A website online for three months, an active contact form, but no legal notice page: this situation still concerns many small organizations. The risk is not theoretical. The Law for Confidence in the Digital Economy (LCEN) of June 21, 2004, requires every website publisher to publish accessible and complete legal notices. Sanctions can reach several tens of thousands of euros for a sole trader, and much more for a company.
CNIL Sanctions and Cookies: Oversight Beyond the Legal Notice Page
It is often thought that legal notices are limited to a fixed block of text at the bottom of the page. In practice, the CNIL also actively monitors cookie management, a topic directly related to the transparency of the site.
In its 2025 report published on September 9, 2026, the CNIL imposed 83 sanctions totaling 486.8 million euros. Cookies, employee surveillance, and data security were among the main reasons. More specifically, 21 entities were sanctioned for violations related to trackers: deposit without consent, incomplete information, or unacknowledged refusals.
The SHEIN case illustrates the extent of the risk. On September 1, 2025, the CNIL fined the Irish subsidiary of the group 150 million euros for depositing advertising cookies before consent and continuing to read after a refusal. It does not matter that the headquarters is outside France: the CNIL can monitor any site targeting French users.
By consulting the legal notices of Hommes Et Abeilles, one can see an example of a page that combines publisher identification and information on personal data in a readable format, which remains the best practice to follow.
Mandatory Content of Legal Notices According to Legal Status
The exact content of the page varies depending on whether one manages a site as a natural or legal person. Feedback on this point varies according to online generators, but the legal framework is clear.
For a company (SARL, SAS, SA, etc.), the page must include:
- The company name, registered office address, phone number, and email address of the publisher
- The registration number in the trade and companies register (RCS) or the directory of trades, as well as the amount of share capital
- The name of the publication director and the contact details of the site’s host (company name, address, phone number)
- The VAT number if the company is subject to it
For a sole trader or self-employed person, the same identification requirements apply, adapted to the status: name, first name, address, SIRET number. No professional site is exempt from these obligations, even a simple blog monetized by advertising.
Legal Notices for an E-commerce Site: Additional Obligations
An online sales site must go further than a showcase site. In addition to the standard identification information, specific mentions related to commercial activity are added.
The general terms and conditions of sale (CGV) must be accessible before any transaction. They cover payment methods, delivery times, the right of withdrawal, and return conditions. These elements do not replace the legal notices: they are two distinct pages with different functions.
If the site collects personal data (registration form, account creation, newsletter), a privacy policy compliant with GDPR must specify the purpose of the collection, the legal basis for processing, the retention period, and the rights of users (access, rectification, deletion).
Cookie Banner: The Trap of the Hidden “Refuse” Button
In practice, many sites display a cookie banner with a large “Accept all” button and a discreet link to the settings to refuse. This practice is contrary to CNIL requirements.
Refusing cookies must be as simple as accepting them. In practical terms, this means a “Refuse all” button visible at the same level as the acceptance button, without an intermediate screen. The sanctions imposed in 2025 and 2026 confirm that the CNIL actively monitors this point.
Three common mistakes to avoid on the banner:
- Pre-checking consent boxes for non-functional cookies, which amounts to depositing without valid consent
- Not blocking tracking scripts until the visitor has clicked, which deposits cookies as soon as the page loads
- Failing to update the list of cookies after adding a new analytics or advertising tool to the site
Writing and Publishing: Where to Place the Legal Notices on the Site
The LCEN law requires that legal notices be easily accessible. They are generally placed in the footer of the site, with a link titled “Legal Notices.” A link named “Info” or “About” is not sufficient: the title must be explicit so that the user can identify the page unambiguously.
The page must be accessible in one or two clicks from any page of the site. On a CMS like WordPress, one creates a dedicated static page, then adds the link in the footer menu. Some extensions offer pre-filled templates, but it is always necessary to check that the information corresponds to the actual legal status of the publisher.
Copying the legal notices from another site by changing the name is a common mistake. Beyond plagiarism, there is a risk of reproducing inaccurate information (wrong status, missing RCS number, incorrect host). Each legal notice page must reflect the specific situation of the site’s publisher.
Updating this page after a change of registered office, legal form, or host is part of the regular maintenance of the site, just like a backup or a security update.
