Business websites in France: the legal requirements (legal notice, cookies, GDPR)

A business website in France has four sets of legal obligations: a complete legal notice (“mentions légales”), consent before setting non-essential cookies, clear information for anyone whose personal data it collects, and — if it sells online — terms of sale that comply with the French Consumer Code. None is hard to set up, but anyone can check them, and some carry heavy penalties. Here is what the official sources say. This is a general overview, not legal advice for a specific situation.

The legal notice: who publishes and hosts the site

Service-public.fr’s page on mandatory information on a business website applies to companies and sole traders alike. It lists:

• Identity: company name, legal form and share capital for a company; first name, surname and the mention “entrepreneur individuel” or “EI” for a sole trader.
• Contact details: registered address, email address and phone number.
• Registration number (RCS and/or RNE, depending on the activity).
• Intra-EU VAT number, where applicable.
• Publication director, for a site that publishes an online public communication service.
• Host: name, address and phone number.

Regulated activities and professions must add further details, such as the authority that granted the licence or the professional body. This information can sit on a dedicated page or in the terms of sale.

According to the same page, missing information is punishable by fines of up to €375,000 for a company and €75,000 for a sole trader, micro-entrepreneurs included. The page cites France’s 2004 law on confidence in the digital economy (LCEN).

Cookies: consent first

The CNIL, France’s data protection authority, explains in “Cookies and trackers: what does the law say?” that Article 82 of the French Data Protection Act requires consent before certain trackers are stored or read on a visitor’s device; until consent is given, those cookies cannot be set. It also states that withdrawing consent must be as easy as giving it.

Its guidelines and recommendation add that:

• Refusing must be as easy as accepting, and the CNIL recommends offering a “Reject all” button, not only “Accept all”.
• Continuing to browse is not consent: a clear positive action is needed, such as clicking “I accept”.

Exempt trackers. The CNIL lists trackers that need no consent: authentication, remembering a shopping basket, and some audience-measurement tools. Its page on audience measurement sets strict conditions: anonymous statistics only, used solely to measure the site’s own audience, with no tracking across other sites; it recommends a limited tracker lifetime, such as thirteen months, not extended automatically on each visit, and a maximum of twenty-five months for the data collected. Some offerings fall outside the exemption, notably when the provider reuses the data for its own purposes.

In practice, list what your site actually sets: analytics, ad pixels, embedded videos, maps, booking or chat widgets. As soon as an ad pixel or a non-exempt tracker appears — for instance to measure a Google Ads campaign — consent is needed before it fires.

Forms and personal data: inform at the point of collection

Contact forms, quote requests and newsletter sign-ups collect personal data, and the GDPR requires informing people when it is collected. The CNIL’s page on informing individuals lists what must always be stated, including the organisation’s identity and contact details, the purposes, the legal basis, whether fields are mandatory, the recipients, the retention period, people’s rights, and the right to complain to the CNIL. It asks for short, readable notices and recommends a layered approach: a few lines under the form, with a link to the full privacy policy.

Retention. The CNIL’s page on retention periods states that personal data cannot be kept indefinitely: the controller sets a period based on the purpose, unless a text already sets one.

Register of processing. The obligation to keep a register of processing activities applies to all organisations, whatever their size. The exemption for companies with fewer than 250 employees is, in practice, limited to very specific cases. The CNIL offers a simplified template for small businesses.

Selling online: terms of sale and pre-contract information

According to service-public.fr, terms of sale are mandatory between a professional and a consumer. For distance selling they must state, among other things, the price, the 14-day right of withdrawal and how to exercise it, the fact that the consumer pays return costs where that applies, and the option of using a consumer mediator. The page on selling online adds that consumers must see the total price including VAT.

One recent change: since 19 June 2026, businesses concluding distance contracts through an online interface must offer a feature letting consumers withdraw directly online. If your shop was built before that date, check it — it’s the kind of update we handle in our e-commerce projects and ongoing maintenance.

An example: a craftsman’s brochure site

A sole-trader joiner near Antibes has a site showing his work, a quote request form and visitor statistics. He needs a legal notice (name with “EI”, address, email, phone, registration and VAT numbers, publication director, host); no cookie banner if his analytics tool meets the CNIL’s exemption, but a banner with “Accept all” and “Reject all” as soon as he adds an ad pixel; a short notice under the form with a link to his privacy policy; and a simple register of processing activities. No online terms of sale while he sells nothing on the site.

Build it in from the start

These obligations are far easier to meet when planned from day one: legal pages in the footer, forms with their notice, tools chosen to limit trackers. It’s one of the points in our guide to building a website and a step in every website design project.

Want to check what your current site is missing? Get in touch.