The legal notices group together the identification information that every website must display to allow visitors to know who is behind a web page. Their content varies according to the legal status of the publisher, the type of activity carried out, and the personal data collected. Measuring what the law actually requires and what sites display in practice allows for distinguishing real compliance from mere copy-pasting of generic templates.
Legal notices and GDPR compliance: what the page alone does not cover
Most sites are satisfied with a single page grouping the publisher’s identity, the host’s contact details, and a few lines on intellectual property. This approach meets the minimum required by law for trust in the digital economy (LCEN), but it overlooks an entire aspect of compliance.
Recent checks by the CNIL regularly associate information deficiencies with other shortcomings: data retention period, data minimization, security, or lack of a processing register. An isolated legal notices page does not replace a comprehensive compliance documentation. A site that collects email addresses via a contact form must, near this form, specify the purpose of the processing, the legal basis, the rights of individuals, and the methods for withdrawing consent.
To observe how a site concretely structures this page, you can access secretsdhommesfr and compare it with your own formatting.
Legal notices thus constitute a foundation, not a shield. They must be articulated with a distinct privacy policy, a compliant cookie banner, and, where applicable, general terms and conditions of sale.
Comparison table: obligations according to the type of website
The required content differs significantly between a showcase site, an e-commerce site, and a personal blog. The table below summarizes the obligations documented by institutional sources.
| Obligation | Professional showcase site | E-commerce site | Personal blog |
|---|---|---|---|
| Publisher’s identity (name, first name or company name, address) | Yes | Yes | Yes (or pseudonym + host contact details) |
| RCS number / VAT identification number | Yes | Yes | No |
| Host’s contact details | Yes | Yes | Yes |
| General terms and conditions of sale (GTC) | No | Yes | No |
| Cookie information and consent for trackers | Yes if trackers are not necessary | Yes | Yes if trackers are not necessary |
| Privacy policy / GDPR | Yes from the collection of personal data | Yes | Yes from the collection of personal data |
| Regulated activity mention (authorization) | If applicable | If applicable | No |
The key point to remember: a personal blog is not exempt from the obligation to display the host’s contact details. The non-professional publisher can, however, limit themselves to a pseudonym, provided that the host can communicate their identity upon judicial request.
Cookies and trackers: information distinct from legal notices
Legal notices are not sufficient to inform about cookies and trackers. Many sites include a paragraph on cookies in their legal notices page, which creates confusion. The CNIL requires specific information, accessible before the deployment of any tracker not strictly necessary for the site’s operation.
In practice, this means that a banner or modal must appear on the first visit, with:
- The list of purposes for each category of trackers (statistics, advertising, social networks)
- The possibility to accept or refuse each purpose in a granular manner
- A link to a detailed cookie policy, separate from the legal notices page
Grouping everything on a single page amounts to drowning the information. The consent collected under these conditions may be deemed invalid during a check, as the user was not informed clearly and beforehand.
Sites using artificial intelligence: additional obligations regarding data
The CNIL’s recommendations on the development of AI systems add a layer of complexity for sites that integrate a chatbot, algorithmic personalization, or use browsing data to train a model.
In these cases, the information to be provided to users goes beyond the classic framework of legal notices:
- The explicit purpose of the processing related to AI (personalization, recommendation, automated assistance)
- The legal basis retained (consent, legitimate interest, performance of a contract)
- The data retention period used by the system
- Understandable information on the logic of automated processing and its consequences for the user
These elements far exceed what a standard legal notices page contains. A site that merely states “we use artificial intelligence technologies” without detailing these points exposes itself to a lack of transparency regarding the GDPR.
Sanctions and concrete risks in case of absent or incomplete legal notices
The absence of legal notices on a professional site is sanctioned by the LCEN. For individuals, the fine can reach up to one year of imprisonment. For legal entities, the financial penalty is proportionally heavier.
In practice, sanctions rarely fall solely for missing legal notices. Recent decisions by the CNIL show that the lack of information is often noted in combination with other shortcomings: absence of a processing register, excessive collection of personal data, lack of security.
The most immediate risk for a professional website remains the loss of user trust. A visitor who cannot find a legal notices page, or who encounters a manifestly generic text without a SIRET number or verifiable contact details, leaves the site. For an e-commerce site, this absence may be enough to dissuade a purchase.
The compliance of legal notices is not a one-time issue to be resolved at the site’s launch. Each change in legal status, change of host, addition of a data collection form, or integration of an artificial intelligence tool requires an update. Sites that treat this page as a fixed document accumulate discrepancies without realizing it.
