Selling CBD online in France entails specific civil and criminal liability. The seller is required to prove that each batch complies with the legal threshold of 0.3% THC in the finished product, to properly inform the consumer before any transaction, and to retain documentary evidence demonstrating this compliance at all times. Exceeding the THC threshold may result in prosecution for drug trafficking; incomplete pre-contractual information may result in administrative penalties from the DGCCRF.
The most important evidence to preserve first:
- Certificates of Analysis (COA) for each lot, issued by an independent accredited laboratory
- Supplier invoices and raw material data sheets
- Traceability records linking each batch sold to its corresponding COA
- Screenshots and archives of product pages, legal notices, and terms and conditions of sale
The practical takeaway: A seller who maintains a complete set of records, displays the mandatory LCEN disclosures on their website, and has taken out professional liability insurance significantly reduces their exposure to regulatory and criminal risks.
Table of Contents
- What is the legal framework that determines the legality of a CBD product in France?
- How to Prove Your Products' Compliance: COA, Traceability, and Record Keeping
- What disclosures must your e-commerce site include to be compliant?
- How Can We Protect Minors When Selling CBD Online?
- Advertising and Claims: What You Can Say and What to Avoid
- Civil and Criminal Liability: What Are the Risks, and What Insurance Should You Purchase?
- How can you prepare for a DGCCRF inspection and respond if goods are seized?
- Operational Checklist for Selling CBD Online in Compliance with Regulations
- Key Points
- Compliance: A Business Advantage as Much as a Legal Obligation
- Official sources and resources for further reading
What is the legal framework that determines the legality of a CBD product in France?
The legal status of CBD in France is based on several overlapping laws, and how they interact directly determines the seller's liability.
The 0.3% THC threshold has applied to the finished product since the decree of December 30, 2021, published in the Official Journal. This threshold applies to all products on the market, regardless of their form. Exceeding this limit in the finished product may result in criminal charges for drug trafficking, with penalties that can include a lengthy prison sentence and a very high fine under the Public Health Code.
The parts of the plant authorized for sale are the leaves and flowers, provided that the THC threshold is not exceeded. Seeds and fibers are also authorized. However, pure resin (hashish) remains classified as a narcotic regardless of its THC content.
| Product Category | Legal Status (France, 2026) | Main condition |
|---|---|---|
| CBD Flowers and Leaves | Approved | THC ≤ 0.3% in the finished product |
| CBD oils | Approved | THC ≤ 0.3% in the finished product |
| CBD cosmetics | Approved | Compliance with EU Cosmetics Regulations |
| CBD as a food or supplement | "Novel Food" Status (EU) | Prior authorization required under EU Regulation 2015/2283 |
| Pure resin (hashish) | Prohibited | Rated "Amazing" |
With regard to food products, the European regulation on novel foods requires prior authorization for any cannabis extract used as a food ingredient. In practice, this applies to CBD-based dietary supplements and infused edibles: selling these products without a valid authorization application exposes the seller to market withdrawal and administrative penalties.
The LCEN (Law No. 2004-575 of June 21, 2004) governs the disclosure obligations of online sellers, regardless of the product being sold. To learn more about who can sell CBD in France, the requirements for entering the industry are detailed in a dedicated guide.
How to Prove Your Products' Compliance: COA, Traceability, and Record Keeping
Product compliance cannot be merely claimed; it must be proven. A seller who cannot present an analysis certificate for each batch during an inspection finds themselves at a disadvantage, even if their products are objectively compliant.
Required documents per batch:
- Certificate of Analysis (COA): Issued by an accredited laboratory (ISO 17025 standard), it must list the THC and CBD levels and, ideally, any contaminants (pesticides, heavy metals, mycotoxins, solvent residues).
- Supplier Data Sheet: Hemp variety used, geographic origin, extraction method
- Purchase invoice: including the supplier’s full identification, lot number, and quantity
- Contaminant report: separate analysis or analysis integrated into the COA, covering at least pesticides and heavy metals
Pro tip: Always request a COA dated within the last six months for each new batch received. An older certificate does not guarantee that the delivered batch complies with regulations. Some French laboratories, such as Phytocontrol and Eurofins Cannabis, offer comprehensive analyses that comply with French regulatory requirements.
Documentation must be organized in such a way as to allow for immediate access in the event of an audit. A digital filing system organized by lot number, with a cross-reference file linking each product reference to its COA, is the most effective method. The recommended retention period is at least five years for commercial documents, in line with civil and tax statutes of limitations.
One aspect that is often overlooked is private labeling. According toArticle 1245-6 of the Civil Code, a seller who markets a product under its own brand is considered equivalent to the manufacturer and bears full liability for defective products, including bodily injury caused by undetected contaminants. This means that a retailer who applies its own label to a product purchased in bulk cannot shift liability to its supplier in the event of a dispute.
Within the supply chain, the rules governing payments between businesses set a cap of €1,000 for cash payments. Exceeding this threshold with a supplier can trigger a tax audit and compromise the compliance of the supply chain’s documentation.
What disclosures must your e-commerce site include to be compliant?
The LCEN and consumer protection laws require that any website selling CBD display a set of disclosures; failure to do so may result in administrative penalties and contractual disputes.
Mandatory Legal Notices (LCEN):
- Full company name, legal form, and RCS number
- Address of the corporate headquarters and contact information (phone, email)
- Intra-Community VAT Number
- Name of the website host
Mandatory Precontractual Information:
- Price per product, including tax; shipping costs are either included or clearly stated
- Shipping Terms (Delivery Times, Carriers, Service Areas)
- Accepted Payment Methods
- 14-day right of withdrawal with a standard form available
- Return Policy and Refund Terms
The general terms and conditions of sale (GTC) must include clauses specific to the nature of the product: a statement that the products are intended for adults only, a clause regarding regulatory compliance with a reference to Certificates of Analysis (COAs) available upon request, and a procedure for handling non-compliant batches. For an overview of the detailed obligations under consumer law, the article on CBD and consumer law elaborates on these points.
On social media, there are two sets of requirements: platform-specific rules apply in addition to consumer protection laws. A sales post on Instagram or Facebook must link to a comprehensive page containing all legal disclosures, since it is technically impossible to display them in full in a short-form post. Keeping time-stamped screenshots of these posts serves as evidence in the event of a dispute.
How Can We Protect Minors When Selling CBD Online?
No standalone law explicitly prohibits the sale of CBD to minors in France, but the authorities expect sellers to implement reasonable age verification measures. The DGCCRF examines this issue during its inspections, and the absence of such measures may be considered an aggravating factor.
Age verification methods suitable for e-commerce:
- Age verification portal: simple but not very legally robust; should be supplemented by other measures
- Verification upon delivery: instructing the carrier to check identification; effective but depends on the service provider
- Third-party identity verification solutions (Yoti, Veriff, Onfido): online document verification before order confirmation; higher level of security
- Explicit statements on each product page: a visible warning indicating that the product is intended for adults only
Pro tip: Document your age verification process in your Terms and Conditions and in an internal policy. In the event of an audit, being able to demonstrate that you have implemented a reasonable procedure—even if it’s not perfect—offers much greater protection than having no measures in place at all. For detailed best practices, see the guide on age verification for CBD shops.
Under the GDPR, the collection of personal data for age verification must comply with the principle of data minimization: collect only what is strictly necessary, do not retain the data beyond the transaction, and inform the user about its processing in the privacy policy.
Advertising and Claims: What You Can Say and What to Avoid
Therapeutic claims are strictly prohibited for CBD products. Presenting a product as capable of “treating,” “curing,” or “relieving” a medical condition constitutes false advertising under the Consumer Code and may trigger proceedings by the DGCCRF.
Prohibited phrases (examples):
- "Relieves chronic pain"
- "Treats anxiety and depression"
- "Recommended for insomnia"
- "Clinically proven anti-inflammatory effect"
Acceptable phrasing (examples):
- "Product made from organic hemp, THC content ≤ 0.3%"
- "Natural terpenes flavoring"
- "Tested in an accredited laboratory — COA available"
- "Product intended for adults"
The rules vary by channel. On an e-commerce site, product descriptions must be written carefully, and prohibited claims must be clearly excluded. On social media, platform algorithms may flag or remove cannabis-related content—even if it is legal—which creates a risk of being delisted in addition to legal risks. On marketplaces, contractual terms generally transfer legal liability to the third-party seller: a general-purpose platform will not cover the seller in the event of a dispute related to a non-compliant claim.
If you receive a formal notice regarding illegal advertising, the recommended course of action is to immediately cease distribution of the offending content, keep a copy of the formal notice, and consult a specialized attorney before providing any written response to the authorities.
Civil and Criminal Liability: What Are the Risks, and What Insurance Should You Purchase?
The distinction between civil liability and criminal liability is fundamental for an online CBD seller.
Product liability covers damages caused to a customer or a third party by a defective product: contamination, incorrect labeling, or an adverse reaction due to an undetected contaminant. Liability may arise even in the absence of intentional wrongdoing, based on the principle of liability for defective products.
Criminal liability generally arises when the THC content in the finished product exceeds 0.3 percent, which can lead to prosecution for drug trafficking. Criminal liability may also arise for false advertising, misrepresentation of goods, or endangering others.
Checklist for Your Professional Liability Insurance Policy:
- Coverage for bodily injury caused by a product (contamination, adverse reaction)
- Coverage of Criminal Defense Costs
- Product Recall Guarantee and Stock Destruction Costs
- Coverage for Intangible Damages (loss of customer revenue due to a product defect)
- Verify that the exclusion for regulatory noncompliance does not apply if you have your COAs
- Deductible amount tailored to your sales volume
- Extension to white-label activities if you market products under your own brand
A seller who markets products under their own brand cannot hide behind their supplier in the event of damage: Article 1245-6 of the Civil Code treats such a seller as the manufacturer, with all the consequences that entails in terms of the burden of proof and the scope of liability. The tax treatment applicable to the sale of CBD (VAT at the standard rate of 20%, applied as a precaution) is in addition to these obligations and must be included in the accounting records from the very start of the business.
How can you prepare for a DGCCRF inspection and respond if goods are seized?
The DGCCRF has stepped up its inspections of the CBD sector. Knowing how to anticipate and respond to these inspections is part of the operational skills of a responsible seller.
- Compile a compliance file for each batch that can be accessed in less than 30 minutes: Certificate of Analysis (COA), supplier invoice, technical data sheet, and traceability log.
- Make sure your product pages match the batches in stock exactly: any discrepancy between the labeling and the COA submitted weakens your position.
- Store documents digitally on a secure platform (a cloud server with restricted access) and keep a physical copy of key documents.
- Appoint an internal contact person responsible for handling audits: this person must know the location of all documents and have received clear instructions on the procedure to follow.
- In the event of an on-site inspection: cooperate fully, provide the requested documents, note the inspectors’ identities and the time of their visit, and do not sign any report without reading it in its entirety.
- In the event of a seizure or a formal notice: immediately contact an attorney specializing in health law or commercial law before making any public statements or providing any written response to the authorities.
- Limit public statements during the proceedings: any public statement may be used in administrative or judicial proceedings.
Pro tip: Penalties for the illegal sale of CBD can be significantly reduced when the seller provides comprehensive evidence of compliance. Case law shows that strong documentary evidence has led to acquittals or reduced sentences. Record-keeping isn’t just an administrative formality—it’s your first line of defense. To understand in detail how authorities regulate CBD products, a dedicated guide outlines their powers and procedures.
Operational Checklist for Selling CBD Online in Compliance with Regulations
Here are the step-by-step procedures to follow to ensure your business complies with regulations, from compiling the supplier file to daily maintenance.
Phase 1: Compiling the Basic File
- Select your suppliers by requiring a Certificate of Analysis (COA) for each lot, a complete technical data sheet, and a named invoice
- Verify that each COA comes from an ISO 17025-accredited laboratory and explicitly states the THC content of the finished product
- Create a digital traceability record linking each batch to its COA and sales
Phase 2: Bringing the site into compliance
- Draft or update your legal notices (LCEN), terms and conditions, and privacy policy with the help of a legal advisor
- Verify that each product listing displays the CBD/THC ratio, the origin, the lot number, and a link to the corresponding COA
- Implement an age verification system at the site entrance or at the time of ordering
Phase 3: Insurance and Tax Coverage
- Purchase professional liability insurance that covers product-related bodily injury and criminal defense costs
- Apply the standard VAT rate of 20% to your sales and maintain separate, traceable accounting records
Ongoing maintenance:
- Quality control upon each batch receipt: visual inspection, cross-checking against the COA, immediate archiving
- Quarterly review of regulatory texts (decrees, ANSES decisions, case law) via Légifrance and DGCCRF publications
- Updating product sheets and legal notices whenever regulations change
- Annual consultation with a legal specialist for a compliance audit
To learn more about the steps involved in getting started, the guide on how to start selling CBD details the practical steps for sourcing products and setting up your business.
Key Points
The liability of online CBD sellers rests on three inseparable pillars: the chemical compliance of each batch (THC ≤ 0.3%), supporting documentation (COA, traceability, invoices), and compliance with the disclosure requirements imposed by the LCEN and consumer law.
| Point | Details |
|---|---|
| THC Threshold in the Finished Product | Each batch must contain no more than 0.3% THC; exceeding this limit may result in criminal prosecution for drug trafficking. |
| COA Required for Each Lot | An ISO 17025-accredited certificate of analysis for each batch is the key piece of evidence in the event of a DGCCRF inspection. |
| LCEN Disclosures on the Website | Full company information, prices including tax, a 14-day right of withdrawal, and specific CBD terms and conditions are required on all online storefronts. |
| Private label = manufacturer's liability | Selling under one's own brand equates the seller with the manufacturer (Article 1245-6 of the Civil Code) and extends the seller's liability to bodily injury. |
| Professional Liability Insurance Is Essential | A policy covering bodily injury, criminal defense, and product recall is the minimum protection needed to operate with peace of mind. |
Compliance: A Business Advantage as Much as a Legal Obligation
Compliance is often reduced to an administrative burden. This is a misguided perspective. A robust documentation system, COAs available on every product sheet, and clear legal notices—all of these build credibility that customers recognize, even without knowing the technical details.
The CBD market in France is undergoing a period of regulatory consolidation. Sellers who invested in their compliance infrastructure from the outset are the ones best equipped to weather inspections and legislative changes, particularly the uncertainties surrounding the 2026 Finance Bill and the status of novel foods. Those who have postponed these investments now face urgent and costly compliance requirements.
Pure-extract-cbd has chosen transparency in documentation as the foundation of its offerings: each product comes with its laboratory test results, and supplier traceability is integrated into the procurement process. This isn’t just a response to regulatory requirements. It also allows customers to make informed choices and gives sellers peace of mind.
Official sources and resources for further reading
Legislative and Regulatory Texts:
- Légifrance — Decree of December 30, 2021 (THC threshold of 0.3%)
- Légifrance — Article 1245-6 of the Civil Code (product liability)
- Légifrance — LCEN (Law No. 2004-575 of June 21, 2004)
- EUR-Lex — EU Regulation 2015/2283 on novel foods
- European Commission — Novel Food Authorizations (CBD)
Regulatory Authorities and Practical Resources:
- DGCCRF — Official Website of the Ministry of the Economy
- Public Service — E-commerce Obligations and Right of Withdrawal
- Drogues.gouv.fr — Recommendations on the Protection of Minors
- EFSA — Scientific Assessments on Cannabinoids
Pure-extract-cbd Internal Resources:
| Resource | Contents |
|---|---|
| Prohibited Claims in CBD Marketing | 2026 Guide to Compliant and Prohibited Formulations |
| Age Verification at a CBD Shop | Technical and Legal Best Practices |
| Government Inspections of CBD Products | Audit Procedures and Documents to Prepare |
| CBD and Consumer Law | Labeling, Information, and Detailed Legal Requirements |
| The CBD Market and the 2026 Budget Bill | Analysis of Ongoing Regulatory Changes |
To discover CBD products, each batch of which comes with its own accredited certificate of analysis, check out the selection of CBD flowers available on Pure-extract-cbd, or browse the entire catalog of compliant products.
This guide provides general legal information and is not a substitute for advice from a legal professional. For any specific situation, consult a specialized attorney or review the applicable laws on Légifrance.
