Legal notices on a business site: what French law requires

Every business website in France, even a simple presentation page, must say who publishes it and who hosts it. As soon as it collects data, through a contact form for example, or sets cookies, other rules are added.

Here are the essentials, based on the guidance of the French administration and of the CNIL, the data protection authority. For a particular case, your accountant, your professional body or a lawyer will decide.

What the legal notices contain

The information depends on your status: company, or sole proprietorship (micro-enterprise included).

Notice	Company (SARL, SAS…)	Sole proprietorship
Identity	Company name, legal form, amount of share capital	Last and first name, followed by “EI” or “entrepreneur individuel”
Address	Registered office	Registered business address
Contact	Email address and phone	Email address and phone
Registration	RCS or RNE number, depending on the activity	RCS or RNE number, depending on the activity
VAT	VAT number, if there is one	VAT number, if there is one
Host	Name, address and phone	Name, address and phone

For registration, a commercial activity gets a number in the trade and companies register (RCS) or the national business register (RNE); a craft, liberal-profession or agricultural activity, a number in the RNE.

Add to this the name of the publication director, the person responsible for what is published: most often, you. These notices can appear on a dedicated page, or in your general terms of sale. A “Legal notices” link in the footer of every page makes them findable everywhere.

Special cases

Regulated profession (architect, lawyer, doctor, physiotherapist, chartered accountant…): state your professional title, the professional rules that apply, the State where the title was issued, and the professional body or organization you are registered with.
Activity requiring authorization (private security, goods transport…): the name and address of the authority that issued it.
Consumer customers: any professional selling to consumers must give them access to a consumer mediator, and display its name, address and website on their own site, including a showcase site with no online sales (CECMC, 2026). Choose it first: citing a mediator you don’t fall under, for lack of membership or agreement, can be deemed a breach.
Online sales to consumers: the general terms of sale must appear on the site, on pain of a €15,000 fine.
Photos, texts, videos: make sure you have the right to publish them, through their author’s permission or a license that allows it.

The contact form and personal data

A contact form collects personal data: a name, an email address, a number, a message. At the moment the person fills it in, you must clearly tell them:

who processes their data, and how to reach you;
why you collect it, for example to answer their request, and on what legal basis;
who has access to it, and how long you keep it;
what their rights are (access, rectification, erasure, objection), and how to exercise them;
that they can lodge a complaint with the CNIL.

This information goes in a privacy policy, separate from the general terms, and linked from every page by a clear link, such as “Personal data” or “Privacy”. Missing any of it is punishable by a €1,500 fine.

The administration recalls two simple rules. Only ask for what is useful: a date of birth has no place in a request for information. And the address received to answer a question isn’t, by default, for sending a newsletter.

Cookies

Cookies strictly necessary for the site to work require no consent. Advertising cookies can only be set after agreement. Some audience measurement tools are exempt, under precise conditions set by the CNIL.

When consent is needed:

refusing must be as easy as accepting, for example with a “Reject all” button at the same level as “Accept all”;
nothing is set before the choice;
continuing to browse doesn’t count as agreement, and closing the banner counts as refusal (CNIL);
a permanent link, in the footer for example, lets people change their mind;
the CNIL generally considers it appropriate to keep the choice for six months before asking again.

Watch out for services embedded in your page: a video player, social media buttons or a booking tool can set their own cookies, the administration warns. Take stock of what your page loads, even if you didn’t install anything yourself.

What oversights cost

Missing legal notices: up to a €75,000 fine for a sole proprietorship, micro-enterprise included, and €375,000 for a company.
Missing information on personal data: €1,500.
Badly managed cookies: in 2025, the CNIL issued 83 sanctions, 21 of which concerned cookies and other trackers. Two targeted Google (€325 million) and Shein (€150 million).

Sanctions don’t target only the giants. In 2025, 14 organizations, including self-employed professionals, were sanctioned for not answering the CNIL’s requests. For simple cases, it has a lighter procedure, with fines capped at €20,000. Between January and July 2026, it issued 23 sanctions of this kind, for €133,750 in total, notably against banners where refusing was harder than accepting (CNIL, 2026).

The checklist

The company’s identity, address, contact, registration and VAT.
The host: name, address, phone.
The publication director.
The professional title and body, if you are concerned.
The consumer mediator, if you serve consumers.
The privacy policy, linked from every page.
A cookie banner, if you set cookies that require consent.
The rights to your photos and your texts.

In short: a business website says who publishes it, how to reach them and who hosts it. If it collects data or sets cookies, it informs and lets people refuse as easily as accept. Oversights are costly, and the CNIL sanctions simple cases too.