What information must a professional website actually display to be compliant, and where are the gaps between what the law requires and what publishers actually publish? The legal notices, framed by the Law for Trust in the Digital Economy (LCEN) of June 21, 2004, constitute the foundation for identifying any website. Their content varies according to the legal status of the publisher, the type of activity, and the nature of the data collected.
Legal notices of a site: individual or legal entity
The obligations differ significantly depending on whether the publisher is a sole proprietorship or a company. The table below summarizes the mandatory information for each case.
| Required Information | Individual (micro-enterprise, sole proprietorship) | Legal entity (LLC, SAS, SA, etc.) |
|---|---|---|
| Identity | First and last name | Company name, legal form, amount of share capital |
| Contact details | Home address, email, phone | Registered office address, email, phone |
| Registration | Siren number | RCS and/or Siren number |
| VAT | Identification number if subject to VAT | VAT identification number |
| Host | Name or designation, address | Name or designation, address |
| Publication director | Name of the responsible person | Name of the responsible person |
One point that institutional documents rarely mention: the host’s contact details must include its postal address, not just its trade name. A simple “hosted by OVH” is not sufficient.
To see a concrete example of a page structured with these elements, one can consult the page about Mon Coach A Domicile, which clearly illustrates the distinction between publisher identification and hosting information.
Regulatory triptych: legal notices, privacy policy, and cookies
Most online guides treat legal notices as a single block. Regulatory practice now imposes a division into three distinct pages on a professional site.
- Legal notices page (LCEN): identification of the publisher, the host, the publication director, and mentions related to intellectual property.
- Privacy policy page (GDPR, articles 13 and 14): purposes of each processing of personal data, legal basis invoked, retention period, user rights, and contact details of the data protection officer if applicable.
- Cookie management module (ePrivacy directive, CNIL recommendations): consent banner with the option to refuse as simple as acceptance, list of cookies deposited by category and lifespan.
Merging these three blocks into a single “legal notices” page remains technically lawful but complicates readability and increases the risk of omissions during updates. In contrast, separating each block into its own URL facilitates control by the CNIL and improves the user experience.
Legal basis “legitimate interest”: a common transparency trap
When a professional site collects data via a contact form, an analytics tool, or commercial prospecting, it must indicate the legal basis for processing. Consent is the most well-known basis, but many publishers invoke “legitimate interest” without providing concrete justification.
Compliance now requires that each recourse to legitimate interest be accompanied by a readable explanation for the internet user. A generic statement like “we process your data in our legitimate interest” does not meet this requirement.
What the justification must contain
The publisher must describe the pursued interest (for example: “measuring site traffic to improve navigation”), explain why this interest outweighs the rights of the data subject, and specify how the user can object. This level of detail far exceeds what most sites display.
The absence of a clear justification exposes to CNIL sanctions, including through the simplified procedure that has led to several dozen decisions since early 2026.
Sanctions and simplified CNIL procedure in 2026
The CNIL has intensified its checks on professional sites, including showcase sites of small structures. Since January 2026, the simplified procedure has resulted in more than twenty new sanctions. This procedure allows for fines to be imposed without going through the restricted collegiate formation, which significantly accelerates the processing of cases.
The most frequently sanctioned breaches do not only concern the total absence of legal notices. They also relate to:
- Cookie banners that do not allow for a refusal as simple as acceptance.
- Incomplete privacy policies (missing retention periods, unspecified legal basis).
- Insufficient host mentions (name without address, absence of phone number).
- Contact forms collecting data without prior information on their processing.
The LCEN law provides for sanctions of up to one year in prison and a fine for individuals in the absence of legal notices. For legal entities, CNIL fines related to the GDPR can represent a significant percentage of annual turnover.
Intellectual property in legal notices
One often overlooked aspect: mentions related to intellectual property are mandatory as soon as the site uses images, illustrations, or texts for which the publisher is not the author. The source must be cited or the author’s permission obtained. Sites using royalty-free visuals must ensure that the license adequately covers commercial use.
The regulatory framework of a professional site is therefore not limited to a one-time written legal notices page. Structuring into three distinct blocks, precise justification for each legal basis for data processing, and regular updates of identification information constitute the three axes on which compliance truly hinges.