DGCCRF 2026: new control rules for dropshippers and e-commerce sellers

A DGCCRF control of a dropshipping store triggers two regimes. Administrative fines first: up to EUR 75,000 for a company when pre-contractual information is missing (art. L242-10). Criminal penalty next: a misleading commercial practice committed online carries 5 years' imprisonment and a EUR 750,000 fine (art. L132-2), i.e. EUR 3,750,000 for a company.

In 2025-2026, DGCCRF controls intensify markedly on online stores. Earlier national investigations (notably the 2019 DGCCRF national investigation service inquiry on 12 dropshipping professionals) had already concluded with 8 criminal proceedings and individual fines ranging from EUR15,000 to EUR80,000. The 2026 context cumulates three aggravating factors: the EU General Product Safety Regulation (GPSR), Regulation (EU) 2023/988, applicable since 13 December 2024; the Digital Services Act (DSA), Regulation (EU) 2022/2065, applicable since 17 February 2024; and, since 1 July 2026, the end of the customs duty relief on consignments worth EUR 150 or less, replaced by a flat customs duty of EUR 3 per item line (Council Regulation (EU) 2026/382 of 11 February 2026). On top of this comes the tax transparency imposed by DAC7.

Cabinet Hayot Expertise in Paris explains the applicable legal framework, the most frequent sanction motives and our 8-point compliance method to bring your store up to standards in under 30 days.

The DGCCRF (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes) is the administration enforcing the French consumer code. Its scope covers:

• Pre-contractual information: incl.-VAT prices, shipping fees, real delays (art. L221-5 Code conso)
• Mandatory T&Cs: seller identity, payment terms, withdrawal right, warranty (art. L221-5 for pre-contractual information, art. L221-13 for confirmation on a durable medium)
• Misleading commercial practices: fake scarcity (deemed misleading in all circumstances, art. L121-4, 7°), misleading struck-through prices, false promotions (art. L121-1 and following)
• 14-day withdrawal right (art. L221-18 and following)
• Consumer mediation: mandatory mediator to mention (art. L612-1)
• Country of origin: if confusion possible (Made in EU vs CN), mandatory mention

Any online store selling to a French consumer, even hosted abroad, is subject to DGCCRF.

1. Hidden or misleading delivery times#

#1 motive in dropshipping. Announcing "3-5 working days" on the product page when the real delay is 20 days (CN → FR via AliExpress) = misleading commercial practice, almost systematic sanction. The duty to state the delivery date or deadline is point 3 of article L111-1, applied to distance selling by article L221-5; failing any indication, delivery must take place no later than thirty days after the contract is concluded (art. L216-1). Missing information carries an administrative fine of up to EUR 15,000 for an individual and EUR 75,000 for a company (art. L242-10), while a misleading display falls under the criminal offence of misleading commercial practice (art. L132-2). The DGCCRF may also order compliance within a deadline it sets case by case (art. L521-1).

2. Fake scarcity ("only 2 left in stock!")#

Artificial counters, "imminent stockout" without product reality. Falsely stating that a product will be available only for a very limited time in order to obtain an immediate decision is deemed misleading in all circumstances (art. L121-4, 7°). There is no administrative fine for this ground: it is a criminal offence, punished by article L132-2 with 2 years' imprisonment and a EUR 300,000 fine, raised to 5 years and EUR 750,000 when the offence is committed online, which is the normal situation of a dropshipping store.

3. Misleading struck-through prices#

Displaying EUR99 with a struck-through EUR199 when the product was never sold at EUR199. Massive practice in TikTok Ads dropshipping. By legal definition, the prior price is the lowest price charged by the trader to all consumers over the thirty days preceding the reduction (art. L112-1-1, in force since 28 May 2022). Breaching the price information rules carries an administrative fine of EUR 3,000 for an individual and EUR 15,000 for a company (art. L131-5); if the announcement misleads the consumer, it shifts to the criminal regime of article L132-2.

4. Country of origin omitted#

For a product made in China and sold via a French brand "made by [brand]", mandatory country of origin mention if confusion possible. A false or misleading origin claim is a misleading commercial practice (art. L121-2 for the definition, art. L132-2 for the penalty).

5. Legal warranty absent or vague#

Every B2C product benefits from the legal conformity warranty (2 years, art. L217-3 Code conso). Mandatory mention. Commercial warranty (if offered) must be distinct. Omission = sanction.

6. Non-compliant or absent T&Cs#

T&Cs generated by ChatGPT without legal validation = frequent sanction motive. T&Cs must include: seller identity, RCS, share capital, intra-community VAT, incl.-VAT prices, payment terms, withdrawal right, warranty, mediation, jurisdiction. Cabinet Hayot Expertise reviews these mandatory statements and supports their upgrade as an accessory to the accounting engagement, standalone legal drafting being reserved to the legal professions.

What the DGCCRF investigations into dropshipping actually found#

One site in two in breach: a control is not a remote hypothesis, it is the normal regime of the sector.

Two regimes coexist and are constantly confused: the administrative fine, imposed by the DGCCRF without a judge, and the criminal penalty for the offence of misleading commercial practice.

Tier 1: administrative fines (DGCCRF, no judge involved)

Tier 2: criminal penalty for misleading commercial practice (art. L132-2)

Tier 3: product safety (GPSR)

Regulation (EU) 2023/988 sets no figure: its article 44 leaves penalties to the member states, which must make them effective, proportionate and dissuasive. In France, failing to implement the measures required by the regulation is punished by 5 years' imprisonment and a EUR 600,000 fine, which can be raised to 10% of average annual revenue (art. L452-5-1 of the French consumer code, applicable since 13 December 2024). The widely quoted "up to 4% of worldwide revenue" appeared in the Commission's 2021 proposal and was not kept in the final text.

Tier 4: digital services (DSA)

Regulation (EU) 2022/2065 caps at 6% of annual worldwide revenue the fines imposed by the Commission on very large platforms (art. 74), with periodic penalty payments of up to 5% of average daily worldwide revenue. Its article 52 requires member states to apply the same 6% cap to all intermediary service providers under their jurisdiction; in France the digital services coordinator is Arcom.

Digital and reputational measures: the DGCCRF suspends neither a Shopify account nor a Stripe account, and there is no register of sanctioned practices. Its real powers are the digital injunction of article L521-3-1 (notification to search engines and app stores to stop the listing, blocking of the domain name for 3 months renewable once, then deletion or transfer, with an execution deadline never shorter than 48 hours) and publication of the sanction or of the order, the "name and shame" (art. L522-6, decree no. 2022-1701 of 29 December 2022). The 2022 dropshipping investigation used the digital injunction 88 times.

Cabinet Hayot Expertise in Paris audits your store on 8 points covering 100% of DGCCRF risks:

1. T&Cs: compliance with articles L221-5 (pre-contractual information) and L221-13 (confirmation on a durable medium)
2. Legal mentions: identity, RCS, capital, intra-community VAT, host (art. 19 of Law no. 2004-575 of 21 June 2004 for e-commerce, art. 6 III for the site publisher)
3. Struck-through price: DGCCRF reference price compliance (last 30 days)
4. Delivery times: transparent display of real delay, not in fine print
5. Withdrawal right: accessible and functional withdrawal form
6. Legal warranty: systematic mention, distinct from commercial warranty
7. Consumer mediation: approved mediator designated and mentioned
8. Country of origin: transparency if possible confusion (DNVB / dropshipping)

Compliance deadline: 30 days (T&Cs corrections, mentions, Shopify setup). Audit cost: from EUR1,500 excl. VAT, included in some recurring Cabinet Hayot Expertise engagements.

A compliant set of dropshipping T&Cs systematically covers the following points, which the firm reviews as an accessory to the accounting engagement:

• Article 1: Seller identity (corporate name, RCS, capital, VAT, address)
• Article 2: T&C acceptance (mandatory checkbox at checkout)
• Article 3: Products and services (description, non-contractual photos)
• Article 4: Real delivery times (15-30 days for CN dropshipping, clear bold mention)
• Article 5: Incl.-VAT prices in euros, shipping fees
• Article 6: Payment methods (CB, PayPal, Klarna)
• Article 7: 14-day withdrawal right (form, conditions)
• Article 8: 2-year legal conformity warranty + hidden defects
• Article 9: Liability (force majeure)
• Article 10: Personal data (GDPR, DPO)
• Article 11: Consumer mediation (designated mediator)
• Article 12: Applicable law and competent jurisdiction

No official publication designates TikTok Ads and Meta Ads as a priority DGCCRF target, but the practices these channels encourage concentrate precisely the grounds for sanction reported by the administration. Why?

• Misleading viral videos: product demo not matching reality
• Fabricated customer testimonials (undisclosed sponsored UGC)
• "Before/after" on cosmetics without scientific proof
• Fast delivery promises ("Delivered in 48h!") incompatible with CN dropshipping
• Opaque dynamic pricing (recurrent "24h limited offer")

These practices amount to the criminal offence of misleading commercial practice: 5 years' imprisonment and a EUR 750,000 fine when committed online (art. L132-2), i.e. EUR 3,750,000 for a company, on top of any advertising account suspension decided by the platform itself under its own terms of use. Cabinet Hayot Expertise recommends a dedicated audit of TikTok and Meta content before any ramp-up of advertising budgets.

DGCCRF is only one side of compliance; the other is tax, and just as controlled. When dropshipping to French or EU consumers, three points are unavoidable:

• VAT on sales: the dropshipper is the seller towards the end customer and is liable for VAT on its sales; beyond EUR 10,000 of intra-EU distance sales and electronic services per calendar year (art. 259 D of the French tax code), the tax is due in the country of destination and is declared through the OSS one-stop shop. Booking the "net" remitted by the platform, or ignoring VAT, is a serious error.
• Imports and IOSS: since 1 July 2021, the VAT exemption on low-value consignments is gone. For goods imported from third countries (China, Hong Kong) worth ≤ €150, the IOSS scheme lets you collect VAT at the point of sale and speed up clearance.
• Deemed-supplier marketplaces: when a platform (TikTok Shop, Amazon) facilitates the sale of imported goods with an intrinsic value of EUR 150 or less, it is deemed the supplier for VAT (art. 256, V of the French tax code) and collects the tax for you, without relieving you of your filing obligations or of DGCCRF compliance.

On top of this sits DAC7 reporting (art. 1649 ter A to 1649 ter E of the French tax code, transactions carried out since 1 January 2023, filed with the tax authority by 31 January of the following year), through which platforms transmit your income to the tax authority: the gap between real and declared revenue is now immediately visible. See our article on the DAC7 obligations of platforms.

Customs duties: what changed on 1 July 2026#

Council Regulation (EU) 2026/382 of 11 February 2026 abolishes the customs duty relief that low-value imported consignments used to enjoy. It is the most structural change of the year for a dropshipping business sourcing from Asia, and it hits unit margin directly.

Excluded from the flat duty: consignments between private individuals worth EUR 45 or less, flows from mainland France to the overseas departments, business-to-business flows and consignments above EUR 150. The product identifier, optional at the start, becomes mandatory on 1 November 2026.

A control rarely starts with a raid: most often the DGCCRF uses test purchases (mystery shopping), screenshots of product pages and ads, then a request for documents (T&Cs, mentions, reference-price evidence). Depending on severity, it then issues an order to comply with a deadline, or directly an administrative fine. The right response is to cooperate, fix the flagged breaches immediately, keep proof of the corrections (modification dates, price history) and document good faith. An up-to-date compliance file (validated T&Cs, a 30-day reference-price history, real delays displayed) turns an endured control into a formality. That is exactly what an upfront compliance audit secures.

Cabinet Hayot Expertise in Paris audits your DGCCRF compliance, structures your T&Cs and secures your business model. See our Dropshipping page, our e-commerce page and our Company formation service.

Launching or scaling a dropshipping business? Cabinet Hayot Expertise secures your DGCCRF compliance, T&Cs, tax and accounting in 30 days. Free 90-day scoping.