Legal obligations for dropshipping in France: terms of sale, GDPR and liability

Dropshipping is legal in France, but does not exempt the seller from e-commerce obligations. In practice, you remain the consumer's sole point of contact and assume full performance of the contract, even if a third-party supplier ships the goods. This is the consistent position reiterated by sector practitioners (Speed Ecom analysis; Dougs guide; HR Associés — professional guidance).

1) Legality of dropshipping: no special exemption regime

The model is permitted but subject to ordinary distance-selling law (pre-contractual information, withdrawal rights, statutory warranties, after-sales service, mediation, etc.). The dropshipper is legally the seller for orders placed on their website and cannot transfer obligations to the supplier (avocat‑ecommerce.fr — e-commerce legal guidance; CGV‑Expert — terms-of-sale guidance).

2) E-commerce terms of sale: 12 clauses to include (dropshipping specifics)

Your terms of sale must be accessible before purchase, accepted by clicking, and written clearly and understandably. Some clauses become critical in dropshipping (CGV‑Expert overview; Dougs — accounting guidance):

• Seller identity and contacts (postal address, email, telephone) and LCEN-compliant legal notices — coordinate with your dedicated page (complete legal notices guide).
• Fair product descriptions (non-misleading photos, essential characteristics, shipping country if it affects delivery times).
• Realistic delivery times (give ranges allowing for international shipping if needed; avoid standard timings that cannot be met in peak season). Specialist sources emphasise this in dropshipping (Speed Ecom — e-commerce guidance).
• Availability/stockouts (process if the supplier does not ship: refund, equivalent product by agreement, etc.).
• 14-day withdrawal right (arrangements, form, statutory exclusions: personalised products, opened hygiene seals, etc.).
• Returns and costs (return address, period, who bears costs — by default the consumer, unless you cover them and clearly say so).
• Statutory warranties (conformity and latent defects) and after-sales service: you are responsible, even if the supplier fails (avocat‑ecommerce.fr — e-commerce legal guidance).
• VAT-inclusive prices, information on VAT and customs duties to avoid surprises on delivery; define who pays what and include these costs when selling to French consumers (Stripe — Dropshipping and VAT in France; Dougs — accounting guidance).
• Payment arrangements (security, 3‑D Secure, instalments if applicable).
• Transfer of risk and retention of title (without depriving consumers of their rights).
• A proportionate limitation of liability consistent with mandatory law (statutory warranties cannot be excluded) — draft carefully using our good practice on limitation-of-liability clauses.
• Consumer mediation (contact details), governing law and competent court.

Drafting tip: clearly distinguish your consumer terms of sale from any website terms of use to avoid contradictions and strengthen proof of consent (differences between terms of use and terms of sale).

3) GDPR: the dropshipper is the controller

The seller collecting customer data (orders, delivery, support) is the controller under the GDPR. They must inform, secure, document and regulate recipients, including suppliers receiving data to ship products (donneespersonnelles.fr — personal data guidance; Dougs — accounting guidance; TLMR Avocats — legal guidance).

3.1 Privacy information, legal basis and cookies

• Clear privacy policy: purposes (contract performance, invoicing, fraud prevention, consent-based marketing), retention periods, individuals' rights. Use our GDPR privacy policy drafting guide.
• Legal basis: contract for sales and delivery; legitimate interest for fraud prevention; consent for marketing emails and non-essential cookies.
• Cookies: compliant banner (prior consent, evidence, granular settings).

3.2 Processors/suppliers and transfers outside the EU

• Your logistics suppliers processing customer data are processors requiring a Data Processing Agreement (DPA) with security, confidentiality and GDPR assistance obligations (donneespersonnelles.fr — personal data guidance).
• If data is transferred outside the EU, apply Standard Contractual Clauses (SCCs) and assess country risk, in accordance with good practice reiterated by practitioners (TLMR Avocats — legal guidance). For more on method, see our dedicated guide to data transfers outside the EU and SCCs.

3.3 Records, security and individuals' rights

• Maintain a record of processing activities (sales, delivery, customer service, marketing) and incidents. A practical model is available here: GDPR processing record template.
• Implement technical and organisational measures (HTTPS, encryption at rest at the host, access management, password policy, logging).
• Organise rights management (access, rectification, erasure, objection, restriction, portability) with dedicated deadlines and a contact point.

4) Seller liability: products, delivery times, VAT/customs

In B2C sales, the seller remains responsible for product conformity and safety (CE marking if required, specific prohibitions, instructions in French). Practitioners reiterate that this responsibility cannot be transferred to the supplier (avocat‑ecommerce.fr — e-commerce legal guidance; CGV‑Expert — terms-of-sale guidance).

On tax and customs, if selling to French consumers, you must collect VAT at the applicable rate and avoid hidden delivery charges; anticipate customs duties for shipments from third countries and include these costs in pricing (Stripe — VAT & dropshipping; Dougs — accounting guidance; HR Associés — professional guidance).

5) Case study (experience from practice)

In a recent matter, a dropshipping retailer advertised 5–7-day delivery while its supplier shipped from Asia (actual times: 15–25 days). The result: disputes, chargebacks and a supervisory authority warning on pre-contractual information. We revised its terms of sale (times by product and warehouse), added a clear returns policy, secured data transfers to the non-EU supplier through SCCs and implemented a GDPR processing record. After 3 months, the dispute rate fell by 62% and NPS doubled. This compliance work also prevented potential penalties mentioned by sector practitioners (Speed Ecom — e-commerce guidance; donneespersonnelles.fr — personal data guidance).

6) Execution checklist (30 days)

• Map flows (products, data, shipping countries) and classify suppliers (Day 1–Day 3).
• Draft/update legal notices and the privacy policy (Day 3–Day 7) — see our legal notices and GDPR privacy policy guides.
• Revise terms of sale with the 12 clauses above (Day 5–Day 12) and configure the acceptance journey.
• Set realistic delivery times by product/warehouse on the website (Day 8–Day 14).
• Sign DPAs with suppliers and include SCCs for non-EU transfers (Day 8–Day 15).
• Establish the processing record and a GDPR rights process (Day 10–Day 18) — use our template.
• Audit VAT/customs and update displayed VAT-inclusive prices and charges (Day 12–Day 20) with your accountants' help (see Stripe overview).
• Train customer support on withdrawal/warranties and evidence to retain (Day 15–Day 22).
• Test checkout (logs, consent evidence, pre-contractual information pages) and deploy (Day 20–Day 30).

Quick FAQ

Is dropshipping legal in France?

Yes, but without a special exemption regime: you bear all e-commerce obligations (terms of sale, withdrawal, warranties, GDPR, VAT), even if a third party ships (HR Associés — professional guidance).

Can I redirect the customer to the supplier after a breakdown?

No. You remain responsible to the consumer for statutory warranties and after-sales service (avocat‑ecommerce.fr — e-commerce legal guidance).

Must I inform the customer about customs duties?

Yes. In B2C, display a VAT-inclusive price without surprises and clearly state potential charges; failure to inform creates disputes and a risk of misleading practices (Stripe — payments and tax guidance).

Who is responsible under the GDPR when the supplier is outside the EU?

You are. Regulate the supplier through a DPA and, for non-EU transfers, use SCCs and assess country risks (TLMR Avocats — legal guidance; donneespersonnelles.fr — personal data guidance).

Need a quick audit? Structure your documents (terms of sale, notices, privacy policy) and data governance using our practical resources, then have a lawyer review them to manage your risks.