Skip to content
NoraSync

Guides

Website legal requirements in France: legal notice, GDPR, cookies

In France, a business website must display certain information, explain what it does with its visitors’ data and ask for their consent for some cookies. These rules apply to a simple showcase website as much as to an online shop. This guide sets out what the official French sites service-public.gouv.fr and the CNIL (French data protection authority) say, and gives you a checklist for your own site.

Updated on

The legal notice

According to the service-public.gouv.fr page “Mentions obligatoires sur le site internet d’une entreprise” (mandatory information on a business website), the site must make it possible to identify the business and its hosting provider. This information can appear on a dedicated page or in the terms and conditions of sale.

  • For a company: the company name, the legal form and the amount of share capital.
  • For a sole trader: surname and first name, with the words “entrepreneur individuel” or the initials “EI”.
  • The registered office address, an email address and a phone number.
  • The registration number: with the RCS (Trade and Companies Register) and/or the RNE (National Business Register) for a commercial activity, with the RNE for a craft, liberal or agricultural activity.
  • The individual VAT number, where applicable.
  • The name or company name, address and phone number of the site’s hosting provider.
  • The name of the publication director.

Regulated activities and professions

If your activity requires an authorisation, the page requires you to state the name and address of the authority that issued it. For a regulated profession, you must add the professional title, the applicable professional rules, the State that issued the title and the professional body or organisation you are registered with.

The page also points out that the business must hold the rights to the content it publishes: photos, text, videos, logos. A photo found on the internet is not royalty-free by default.

Personal data: informing your visitors

A contact or quote form collects personal data. According to service-public.gouv.fr, people must be told, at the moment their data is collected, how it will be used. This information covers in particular:

  • The identity and contact details of the data controller, and of the data protection officer if there is one.
  • The data collected, the purposes, the legal basis and whether answers are mandatory or optional.
  • The recipients, the retention period and people’s rights, with how to exercise them.
  • The option to lodge a complaint with the CNIL and, where relevant, transfers outside the European Union.

A data protection policy available everywhere

The page states that a link to the data protection policy must be visible on every page, separate from the terms and conditions. Consent is not always required: it is not, for example, when the processing is needed to perform a contract or meets a legal obligation. If in doubt, the CNIL publishes practical guidance for each situation.

Cookies and trackers: what the CNIL says

A cookie is a small file stored on the visitor’s device. Some are essential for the site to work, others are used for advertising or audience measurement. The CNIL distinguishes between the two.

Those that require consent

According to the CNIL, all trackers that are not used exclusively to provide the service the user asked for require their consent. It cites personalised advertising cookies and social network cookies, including those set by share buttons. An embedded video or an external plugin can also set them: take stock of what your site uses.

Those that are exempt

  • The cookie that stores the visitor’s choice about trackers.
  • Authentication cookies and cookies for login security.
  • Those that keep the contents of a shopping basket.
  • Those that remember an expected interface preference, such as language.
  • Certain audience measurement trackers, under conditions.

The rules for consent

Consent must be collected before any cookie is set, through a positive action, after clear information about the purposes. Accepting and refusing must be equally easy. Visitors must be able to withdraw their choice at any time, as easily as they gave it, for example with a “Manage my cookies” link on every page. Accepting terms and conditions does not count as consent.

If you sell online

According to service-public.gouv.fr, a shop selling to consumers must display its terms and conditions of sale. They set out in particular the characteristics of the products or services, the price incl. VAT, delivery costs and arrangements, the right of withdrawal, the legal guarantees and how disputes are settled. For business customers, the terms and conditions must be available on request.

For a subscription contract, the page states that a free online cancellation function must be available.

The checklist for your site

Open your site on your phone and check each point. Missing information is penalised: the fine amounts are given on the official page.

  • A complete legal notice page, reachable from the footer.
  • A data protection policy, linked from every page.
  • An information notice below each form.
  • A cookie banner with a “Refuse” button as visible as “Accept”, if there are trackers that require consent.
  • A link to change your choice at any time.
  • Terms and conditions of sale, if you sell online.

This guide is not legal advice

Every site has its own particularities. For a specific case, refer to the official pages listed at the bottom of this guide, or to a legal professional. For our part, we set up the legal notice, the data protection page and cookie management on the sites we build, using the information you provide.

Information checked on the official sites on 4 November 2026.

Official sources

Let’s talk about your project.

A free 30-minute first call. We tell you honestly what is worth doing. Reply within two working days.

Discuss my project