Legal CBD website: 7 disclosures to check before ordering

Three sets of texts apply to a French online shop. Under the 2004 law on confidence in the digital economy, known as LCEN, the seller's identity and contact details must be accessible. The consumer code covers pre-contract information, price, terms and conditions and the right of withdrawal. The General Data Protection Regulation (GDPR) fixes what the website has to say about the data it collects.

Hemp itself is the subject of a single text, the order of 30 December 2021. It authorises varieties listed in the official catalogues whose Δ⁹-THC content does not exceed 0.30%, and extends the same cap to extracts and to the products that contain them. On 29 December 2022, the Conseil d'État, France's highest administrative court, struck down the ban on selling raw flowers and leaves and kept this limit in place.

Point 5 calls for a clarification. The order sets the limit a product must respect, and by itself it does not require any percentage to be published. Yet without the measured value and the matching batch, a buyer has no way to check compliance. This point is what sets a CBD website apart from an ordinary shop.

The seller's identity

Article 19 of the LCEN requires "easy, direct and permanent access" to the following: name or company name, address, email address and phone number, plus, for a registered company, the registration number, share capital and registered office. A seller liable for VAT must also give the intra-EU VAT number. Since May 2024, article 1-1 of the same law has added the name of the publication director and the host's name, address and phone number.

The page usually exists; it is just incomplete. A contact form is no substitute for an email address or a phone number, and a company name with no registration number cannot be checked against any register.

Terms of sale and the mediator

Article L221-5 lists what the seller has to tell you before you order: features, price, delivery time, identity, guarantees, how to withdraw using the model form, and the possibility of turning to a consumer mediator. If a website names no mediator, the buyer has no identified way to settle a dispute out of court.

Withdrawal and its exceptions

Article L221-18 allows 14 days, counted from receipt of the goods, to withdraw from a distance purchase without giving a reason. Within the next 14 days, the seller refunds everything, delivery costs included (article L221-24).

Article L221-28 contains two exceptions that may concern hemp: goods liable to deteriorate or expire quickly (4°), and unsealed goods that cannot be returned for reasons of hygiene or health protection (5°). A seller who relies on them has to say so before the order. If you only learn of the exception afterwards, in an email refusing the return, take it as a red flag.

THC content and the batch

"Compliant with the law" is a claim with no measurement behind it. What you can verify is a pair, a Δ⁹-THC value and a batch number, tied to a certificate of analysis. Our guide to reading a certificate of analysis shows how to link the two, and the article on the 0.30% limit explains what that figure covers.

Certain products rule a website out on their own, however complete its legal notice.

The first red flag is a cannabinoid classified as a controlled drug. HHC has been one since 13 June 2023. According to the French medicines agency, ANSM, H4CBD, THCP and other derivatives have been since 3 June 2024. A website that still sells them, sometimes under a new acronym, operates outside the legal framework.

The second is CBD to swallow. On 20 May 2026, the French agriculture ministry restated that foods containing CBD are not authorised under the novel food regulation, food supplements included. The rule covers gummies, chocolates and oils presented as food. Our overview of CBD regulation in 2026 describes where things stand.

The third is a health claim. Article L121-2 of the consumer code classes as misleading any practice resting on false or misleading claims about a product's properties and the results to expect from using it. Epidyolex, dispensed on prescription, is the only authorised CBD-based medicine. Our article on advertising CBD products sets out the penalties.

1. From the footer, open the legal notice. Write down the company name and SIREN number and look them up in a public business register.
2. Make sure the site gives an email address and a phone number, beyond a contact form.
3. Search the terms of sale for "withdrawal" (« rétractation »). You should find at least 14 days, a model form and any exceptions spelled out.
4. Find the name of a consumer mediator.
5. On a product page, locate the price including tax, the Δ⁹-THC content and a batch number.
6. Read through the product pages for any claimed effect on the body and any product meant to be swallowed.

Take the Phytogrammes catalogue as an example. The Skunk page shows a reference profile tied to batch PG-26-7188 and a per-gram price scale (checked on 23 September 2026), and no laboratory certificate is published for it. The legal notice page lists the company name, legal form, share capital, registered office, SIREN, VAT number, publication director and hosts. Practical questions are gathered in the FAQ.

Three disclosures are often presented as mandatory, yet the texts cited here either do not provide for them or do not use the usual wording.

• No text sets a general minimum age for CBD as such; the rule depends on the format. A CBD e-liquid is a vaping product and may not be sold to under-18s. For flowers and resins, "adults only" is a shop practice as the texts currently stand. Each case is covered in our article on CBD and the legal age.
• France has no public quality label for CBD. A certificate of analysis from an accredited laboratory, tied to a batch, is what counts.
• The phrase "not for ingestion" reflects the status of extracts under food law, yet none of the texts cited here requires it on the website.