Under the Certification framework for cloud service providers, only providers who are certified under the SecNumCloud standard have access to public procurement tenders for cloud services. The SecNumCloud standard requires providers to use root certificates emitted by the certification authority of an EU Member State in the presence of the provider.

According to Art. 45-3 of the Postal and electronic communications code, ".fr" domains can only be registered by physical persons residing in the territory of an EU member state or legal persons established there.

According to Art. 289A of the General Taxation Code, a person not established in the European Union who is liable for the value-added tax or must fulfil reporting obligations is required to have a taxable representative established in France accredited to the tax office.

The Consumer Rights Directive 2011/83/EU provides an updated framework aimed at encouraging online sales. The Directive has been implemented by Law no. 2004-575 of June 21, 2004 on confidence in the digital economy.

France has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

France has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

According to Art. L851-1 of the Internal Security Code, the Prime Minister can authorise the collection of connection data and other technical data for law enforcement purposes without a court order. Furthermore, under Art. L851-2, in exceptional cases, real-time online surveillance of individuals connected to a terror suspect can be authorised. The maximum number of authorisations for this is determined by the Prime Minister.

The Directive 2000/31/EC (E-Commerce Directive) is the legal basis governing the liability of Internet Services Providers (ISPs) in the EU Member States and includes a conditional safe harbour. Not all Member States have transposed the relevant articles consistently, leading to divergent national case law that could cause legal insecurity on an EU level.
The E-Commerce Directive was transposed into French law by Law No. 2004-575 of 21 June 2004. According to this law, the hosting provider is liable for the stored contents only if (i) he was actually aware of the illicit character of the content or if (ii) he did not delete the illicit content or did not forbid access to such content promptly after becoming aware of its illicit character.

The Directive 2000/31/EC (E-Commerce Directive) is the legal basis governing the liability of Internet Services Providers (ISPs) in the EU Member States and includes a conditional safe harbour. Not all Member States have transposed the relevant articles consistently, leading to divergent national case law that could cause legal insecurity on an EU level.
The E-Commerce Directive was transposed into French law by Law No. 2004-575 of 21 June 2004. According to this law, the hosting provider is liable for the stored contents only if (i) he was actually aware of the illicit character of the content or if (ii) he did not delete the illicit content or did not forbid access to such content promptly after becoming aware of its illicit character.

It is reported that France imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Under Art. 11 of the Act related to the fight against the manipulation of information, platform operators have to implement measures to fight against the spread of false information that may disrupt public order or affect general elections. To this end, they have to provide a complaint mechanism and are invited to establish complementary voluntary measures such as blocking accounts that massively spread disinformation and increasing transparency over their algorithms and the sources of information.

According to Art. L851-3, telecommunication providers can be required to automatically analyse connection data in their networks to detect terrorist threats.

In May 2024, during a state of emergency, French authorities imposed a temporary suspension of TikTok in New Caledonia, citing risks to public order amid civil unrest. The measure, implemented from 15 to 29 May, was carried out via the territory’s sole internet provider and marked the first instance of France blocking access to a social media platform. The action raised significant concerns regarding compliance with legal standards of necessity and proportionality, particularly given the absence of judicial oversight or formal regulatory procedure.

Under Arts. L-111-1 and L-111-2 of the Heritage Code, public archives that are kept because of scientific interest or ongoing administrative utility are national treasures. As such, they must be stored on French territory, even in electronic form.

According to the Art. L102 C of the Tax Procedures Handbook, if invoices are sent in electronic form, taxable persons may not store invoices in a country not linked to France by an agreement providing for mutual assistance or not providing immediate online access rights, downloading and use of the whole of the data concerned. Taxable persons are obliged to declare the place of storage of their invoices and any modification of that place where it is located outside France.