(Beyond) cosmetic compliance? HRDD litigation and the Yves Rocher case under the French Duty of Vigilance Law

I.Introduction

In March 2022, the Turkish trade union Petrol-İş, representing former employees of a Turkish cosmetics company, together with human rights action groups Sherpa and ActionAid France, initiated legal proceedings against Yves Rocher, the parent company of the cosmetics group, before the Paris Court of Justice. Yves Rocher allegedly failed to protect workers’ rights at its – now former – Turkish subsidiary. Among the allegations: violation of the right to freedom of association, the right to non-discrimination based on gender, and the right to a safe and healthy working environment, including occurrences of sexual harassment.

The claim was brought under the 2017 French Law on the Duty of Vigilance of Parent and Lead Companies (Duty of Vigilance Law), the trailblazing instrument which introduced human rights due diligence (HRDD) to continental Europe. Under this framework, companies must publish and effectively implement a ‘vigilance plan’ designed to prevent, mitigate and remedy risks linked to their own activities and those of their business partners, failing which they may face civil liability.

HRDD and vigilance obligations form the latest solution designed to address labour rights infractions linked to corporate activities and to counteract cosmetic compliance, where policies look polished and progressive written down, yet lack effective implementation and monitoring. This blogpost explores what the outcome of the Yves Rocher proceedings, based on the French Duty of Vigilance Law, means for HRDD litigation and the enjoyment of labour rights not only on paper but in practice.

II. The French Duty of Vigilance Law

The French Duty of Vigilance Law is the oldest of the European HRDD frameworks focused on corporate accountability for human rights violations. Through a vigilance obligation for certain large corporations to set up, implement and publish a ‘vigilance plan’, the aim of the Duty of Vigilance Law is to improve the responsibility of multinational companies for the damages they cause to human rights, as well as to provide avenues for remediation for the victims of those damages. The explanatory memorandum of the draft Duty of Vigilance Law links these goals to those of the United Nations Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Entreprises and ISO 26000. The law got adopted on 27 March 2017 and entered into force a day later.

Under the Duty of Vigilance Law are obligated to establish and effectively implement a ‘vigilance plan’, by virtue of which they can be held liable for labour rights infractions. The underlying duty of vigilance hinges on three ‘vigilance obligations’: 1) companies must establish the plan, 2) the plan must be effectively implemented, and 3) the plan, accompanied by the report on its effective implementation, must be made available publicly and through the company’s annual management report.

The content of the plan consists of ‘reasonable’ vigilance measures such as a risk-mapping  analysis, an alert mechanism tracking risks, and a monitoring scheme to follow up on the other measures of the plan. Stakeholders are involved at multiple stages, including in the plan’s conception. Where appropriate, stakeholder involvement takes place as part of a sectoral or territorial multi-stakeholder initiative.

The vigilance plan is structured around three main risk themes: 1) human rights and fundamental freedoms, 2) health and safety of persons, and 3) the environment. Notably, the Duty of Vigilance Law does not point to any further norms or definitions that might assist in defining the scope of these themes. The French legislators held this was not needed, since “France’s international commitments in this area appear to be sufficiently precise and comprehensive”. The explanatory memorandum refers to authoritative soft law, which might imply that these documents should be consulted when operationalizing the risk themes, a point that returns in the Yves Rocher case. Furthermore, given that the Duty of Vigilance Law takes on a risk-based perspective, and imposes an obligation of means rather than of result, companies retain discretion in prioritizing – and, arguably, in interpreting – the risks they should address.

The vigilance obligations are further characterized by their brevity and open-endedness. The French Council of State has the competence to issue an implementing decree. However, since the design of the law was intentionally broad as to provide companies with flexibility and prevent tick-the-box exercises, no such decree exists to this day. As a downside, this makes for less legal certainty on the interpretation of the due diligence obligations for both companies and other stakeholders in vigilance plans, as well as for the judiciary.

Companies confronted with the Duty of Vigilance Law fall into two categories. The first consists of companies fully subject to the vigilance obligations. These obligations apply to companies with their registered office in France that, over two consecutive financial years, employ either 5,000 or more employees in France, including subsidiaries, or 10,000 employees worldwide, including both direct and indirect subsidiaries. Unlike other European frameworks, the French Duty of Vigilance Law does not include a turnover threshold. A subsidiary is exempt from preparing its own plan if its parent company already publishes one that covers both the parent’s activities and those of its subsidiaries. This exemption points to a broader second category, which includes companies that, while not directly subject to the law, fall within the perimeter of the vigilance plan. These companies might see their activities covered by vigilance plans if they are controlled (in)directly by an in-scope company, or if they qualify as a subcontractor or supplier with whom the in-scope company has established a commercial relationship. By consequence, the influence of the Duty of Vigilance Law extends well beyond the in-scope companies, and many more businesses will be facing vigilance-related questions. The French government currently does not provide an overview of which companies fall within scope of the law. This is remedied by a duty of vigilance radar, created by a group of civil society organizations.

Failure to comply with the vigilance obligations may lead to periodic penalty payments and other measures under interim proceedings, as well as to civil liability actions. The former option relies on a formal legal notice of a company’s failure to comply with vigilance obligations, which can be send by civil society organizations and other interested parties. In the event that the failure to comply persists for three months after the notice, the interested party can turn to a judge to request an injunction obliging the company to set up a compliant vigilance plan under the threat of penalty payments. The latter option demands companies rectify the damage that the execution of the vigilance obligations could have prevented through a standard civil liability claim. The claim can only hold a parent or instructing company accountable based on their own fault – combined with a proven damage and causal link – not on the fault of other entities in their supply chains. It is the claimant who bears the burden of proof. If the claim is successful, the court can decide to publish the decision. The accompanying civil fine of up to 30 million EUR was struck down by the French Constitutional Courtbecause the definition of a breach of vigilance obligations needed to incur such a civil fine was “insufficiently clear and precise”. However, this definition – although deemed unconstitutional – remains a condition for finding civil liability.

III. Sherpa & others v. Yves Rocher

The Yves Rocher case concerns a second ruling on the merits of the French Duty of Vigilance Law. The first one, the La Poste case, had ordered injunctive relief, meaning that the vigilance plan at issue needed to be rewritten. In this case, the Paris Judicial Court was confronted with a claim brought by 81 former employees Kosan Kozmetik Sanayi (KKS), as well as by the Turkish trade union Petrol-İş, and the NGOs Sherpa and ActionAid France against the parent company of KKS, Laboratoires de Biologie Vegetale Yves Rocher (Yves Rocher). The claimants sought both injunctive measures to ensure compliance with vigilance obligations, as well as compensation for the harm allegedly caused by insufficient vigilance.

In order to obtain injunctive relief, as mentioned above, formal notice is required. The claimants issued a formal notice of Yves Rocher’s failure to comply with its vigilance obligations on 21 April 2020. Just before the prescribed three-month deadline was set to expire, on 17 July 2020, Yves Rocher announced that it had made its due diligence plans public, with the company stating that “it had developed and implemented [these plans] since 2017”. Since this act did not fully respond to the demands of the claimants, the proceedings went on. The injunctive relief was dropped along the way due to corporate restructurings, which meant that KKS was no longer a subsidiary of Yves Rocher. Ultimately, it was decided that the admissibility would be dealt with at the same time as the merits of the case. The hearing of the pleadings took place on 20 November 2025, and the judgment was passed on 12 March 2026.

The claimants brought forth that between 2018 and 2019, Yves Rocher's Turkish subsidiary KKS dismissed 132 workers who had joined Petrol-İş to protest against poor working conditions, systematic discrimination against women, and gender-based violence. This came after an earlier audit, conducted when Yves Rocher acquired the majority of KKS in 2012, that had already flagged risks related to the freedom of association and collective bargaining. The claimants stated that Yves Rocher failed to include these risks in its vigilance plans, instead focusing solely on the risks tied to supplier and subcontractor activities. Moreover, rather than publishing and depositing their vigilance plans from 2017-2019 as required, Yves Rocher had only annexed them to General Assembly reports. The dismissed employees initially had gone to the Turkish labour inspectorate and court, but many withdrew their case due to a collective settlement agreement signed with Yves Rocher.

In its judgment, the Paris Court of Justice first decided on the admissibility of the case. Yves Rocher pleaded that Turkish law was applicable under the Rome II Regulation, it being the law of the venue of the damage (lex loci damni). The Court dismissed this argument, stating that the French Duty of Vigilance Law should be considered an overriding mandatory law (loi de police), which makes French law applicable. In its arguments on the conflict of laws debate, the Court further spoke out about the European CSDDD. It stated that Omnibus I did not affect national civil liability regimes. Instead, it had simply abandoned their harmonization.

In addition, Yves Rocher’s motion to dismiss based on Turkish and French statutes of limitations was also rejected. The Court held that Turkish law was inapplicable, and that the 5-year limitation period of the French Civil Code began running only upon publication of the vigilance reports in 2020, rather than at the time of the underlying events in 2018. Several additional motions to dismiss failed as well. First, Yves Rocher sought to preclude the action of Petrol-İş, Sherpa and ActionAid France prior to consideration of merits, but this motion was deemed inadmissible because of the lack of concrete grounds. Second, Yves Rocher argued that the case had already been adjudicated in Turkey, but the Court dismissed this motion for lack of judgments evidencing res iudicata. Third, the company disputed the claims for damages relating to non-discrimination based on sex and mental and psychological health of individuals, because they had not been included in the formal notice. The Court rejected this, as a standard liability action does not require the same formal legal notice as the injunctive relief route. Yves Rocher did, however, succeed in one motion to dismiss; the Court ruled that 72 out of the 81 employees had no legal standing for their claims anymore, since they signed the collective settlement agreement.

The Court then addressed the conditions necessary to obtain compensation for damages under French civil liability law: fault, damage and causal link. The fault was established as the non-compliance with the vigilance obligations of the Duty of Vigilance Law. While the Court was lenient regarding the late publication of the vigilance plans, it found a clear breach in the company’s decision to exclusively include risks in its vigilance plan linked to suppliers and subcontractors, thereby excluding those arising from its own subsidiaries. As a result, the Court sets the outer borders to risk prioritization. A company cannot simply analyse its competitors, leaving its own activities and the accompanying risks out of frame.

It further found the conditions of damage and causal link to be firmly established with respect to violations of the right to freedom of association and collective bargaining. It interpreted this right in accordance with Arts. 21 and 22 of the ICCPR, Art. 8 of the ICESCR, and the fundamental ILO Convention no. 87 on the Freedom of Association and Protection of the Right to Organise. The claimants had provided several witness statements, audits, and other evidence showing the link between workers’ union membership and activities, and the subsequent layoffs. The Court rejected Yves Rocher’s argument that these facts had been concealed by local management. It found that there was enough information available to recognise a serious risk of union repression, and that proper inclusion of this risk in the vigilance plan would have prevented harm up to 2019. In contrast, the Court did not grant damages for sex‑based discrimination or for psychological harm, as these claims were not sufficiently established.

Having established all three elements of liability, the Court awarded €8,000 in compensation to each of the six workers that did not sign a settlement agreement, €40,000 to the union, and symbolic damages of one euro to Sherpa and ActionAid, with provisional enforcement. It remains to be seen whether Yves Rocher might consider an appeal to test the interpretation of the novel vigilance obligations in this judgment.

Since the events at issue, Yves Rocher published its vigilance plans for the year 2017, 2018, 2019, 2020, 2021, 2022, 2023 and 2024.

IV. Lessons for HRDD litigation

The Yves Rocher case marks the first time a French parent company was held liable for labour rights violations arising from the activities from one of its non-EU subsidiaries, granting former non-EU employees the possibility to obtain damages directly from a European parent company. With the duty of vigilance radar showing a total of 10 known formal notices and 13 civil lawsuits pending, it will not be the last time.

Besides its national significance, the case should be seen within the broader architecture of HRDD frameworks. The French Duty of Vigilance Law was the pioneering law on the European continent to impose mandatory corporate human rights due diligence to combat human rights risks arising from corporate activity. It led numerous jurisdictions, including EU Member States (f.e. the Netherlands) and non-EU countries (f.e. the Republic of Korea) to consider or advance HRDD legislation, and served as an inspiration for the two other major European HRDD instruments: the German Supply Chain Act (LkSG) and the EU Corporate Sustainable Due Diligence Directive (CSDDD). Despite these developments, France remains the only jurisdiction with a tried and tested civil liability system for HRDD-related infractions. By contrast, the German LkSG relies on administrative enforcement by its German Federal Office of Economics and Export Control (BAFA), while the EU saw the CSDDD’s harmonized civil liability system scrapped for national systems that still have to adjust to HRDD claims. The Yves Rocher judgment therefore provides the first concrete illustration of how such liability can operate in practice, and what companies may reasonably expect in future litigation.

The case also illustrates how business and human rights disputes increasingly move beyond the reputational towards the liable. Business and human rights, which points towards corporate accountability for the negative impacts of their activities on people and the environment, is originally rooted in soft law instruments. This still shows in the references the Yves Rocher case makes to, for example, the UN Guiding Principle no. 24. If cases moved to litigation, it was under tort, administrative, consumer or criminal law, with systems that where ill-suited to these matters. The emergence of statutory HRDD legislation thus can be seen as an answer to the difficulties under other litigation systems. Nonetheless, statutory HRDD litigation does not render other legal routes obsolete. On the contrary, since every system still faces hinderances – a heavy burden of proof (f.e. in proving the causal link), information imbalances, duration of proceedings – companies are likely to face multi‑layered strategies, where one case could be introduced based on tort claims, consumer‑law arguments, administrative complaints, and statutory HRDD procedures, depending on which is most advantageous. Still, it remains to be seen whether the statutory HRDD litigation will ensure large-scale substantive improvements in among others labour conditions, or whether it will result more in tick-the-box exercises and compliance oriented-risk management.

V. Conclusion