The legal notices of a professional website are not just a copy-paste of a template found online. Their content varies according to the legal form, the industry sector, and the nature of the data collected. Poorly informed or incomplete, this legal information exposes the publisher to sanctions that go beyond a simple administrative fine.
Digital accessibility and legal notices: the new regulatory layer
Since June 28, 2025, the European Accessibility Act requires certain private companies to make their digital services accessible to people with disabilities. The scope particularly covers e-commerce sites aimed at consumers, certain banking services, transportation, and electronic communication.
In practice, a subject e-commerce site must go beyond a single line in its general terms and conditions. It needs to publish an accessibility statement, provide a channel for reporting encountered issues, and, if applicable, offer an alternative solution. The RGAA remains the technical reference for verification in France.
We observe frequent confusion between two distinct regimes. The first, historical, stems from Article 47 of the 2005 law and targets public bodies as well as certain very large companies. The second, arising from the 2025 European directive, depends on the nature of the service provided to the consumer, not on the size of the company. Microenterprises providing services, however, benefit from an exemption under certain thresholds.
To illustrate the structuring of a compliant page, the legal information of Digital Breizh integrates these elements in a readable and segmented format.
A strictly B2B activity is not automatically subject to this new regime, as the text targets services intended for consumers. Verify the exact qualification of your activity before concluding an exemption.
Identification notices: what the LCEN requires according to your status
The law for confidence in the digital economy (LCEN) of June 21, 2004 remains the foundation. Any legal notice page must allow for the unambiguous identification of the publisher of the website. The required content differs significantly between a legal entity and a sole trader.
Company registered with the RCS
- Company name, legal form (SAS, SARL, SA, etc.), address of the registered office, and amount of share capital
- Registration number with the RCS, SIREN number, and VAT identification number
- Usable contact details (email address and phone number), identity of the publication director
- Identity of the website host: company name, address, and phone number
Regulated activities
A site operated in a sector subject to authorization (pharmacy, beverage sales, regulated liberal professions) must mention the name and address of the authority that granted the operating license, as well as the reference to applicable professional rules.
We recommend systematically checking if your activity falls under a professional order or a specific consular chamber. The omission of this mention is one of the most common shortcomings during inspections.
Personal data protection and privacy policy
The privacy policy is legally distinct from the legal notices, even though both often appear on the same page. The legal notices identify the publisher. The privacy policy informs the user about the processing of their personal data under the GDPR.
A site that collects data (contact form, newsletter, analytical cookies) must specify the purposes of each processing, the legal basis chosen (consent, legitimate interest, contractual execution), the recipients of the data, and the retention period.
Consent for cookies remains a friction point. Simply continuing to browse no longer constitutes acceptance since the CNIL guidelines. A compliant consent banner must allow for refusal as easily as acceptance, with a refusal button at the same visual level as the acceptance button.
User rights to mention
Right of access, rectification, erasure, portability, opposition, and limitation of processing. Each right must be accompanied by a clear procedure (email address of the DPO or dedicated form). Mentioning the right to lodge a complaint with the CNIL is mandatory.
Sanctions incurred and effective control of professional websites
The absence of legal notices or their incomplete nature constitutes a criminal offense for both individuals and legal entities. The LCEN provides for penalties of up to one year in prison and a fine for individual publishers.
In terms of data protection, the sanctions imposed by the CNIL are distinct and cumulative with criminal sanctions. Non-compliance with the GDPR exposes companies to fines calculated on their global annual revenue.
Inspections are not theoretical. The DGCCRF regularly checks the compliance of online commerce sites, and the CNIL conducts thematic campaigns targeting cookies and data collection forms. A competitor or a dissatisfied consumer can also report a shortcoming, triggering a targeted inspection.
Compliance is not limited to the initial drafting. Any change in the legal structure of the company, any change of host, or any evolution of data processing requires an immediate update of the legal notice page. We recommend a biannual audit, particularly for sites that regularly add new forms or third-party tools.
