By country

Refund Policy Generator France

GDPR plus the Loi Informatique et Libertés, CNIL cookie doctrine and the mentions légales duty.

Generate your refund policy Read the refund policy guide

A French refund policy sits inside the CGV rather than beside them, and it has to distinguish three things French law keeps separate: the fourteen-day withdrawal right, the garantie légale de conformité, and the garantie des vices cachés - each with its own duration and its own remedy.

France applies GDPR through the Loi Informatique et Libertés, and the CNIL is one of the most active regulators in Europe on the specific question of cookies. Its recommendation that refusing must be as simple as accepting was backed by fines in the tens and hundreds of millions against the largest advertising platforms, and it has continued down the long tail since.

The CNIL also publishes référentiels - sector reference frameworks for HR data, health research, customer management and more. They are not binding in the way a regulation is, but departing from one is something you are expected to justify.

Alongside data protection, French e-commerce carries its own disclosure regime: mentions légales identifying the publisher and host, CGV setting sale terms, and Code de la consommation rules on the fourteen-day withdrawal right and the two statutory guarantees.

What a refund policy in France has to cover

The fourteen-day withdrawal right, with the model withdrawal form supplied in French
The garantie légale de conformité and its two-year presumption period
The garantie des vices cachés, which runs separately and for longer
Return costs, stated before the order if the customer is to bear them
Refund within fourteen days of withdrawal, subject to receiving the goods or proof of return

How France actually moves personal data

Audience measurement under the CNIL exemption

France allows a narrow consent exemption for strictly first-party, non-shared audience measurement configured to CNIL parameters. Standard Google Analytics does not qualify; a properly configured Matomo instance can.

Prospection commerciale

B2C email marketing needs prior opt-in; B2B is permitted on a professional address where the message relates to the person’s role and an opt-out is offered. The distinction is French-specific and frequently missed.

Health and wellbeing data

French rules on health data are stricter than the GDPR baseline, and hosting health data on behalf of others requires an HDS-certified host.

HR and recruitment records

The CNIL HR référentiel sets expected retention - typically two years for unsuccessful applicants - and restricts what may be collected during recruitment.

Cookie consent proof

The CNIL asks operators to demonstrate consent. In its enforcement decisions the evidence examined was the live banner behaviour, not the wording of the cookie policy.

Third parties the draft will ask you about

Stripe · Lydia · Chronopost and Colissimo · OVHcloud · Scaleway · Matomo · Sendinblue/Brevo · Salesforce · Google Workspace

The rules that apply

Loi Informatique et Libertés + GDPR

The French implementation, including the age of digital consent set at fifteen and specific rules on health and research data.

CNIL cookie recommendation

Refusal as easy as acceptance, no consent by continued browsing, consent lifetime of about six months before re-asking, and a documented audience-measurement exemption if you rely on it.

Mentions légales

Publisher identity, director of publication, and the host’s name and address must be published - a duty from the LCEN, separate from privacy law.

Code de la consommation

Fourteen-day withdrawal, the garantie légale de conformité and the garantie des vices cachés, plus mandatory pre-contractual information.

CNIL référentiels

Sector frameworks covering customer management, HR, health and more. Divergence is permitted but has to be reasoned.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

The French checklist

Publish mentions légales
Identity of the publisher, the director of publication, and the host’s name, address and telephone number.
Configure the banner symmetrically
Accept and refuse at the same level, same visual weight, same number of clicks. Store the choice for roughly six months.
Decide honestly whether the analytics exemption applies
If it does not, analytics fires only after consent.
Set the age of digital consent to fifteen
Below that, parental authorisation is required for consent-based services.
Publish CGV before checkout
The general conditions of sale must be accessible and acceptable before the order is confirmed, with a payment-obligation button.

Where this usually goes wrong

A banner where "Tout accepter" is a button and refusal is a link

This is the exact configuration the CNIL fined. Symmetry is the test.

Claiming the audience-measurement exemption while sharing data

The exemption dies the moment the measurement data is used for anything else or shared with the provider for its own purposes.

Missing mentions légales

Publisher, director of publication and host details are required by law and are trivially checkable by anyone.

English-only notices for a French audience

The Toubon law and Article 12 transparency both point the same way: if you sell in France, the notice should be in French.

Treating B2B prospection as unrestricted

It is permitted without prior consent only where the message relates to the recipient’s professional function and an opt-out is present in every message.

Frequently asked questions

Does my privacy policy have to be in French?

If you target French consumers, yes in substance. Article 12 requires intelligible language for the audience and French consumer law reinforces it. A French version alongside English is the safe configuration.

Can I use Google Analytics in France?

The CNIL has issued formal notices over standard Google Analytics configurations and transfers. It is possible to use analytics lawfully with consent and appropriate transfer safeguards, but the consent-free exemption is designed around tools that do not share data, not around GA.

How long can cookie consent last?

The CNIL recommends re-asking after about six months, and treats an indefinitely stored acceptance as a problem. Refusals should be remembered for a comparable period so the banner does not nag.

What are mentions légales?

A statutory legal notice identifying who publishes the site, who is responsible for its content, and who hosts it. It is separate from the privacy policy and from the CGV, and all three are expected.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.