The legal notices refer to all the information that a website must publish to allow any visitor to identify the person or company responsible for the content. This obligation arises from the law for confidence in the digital economy (LCEN) of June 21, 2004. It applies to all sites, whether they are showcase sites, blogs, or e-commerce platforms, without exception related to the size of the company.
Trackers and consent: transparency beyond the cookie banner
Most guides on legal notices focus on identification information. However, online transparency is not limited to displaying a SIRET number and a postal address. The management of trackers constitutes a separate aspect, often misunderstood.
A site that places cookies or other trackers must list each tracker used, specify its origin and purpose. Prior consent from the user is required for trackers that are not strictly necessary for the operation of the service. Refusal must be as simple as acceptance, and the user must be able to modify or withdraw their choice at any time.
In practice, a simple banner saying “Accept cookies” is not enough. The company must offer a granular mechanism that distinguishes between the different categories of trackers (analytical, advertising, functional). This requirement falls under the GDPR and the recommendations of the CNIL, and adds to the classic legal notices. Sites that address these two topics on the same page often mix distinct obligations, which harms readability for both the user and any potential audit.
Some companies publish a rigorous legal notice page while neglecting their tracker policy – you can learn more about Mirage D’Intérieur to see how a legal notice page can be structured clearly and accessibly.
Mandatory legal notices according to the legal status of the company
The exact content of the legal notices varies depending on whether the publisher of the site is a legal entity or a natural person. This distinction is the source of most errors found on professional sites.
Legal entity (SARL, SAS, SA, etc.)
A company must publish its corporate name, legal form, and the amount of its share capital. This is supplemented by the address of the registered office, an email address, and a phone number to contact the company. The registration number in the trade and companies register (RCS) is required for commercial activities.
Natural person (sole proprietor, micro-enterprise)
The sole proprietor indicates their first and last name, accompanied by the mention “sole proprietor” or the initials “EI”. The domiciliation address replaces that of the registered office. The phone number and email address remain mandatory.
In both cases, the contact details of the site’s host must be included in the legal notices: corporate name, address, and phone number. Omitting this information exposes one to sanctions, even if the rest of the page is complete.
- For a regulated activity (health, law, real estate), it is necessary to mention the authority that issued the authorization to practice and the applicable professional rules.
- An online commerce site must add the intra-community VAT number and the general terms and conditions of sale (CGV).
- Companies subject to a professional order specify the professional title, the State in which it was granted, and the name of the order.
Personal data protection and GDPR compliance
The GDPR requires companies that collect personal data to inform users precisely. This information is not to be confused with the legal notices as defined by the LCEN, even if both are often found on the same page.
The company must indicate the identity of the data controller, the purposes of the collection, the legal basis retained (consent, performance of a contract, legitimate interest), and the recipients of the data. The retention period and the rights of the user (access, rectification, deletion, portability) must also be mentioned.
Confusing privacy policy and legal notices is a common mistake. Legal notices identify the publisher of the site. The privacy policy describes the data processing. A compliant site publishes both, in separate sections or on separate pages.
Digital accessibility: a recent obligation for e-commerce sites
Since June 28, 2025, the European Accessibility Act covers certain e-commerce services intended for consumers. Affected companies must explain, in their CGV or an equivalent document, how their service meets accessibility requirements. This information must remain available in written and oral form as long as the service is offered.
The text provides an exemption for microservice enterprises that meet the size conditions defined by the scheme. For others, digital accessibility joins the list of online transparency obligations, alongside legal notices and personal data policy.
This aspect is often overlooked because it does not fall directly under the LCEN. However, an e-commerce site that neglects accessibility exposes itself to a distinct risk of non-compliance, which adds to the sanctions provided for the absence of legal notices.
Sanctions for absent or incomplete legal notices
The absence of legal notices on a professional site constitutes an offense. For natural persons, the penalty can reach one year of imprisonment and a fine. For legal entities, the amount of the fine is multiplied.
Sanctions also target incomplete notices, not just the total absence of a page. A site that omits its host’s contact details or fails to specify its legal form is in violation, even if other information is correctly published.
- The fine applies per violation detected, which means that multiple breaches on the same site can accumulate.
- A competitor or a customer can report the absence of legal notices to the DGCCRF.
- Online sales platforms sometimes check the compliance of legal notices before listing a seller.
The compliance of legal notices, the personal data policy, and accessibility obligations forms a coherent whole. A site that addresses these three aspects separately, with dedicated and up-to-date pages, reduces its legal exposure and strengthens user trust. Updating these pages after each change in status or hosting provider remains the simplest reflex to stay compliant.
