An online site for three years, never updated on the legal side: this is the typical profile that triggers an inspection or a complaint. The legal notices of a website are not a block of fixed text that is copied and pasted at creation. They engage the responsibility of the publisher, frame data collection, and must reflect the reality of the activity at every moment.
Check your legal notices: the overlooked errors
It is often thought that the “legal notices” page is settled once and for all. In practice, several elements become outdated without us realizing it: change of host, modification of the VAT number, or transition from sole proprietorship to company.
The most common trap concerns the identity of the host. When migrating a website to new hosting, updating this information is rarely the first reflex. The LCEN law of June 21, 2004, however, requires mentioning the name, address, and phone number of the host.
Another neglected point: contact details must be genuinely functional. A broken form or a generic email address that is no longer checked does not fulfill the accessibility obligation set by law. One can observe how other organizations arrange this transparency, for example in the legal notices of Sourires D’Enfants, where each piece of information is directly verifiable.
- Name or corporate name of the publisher, address of the headquarters, operational email and phone
- Registration number with the RCS and VAT identification number
- Name, address, and phone number of the website host
- For an individual entrepreneur: first and last name accompanied by the mention “EI”
If your activity is regulated (liberal profession, beverage sales, financial activity), specific mentions are added: name of the supervisory authority, reference to applicable professional rules.
Legal notices and GDPR: two distinct but overlapping obligations
The confusion between legal notices and privacy policy remains massive. Legal notices identify the publisher of the site, while the privacy policy details the processing of personal data. Both are mandatory, but they respond to different texts: the LCEN for the former, the GDPR for the latter.
In practice, many sites group everything on a single page. This is not prohibited, but it complicates readability and updating. If a marketing tool, contact form, or chatbot is added, it is necessary to document the purpose of the processing, the legal basis for consent, and the data retention period.
Cookie consent: an autonomous control
The CNIL now treats cookie compliance as a standalone control subject. Refusing cookies must be as simple as accepting them: a “Reject all” button at the same level as “Accept all,” without misleading design.
The sanctions imposed by the CNIL in 2025 focus on the absence of a legal basis, proof of consent, and electronic commercial prospecting. We are no longer just talking about displaying a banner, but about documenting proof that the visitor has indeed consented.
Specific obligations for an e-commerce site
An online sales site combines the obligations of classic legal notices with those of the consumer code. The general terms and conditions of sale (GTCS) must be accessible before any transaction. Returns vary on this point, but the safest practice remains to separate GTCS, legal notices, and privacy policy into three distinct pages.
The right of withdrawal, delivery terms, and the consumer mediator must be explicitly stated.
- General terms and conditions of sale accessible and dated
- Identity and contact details of the consumer mediator
- Information on the right of withdrawal (deadline, terms, standard form)
- Prices including VAT, delivery charges, and payment terms
Sanctions for the absence of legal notices on a website
For individuals, the absence of legal notices is punishable by one year in prison and a fine. For legal entities, the amount of the fine is multiplied. The sanction also applies to incomplete or inaccurate notices, not just to the total absence of a page.
Beyond the criminal sanction, a competitor or an unhappy customer can report the breach.
Establish a verification routine
It is recommended to check your legal notices with each structural change: new technical provider, modification of legal status, addition of a data collection module. A semi-annual check is sufficient for most showcase sites.
The CNIL’s repressive activity in 2025 shows that the targeted breaches concern operational practices (cookies, prospecting, security, retention, information) and not just the absence of a static page. Legal notices are a living device, not an archive document.
