You are publishing a showcase site, a blog, or an online store. Before even thinking about design or SEO, a legal obligation applies: to display legal notices. This page, often relegated to the footer of the site, engages your responsibility and protects your visitors. Here’s what you need to know to write it correctly.
Legal notices and data collection: two distinct obligations
Many website owners confuse the legal notices page with the privacy policy or the cookie banner. These are three separate provisions, each responding to a different text.
The legal notices fall under the law for trust in the digital economy (LCEN) of June 21, 2004. They serve to identify the publisher and the host of the site. The privacy policy, on the other hand, stems from the GDPR and details how you handle personal data.
A site can display impeccable legal notices while still being non-compliant if its cookie consent banner is faulty. The CNIL regularly sanctions this type of breach, regardless of the content of the legal page. Keeping these obligations separate in your mind (and on your site) prevents the misconception that a single page covers everything.
To observe a concrete example of formatting, the legal notices of Pixikult illustrate how to structure this information on a professional site.
Mandatory information according to your legal status
The exact content of your legal notices depends on your legal form. Are you a sole trader? You must indicate your first name, last name, address, the mention “sole trader” (or the initials EI), your registration number with the RCS, an email, a phone number, and your VAT identification number.
Do you manage a company (SARL, SAS, SA)? Add the company name, the amount of share capital, the address of the head office, and the RCS number along with the city of the registry.
In all cases, the identity of the host must appear on the page: name or company name, address, and phone number. Forgetting the host is one of the most common mistakes.
- Name, first name (individual) or company name (legal entity), postal address, email, and phone number of the publisher
- RCS number, intra-community VAT number, and, for a company, amount of share capital
- Name or company name of the host, its address, and its phone number
- For a regulated activity: reference to applicable professional rules and name of the authority that granted the authorization
Forms and collection points: the obligation that most sites ignore
Displaying a “Legal Notices” page is not enough to cover your obligations regarding personal data. The information must also appear at the precise moment you collect data.
Do you offer a contact form, newsletter subscription, or account creation? At each collection point, the visitor must know why their data is being requested, which fields are mandatory or optional, who will receive this data, and what rights they can exercise.
This requirement comes directly from the GDPR. The CNIL insists on this for services used by minors, but it applies to all sites without exception. A simple contact form with an “email” field triggers this obligation.
A data controller that is genuinely reachable
Your legal notices and forms must indicate a data controller and a practical means to exercise their rights (access, rectification, deletion). A generic email address like “[email protected]” is acceptable, provided that someone actually responds to requests within a reasonable timeframe.
The CNIL checks this point separately. A site that displays a right to rectification but never processes requests is subject to sanctions just like a site without legal notices.
Sanctions and concrete risks in case of absent or incomplete legal notices
The LCEN law provides for criminal sanctions for both individuals and legal entities in case of absence of legal notices. Fines can reach significant amounts, accompanied by imprisonment for the most serious cases.
In practice, the most common risk is not criminal. A competitor or an unhappy customer can report the absence of legal notices to the DGCCRF or the CNIL. The subsequent inspection often examines the overall compliance of the site, not just the targeted page.
Data security and retention: beyond the legal page
The CNIL has imposed sanctions for the absence of security measures, excessive data retention, or failure to minimize. These breaches are checked separately from the mere existence of a legal notices page.
Writing a complete legal page does not exempt you from documenting internally your data access rules, retention periods, and deletion procedures. The page displayed on the site reflects what you actually apply, not the other way around.
Writing compliant legal notices for a website in practice
Start by verifying your legal status and gathering the corresponding information (see the list above). Create a dedicated page, accessible from the footer of every page on the site. The link must be visible without having to search.
Clearly separate the legal notices (identity of the publisher, host) from your privacy policy (data processing, cookies). You can place them on the same page as long as you distinguish the sections, or better, on two separate pages.
- Ensure that each form on the site displays an information notice at the point of collection
- Test your cookie banner independently of the legal notices page
- Review your notices after each change of host, legal form, or address
Up-to-date legal notices protect both the visitor and the site publisher. Compliance is not only about the initial drafting but also about regularly updating this information whenever your situation changes.
