suspend the 26 February 2025 arrêté (17 April and 15 July 2025), Arcom gave five designated services, including xHamster and XVideos, three weeks to stop minors' access on 1 August 2025, finding a simple declaration of majority insufficient (decisions n° 2025-558 to 2025-562); similar notices continue, such as n° 2026-461 of 22 September 2026.
10. Recent changes and what to watch
- 10 July 2027[Adopted, applies 10 Jul 2027] The EU AML Regulation (EU) 2024/1624 makes traders in high-value goods obliged entities (Annex IV: jewellery and watches above €10,000, cars above €250,000, aircraft and boats above €7.5 million) and caps cash payments at €10,000; France's lower ceilings stay.
- 24 August 2026[Struck down by Conseil constitutionnel] Law n° 2026-813 was promulgated without its article 1, the ban on social media for under-15s, which decision n° 2026-911 DC of 14 August 2026 held unconstitutional, partly because it required everyone to prove their age without legal guarantees. No general age gate for social features applies.
- 16 June 2026[Final judgment] The Court of Justice of the EU (C-188/24 and C-190/24) confirms that adult sites established elsewhere in the EU can be bound only through case-by-case designation; the Conseil d'État has not yet ruled on the merits of challenges to the 26 February 2025 arrêté (as of October 2026).
- 19 June 2026[In force] Online withdrawal function mandatory for distance contracts concluded through an online interface (L221-21, D221-5).
- 8 May 2026[Adopted, non-binding] Commission Recommendation (EU) 2026/1035 on EU-wide age-verification technologies: national solutions due by 31 December 2026, which may give merchants a standard way to receive proof of age.
- 1 July 2025[In force] Distance sale of manufactured tobacco prohibited (CSP L3512-14-1).
- 6 June 2025[In force] Age verification binds the 17 EU-established adult services designated on 26 February 2025.
11. What this means for identity verification
- Verify sellers before go-live. Collect DSA Article 30 data and DAC7 tax data in one onboarding flow; accept an identity document copy or eIDAS electronic identification.
- Check against official sources. Match company details to the national business register and keep evidence of the checks for the relevant retention period (six months after exit for DSA data, ten years for the DAC7 register).
- Re-verify on triggers. Indications of inaccurate data require a correction request and suspension if not fixed; payout account changes and DAC7 reminders are natural re-verification points.
- Separate age assurance from identity. For adult content, the site must not see identity data; route checks through an independent provider meeting Arcom's standard, with liveness and deepfake resistance where faces are used. Elsewhere, keep only the pass or fail result and plan for anonymised age tokens and the EU age-verification solution.
- Offer a non-biometric route. Because the CNIL treats biometrics as consent-based and not to be imposed without an alternative, pair selfie and liveness checks with a document- or eID-based path.
- Apply AML methods only where in scope. High-value, art and precious-metal sellers use the CMF methods (eIDAS substantial or high, or two complementary measures) and keep records for five years.
How Identomat helps
Identomat runs identity verification, screening and monitoring for regulated businesses on one platform, with workflows you configure for each market. For the requirements in this guide, that means:
- Marketplace seller onboarding (KYB and beneficial owner verification) that collects and checks the trader data required before a first listing.
- ID document capture and verification, including NFC, with face match and biometric liveness for sellers who verify remotely.
- Age verification for age-restricted products and content, configurable to the method each product requires.
- AML screening against sanctions and asset-freeze lists at onboarding and through ongoing monitoring.
- No-code workflow builder and an audit trail that support separate retention rules for each data set.
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
Yes. Under Article 30 of the EU Digital Services Act, a platform that lets consumers buy from traders must collect each trader's contact details, an identity document copy or electronic ID, payment account, registration number and a compliance self-certification before the trader can sell, and make best efforts to check them. In France, failing to do so is a criminal offence punishable by two years' imprisonment and a fine of up to 6% of worldwide turnover. Micro and small platforms are exempt.
Generally no. A retailer or marketplace is not an obliged entity under the Code monétaire et financier unless it trades in art, antiques, precious metals, high-value jewellery or watches above €10,000, runs voluntary auctions, or accepts cash or e-money payments above €10,000. Those businesses must identify and verify customers, keep records for five years and report suspicions to Tracfin. From July 2027 the EU AML Regulation adds traders in high-value goods.
It depends on the product. Pornographic sites must use an independent provider meeting Arcom's technical standard, including a double-anonymity option. Alcohol sellers must obtain proof of majority, without a prescribed online method. Tobacco cannot be sold online at all, and medicines only as non-prescription products from authorised pharmacies. A general ban on social media for under-15s was struck down by the Conseil constitutionnel in August 2026.
Get the PDF guide
Enter your details and the download button will switch on.