You have just launched your showcase site or your online store. The design is polished, the texts are ready. But have you thought about your legal notices? This page, often relegated to the bottom of the site, is actually a legal requirement imposed by the law for trust in the digital economy (LCEN) of June 21, 2004. Without it, you expose your business to heavy sanctions.
Common mistakes in drafting legal notices
Most sites do display a page titled “legal notices.” The problem lies in the actual content of this page. Many site owners copy a generic template found online, without adapting it to their situation.
The first common mistake: confusing legal notices, general terms and conditions of sale (CGV), and privacy policy. These three documents respond to distinct obligations. Legal notices identify the site’s responsible party. The CGV frame the commercial relationship with the buyer. The privacy policy details the processing of personal data under the GDPR.
The second trap: forgetting to update information after a change of address, legal form, or hosting provider. Legal notices must reflect the current situation of the site’s publisher, not that of the day of its creation.
The third often overlooked point: the identity of the host must be included in your notices, with its name or corporate name, address, and phone number. A simple logo or a link to the host’s homepage is not sufficient. The legal notices of Passez l’info illustrate how to structure this information in a readable manner, with all the elements required by law.
Mandatory legal notices according to your legal status
The exact content of your legal notices depends on your status. Are you a sole trader? You must indicate your first and last name, accompanied by the mention “sole trader” or the initials “EI.”
For a company (SARL, SAS, SA, etc.), the expected information is more detailed:
- Corporate name, legal form, and amount of share capital
- Address of the registered office and registration number with the RCS
- VAT identification number
- Contact details: email address and phone number
- Name of the publication director
If you engage in a regulated activity (pharmacy, beverage sales, regulated liberal professions), you must also mention the name and address of the authority that issued the operating license.
Particular case of e-commerce sites
An online sales site has additional obligations compared to a showcase site. The general terms and conditions of sale must be accessible before the validation of any order. The notices must also specify the payment methods, delivery terms, and the right of withdrawal.
Cookies and personal data: what falls under the GDPR, not the legal notices
Many sites mix everything into a single page. The management of cookies and the personal data policy deserve separate treatment, and the CNIL is increasingly vigilant about this.
Consent to cookies must be obtained before any deposit. In practice, no advertising or audience measurement cookies (except exemptions) should be placed until the user has made their choice. The CNIL considers that refusal must be as simple as acceptance, in accordance with Article 82 of the Data Protection Act.
Recent checks have resulted in sanctions for sites that placed advertising cookies before any user interaction. The CNIL has also sanctioned the absence of complete information on the purposes of cookies and on the methods for withdrawing consent.
What your privacy policy should contain
As soon as your site collects data (contact form, newsletter subscription, account creation), you must inform the user precisely:
- Identity of the data processing controller
- Purpose of each collection and associated legal basis
- Data retention period
- Rights of individuals (access, rectification, deletion, opposition)
The CNIL recommends adapting these notices to each processing rather than drafting a catch-all text. A contact form and a newsletter subscription do not have the same purpose or legal basis.
Sanctions for absent or incomplete legal notices
Ignoring this obligation is not a theoretical risk. Failure to comply with identification obligations is punishable by law. For individuals, the fine can reach a significant amount, which may be accompanied by a prison sentence.
Legal entities face a fine of 375,000 euros. Beyond the financial penalty, the absence of legal notices harms the credibility of the site. A visitor who cannot find this information may legitimately doubt the seriousness of the company.
On the GDPR side, checks target both large platforms and commercial prospecting sites. For prospecting by email or SMS to individuals, prior consent is generally required. The exception for existing customers only covers similar products or services, with a simple opt-out option for each sending.
Documenting your compliance
Displaying complete legal notices is not always enough. The CNIL recommends keeping proof of consent and maintaining an up-to-date record of processing activities. In the event of a check, it is this documentation that proves your good faith.
Your legal notices are the first signal of trust you send to your visitors and regulatory authorities. Take the time to adapt them to your status, clearly separate them from your privacy policy and CGV, and update them with every change in your activity. A well-drafted page today saves you from legal disputes tomorrow.
