A DGCCRF inspection of your site, a letter from a competitor pointing out a lack of legal notices, or simply a customer looking to verify your identity before placing an order: in each of these cases, the absence or incompleteness of legal information poses a concrete problem. The law requires every website publisher to display a set of information clearly identifying the responsible party for the site.
Since the SREN law of May 21, 2024, these obligations have changed their legal basis, rendering many “legal notice” pages copied and pasted a few years ago obsolete.
SREN Law and Article 1-1 of the LCEN: the legal basis that most sites ignore
For nearly twenty years, Article 6-III of the LCEN (law no. 2004-575 of June 21, 2004) was cited as the foundation for the obligation to identify the publisher. This is no longer the case. The SREN law (securing and regulating the digital space), enacted on May 21, 2024, has shifted this obligation to Article 1-1 of the LCEN.
In practice, this means that if your legal notice page still cites Article 6-III, it is legally outdated. This is not just a detail for purists: in the event of a dispute, a judge or a control agent will refer to the current text. Publishing the legal information on Backlink Links illustrates what a page structured according to the current framework looks like.
It is noted that many automatic legal notice generators have not yet integrated this change. If you are using an online tool, manually check the legal reference it inserts into your page.
Mandatory mentions according to status: individual or legal entity
The exact content of the legal notices depends on the legal form of the publisher. Different elements are required for a micro-entrepreneur and a SAS.
Individual entrepreneur or micro-entrepreneur
- Name and surname, accompanied by the mention “individual entrepreneur” or the initials “EI” (obligation added with the unique status of individual entrepreneur)
- Home address (or business premises), email address, and phone number allowing contact with the business
- Registration number with the RCS, VAT identification number
- Identity of the site host: name or corporate name, address, and phone number
- For a regulated activity (pharmacy, beverage sales, etc.): name and address of the authority that issued the authorization
Company (SARL, SAS, SA, etc.)
The required information includes the corporate name, legal form, amount of share capital, address of the registered office, as well as contact details. The RCS number, intra-community VAT number, and host data remain the same.
A common oversight concerns the host: many sites mention their own identity but omit the name, address, and phone number of the company that physically hosts the site. This information is, however, mandatory for all publishers.
Dark patterns and Digital Services Act: what changes for your legal pages
The Digital Services Act (DSA), fully applicable in the EU since February 17, 2024, introduces a constraint that directly affects the design of legal information pages. Deceptive interfaces (dark patterns) are now prohibited: any presentation that manipulates or hinders the user’s free decision-making falls under this regulation.
In practice, there are still sites that make their legal notices deliberately difficult to find (light gray link on a white background, page accessible only after three clicks). This type of practice, once tolerated, falls within the scope of dark patterns that the DSA aims to eliminate.
Legal notices must remain visible, complete, and easily accessible from any page of the site. A footer link, readable and properly contrasted, remains the simplest and most compliant solution.
GDPR and personal data: the aspect that legal notices alone do not cover
Legal notices and privacy policies are often confused. They are two distinct obligations.
Legal notices identify the publisher. The privacy policy, on the other hand, meets the requirements of the GDPR by detailing what personal data is collected, for what purposes, on what legal basis, and what rights users have (access, rectification, deletion, portability).
A site that collects data via a contact form must have both pages. The mere presence of legal notices is not sufficient to cover the information obligation set out in Articles 13 and 14 of the GDPR.
For cookies, the situation adds an additional layer. The consent banner does not replace the privacy policy, and the privacy policy does not replace the legal notices. Feedback varies on how to structure these elements, but three distinct pages (legal notices, privacy policy, cookie policy) constitute the safest configuration for a professional site.
Sanctions for the absence of legal notices on a website
The absence of legal notices is not just a formal oversight. For individuals, the penalty can reach one year of imprisonment and a significant fine. For legal entities, the fine is multiplied by five.
Beyond the criminal sanction, the absence of legal notices directly harms the commercial credibility of the site. A prospect who cannot find a clear identification of the publisher will leave the page. Matching platforms and marketplaces increasingly require compliance with legal notices as a condition for registration.
Verification takes little time. It can be broken down into three steps: check that the legal reference cited is indeed Article 1-1 of the LCEN (and not the old 6-III), verify that the host’s contact details are indeed on the page, and ensure that the link to the legal notices is accessible from the footer on all pages of the site.
A site compliant with legal information does not need to be perfect from the start. However, it must be up to date with the current framework, accurately reflect the legal status of its publisher, and not hide its obligations behind opaque ergonomics.
