The law for trust in the digital economy (LCEN) of June 21, 2004, requires every publicly accessible website to display legal notices. This obligation applies to showcase sites, online shops, blogs, and associative platforms alike. The required content varies depending on the legal status of the publisher and the nature of the activity conducted.
Cookie consent: the real area of sanctions in 2025
In its 2025 report, the CNIL indicates that cookies and trackers were among the main reasons for sanctions. Deposits without consent, insufficient information, and failure to effectively account for refusals: the observed shortcomings relate to technical mechanisms, not editorial oversights.
A concrete example: the CNIL sanctioned American Express for continuing to read trackers after the user withdrew consent. The issue was not with the displayed text, but rather that the withdrawal of consent had no real technical effect. The preference was visually recorded without the scripts ceasing to function.
The “Reject” button must be as accessible as the “Accept” button. A site that allows acceptance with one click but imposes several steps to refuse is at risk of a fine.
“Cookie walls” (conditioning access to the site on the acceptance of trackers) are not automatically prohibited, but the CNIL requires that the choice be genuinely free, without excessive pressure, and that an alternative exists. By examining the legal notices of Bordel de Nerd, we see an example of a page that clearly distinguishes information about the publisher from that related to personal data.
Mandatory legal notices according to the publisher’s legal status
The content of the legal notices is not the same for a company, a sole trader, or an association. The common foundation remains the identification of the publisher and that of the host, but the details differ.
Publisher as a natural person or sole trader
The sole trader (including micro-entrepreneurs) must indicate their first and last name, accompanied by the mention “sole trader” or the initials “EI”. This is supplemented by the address, the registration number with the RCS, a means of contact (email address and phone number), and the VAT identification number if the activity is subject to it.
Publisher as a legal entity
For a company, the notices include the company name, legal form (SARL, SAS, SA, etc.), the address of the registered office, the amount of share capital, the RCS number, and the intra-community VAT number. The name of the publication director must also appear.
Information about the host
The identity of the site’s host is mandatory in all cases: name or company name, address, and phone number. Many sites forget this mention or only indicate the commercial name of the host without its complete contact details.
Regulated activities and e-commerce: additional obligations
The basic notices are not sufficient for certain categories of sites. Obligations accumulate depending on the nature of the activity.
- Regulated professions (lawyers, doctors, architects, chartered accountants) must specify the professional title, the state that granted it, the name of the order or professional organization with which they are registered, and the applicable professional rules.
- E-commerce sites add the general terms and conditions of sale (GTCS), payment methods, delivery times, the right of withdrawal, and the contact details of the consumer mediator. These elements can appear on a separate page, but a clear link must refer to them from the legal notices.
- Any site collecting personal data must mention the purposes of the collection, the legal basis for processing, the recipients of the data, the retention period, and the user’s rights (access, rectification, deletion, portability). This obligation arises from the GDPR and adds to the classic legal notices.
Sanctions incurred in case of absent or incomplete legal notices
The absence of legal notices on a professional site constitutes a criminal offense. For natural persons, the LCEN provides for a penalty of up to one year in prison and a significant fine. For legal entities, the fine can be multiplied.
In practice, the most frequent sanctions come from the CNIL and concern personal data and cookies, not the omission of the VAT number.
DGCCRF checks can also target e-commerce sites whose GTCS are absent or whose pre-contractual information is incomplete. The risk is therefore not only criminal: an administrative notice may be enough to disrupt the activity of a commercial site.
Drafting compliant legal notices: checks after generation
Online legal notice generators produce standardized text that covers the minimal foundation. They generally do not take into account business specifics, and above all, they do not address the technical compliance of cookie consent.
Three checks to perform after drafting or generating your notices:
- Is the page accessible within two clicks from any page of the site? A footer link remains the most reliable practice.
- Is the information about the host complete (name, address, phone), and not just a logo or commercial name?
- Does the cookie banner actually work? Test the refusal: third-party scripts must stop loading, not just disappear visually.
The compliance of legal notices is verified at both the technical and editorial levels. Field feedback varies on the actual frequency of checks for small sites, but the CNIL’s tendency to use simplified procedures makes sanctions quicker and less costly to impose.
