The legal information of a website is not just a copy-paste of a template found online. Since May 2024, the legal basis has changed, and most legal notice pages in circulation still refer to a law article that is no longer correct. We will clarify what actually applies, the least documented technical pitfalls, and the penalties incurred.
Law SREN of May 2024: the new legal basis for mandatory notices
The law no. 2024-449 of May 21, 2024 (law SREN) has shifted the obligations for identifying the publisher. They are no longer found in article 6-III of the LCEN, but in a new article 1-1 of law no. 2004-575 of June 21, 2004. Any site that still cites “article 6-III LCEN” as the basis for its legal notices is therefore legally outdated.
This change is not cosmetic. The new wording specifies the elements to be displayed according to the publisher’s status (individual or legal entity) and includes the identification of the host, including the contact details of the individuals responsible for data storage. We recommend checking the legal reference displayed on your own legal notice page before taking any other action.
A concrete example of up-to-date compliance can be seen on the legal information page of B2B Infos, which clearly distinguishes between publisher identification, hosting, and data processing.
Website legal notices: what the law requires according to your status
The mandatory elements differ significantly between a sole proprietor and a company. Confusing the two exposes one to incomplete notices, which is enough to characterize the offense.
Individual (sole proprietor, micro-enterprise)
- Name, first name, accompanied by the mention “sole proprietor” or the initials “EI”
- Home address, email address, and phone number
- Registration number with the RCS and VAT identification number
- Identity of the website host: name or corporate name, address, and phone number
- For a regulated activity: name and address of the authority that issued the authorization
Legal entity (company)
The corporate name, legal form, and amount of share capital replace the name and first name. The address indicated is that of the registered office. The name of the publication director must be explicitly stated, a frequent oversight on SME websites.
The absence of the publication director’s name is the most common error we observe during compliance audits. It is, however, punishable in the same way as the total absence of notices.
Privacy policy and GDPR: two distinct obligations from legal notices
The majority of articles aimed at the general public mix legal notices and privacy policy. These are two separate documents, based on different texts. Legal notices fall under the LCEN (now article 1-1). The privacy policy falls under the GDPR, particularly its article 13, which imposes specific mentions as soon as personal data is collected.
Article 13 of the GDPR requires at a minimum: the purposes of processing, the legal basis, the retention period, the identity of the data controller, and the rights of users (access, rectification, erasure, portability). These elements cannot be buried in the legal notices. They require a dedicated page or a clearly identified section.
Cookie management and consent
The cookie banner is not a decorative element. Consent must be obtained before any non-strictly necessary tracker is placed. The CNIL has intensified its controls on this point, and sanctions apply both to the absence of a banner and to a poorly configured banner (pre-checked boxes, making refusal more complex than acceptance).
A site that places Google Analytics cookies without prior consent is in violation, regardless of the size of the company.
Penalties incurred in case of absent or incomplete legal notices
Failure to comply with identification obligations can result in a penalty of up to one year in prison and a fine for individuals. For legal entities, the fine is multiplied by five. These penalties are included in the LCEN and have not been softened by the SREN law.
In practice, criminal prosecutions remain rare for simple omissions. The concrete risk manifests more as formal notices from the DGCCRF or the CNIL, followed by administrative sanctions. A CNIL audit on cookies can trigger a broader audit that reveals non-compliant legal notices.
We observe that e-commerce sites are the most exposed, as they accumulate obligations: classic legal notices, general terms and conditions, privacy policy, cookie management, and, where applicable, specific mentions for the consumer mediator.
Intellectual property: a mention often rushed
Mentions relating to intellectual property are mandatory as soon as the site uses images, illustrations, or texts for which the publisher is not the author. Citing the source is not always sufficient: permission from the author must be obtained or an appropriate license must be held.
Photos purchased from stock image banks are covered by a license that often prohibits sublicensing or resale. The mention of the applicable license for each visual protects the publisher in case of dispute. We recommend integrating a generic clause in the legal notices, supplemented by credits on a case-by-case basis in the body of the site.
Compliance of a website relies on a set of articulated documents: up-to-date legal notices according to the SREN law, a privacy policy compliant with article 13 of the GDPR, a functional cookie banner, and mentions of intellectual property. Treating these elements as isolated formalities leaves gaps that any audit or competitor can exploit.
