The legal notices of a website are not just a simple block of text relegated to the footer. The law for confidence in the digital economy (LCEN) of June 21, 2004, requires every publisher of a professional site to make precise identification information accessible. GDPR, cookie management, and digital accessibility have since added layers of obligations. Their accumulation creates a complexity that most sites manage poorly.
Cookies and trackers: control focuses on the effectiveness of refusal
The majority of sites display a cookie consent banner. This banner has become a reflex, almost a design element. The problem is that the CNIL now controls what happens after clicking “refuse”.
Recent decisions reported by the CNIL focus on three specific points: the placing of trackers before any consent, the actual stopping of cookies after a refusal, and the clarity of the advertising purposes presented to the user. In other words, a banner that offers a “refuse” button but continues to place advertising trackers exposes the publisher to sanctions.
This shift from formal control to technical control changes the game. A site can have an impeccable privacy policy and still be in violation because its cookie management tool does not block third-party scripts after a refusal. Document compliance is no longer sufficient; it is the technical behavior of the site that is audited.
This concern for consistency between declaration and practice is found on the legal information on Lordy’s, where each legal element is linked to a concrete operation of the site.
Mandatory legal notices: what the LCEN requires according to the publisher’s status
The content of the legal notices varies depending on whether the publisher is a legal entity, a sole trader, or an individual publishing for non-professional purposes. For a company, the LCEN imposes a precise foundation:
- Company name, legal form, address of the registered office, and amount of share capital
- Registration number with the RCS or Siren number, VAT number
- Contact details (email address, phone) and identity of the site’s host (name or company name, address)
These notices must be easily accessible from all pages of the site. A footer link remains the standard practice. Integrating them into the general terms of sale is possible, provided that access remains direct and permanent.
For e-commerce sites, additional obligations apply: general terms of sale, information on the right of withdrawal, delivery and payment methods. The absence of legal notices on a professional site can lead to a fine of up to one year in prison and a significant financial penalty for individuals.
GDPR and personal data: transparency as a fundamental obligation
The General Data Protection Regulation (GDPR) has added a requirement for transparency that goes beyond simple declaration. Any processing of personal data requires clear information to the data subject: purpose of collection, legal basis for processing, retention period, rights of access, rectification, and deletion.
Information must be provided at the time of data collection, not in a buried document. The data controller must also indicate the recipients of the data and, where applicable, transfers outside the European Union.
Privacy policy and processing register
The privacy policy serves as the reference document for this transparency. It details each processing activity, its purposes, and the rights of the individual. In parallel, the processing register (mandatory for most organizations) remains an internal document, but it structures compliance and may be requested by the CNIL during an audit.
Collecting data without prior information constitutes a violation of the GDPR, even if the data is not sold. A simple contact form generates personal data processing that must be documented.
Digital accessibility: the new layer of transparency since 2025
The European Accessibility Act, transposed in France by law n° 2023-171 and decree n° 2023-931, has made digital accessibility mandatory for certain private sites since June 28, 2025. The services concerned include e-commerce, consumer banking services, passenger transport, electronic communications, and e-books.
Microenterprises with fewer than 10 employees and a maximum turnover or balance sheet total of 2 million euros are exempt. For others, compliance is not limited to making the site technically accessible.
- Publish an accessibility statement explaining how the service meets the requirements
- Provide a means for users to report an accessibility issue encountered
- Offer an alternative solution when content is not accessible
This obligation adds a new aspect of public transparency. A site must now account for its level of accessibility, not just its identity or data management. Field feedback varies on the maturity of automated audit tools to verify this compliance, making the topic even more fluid for publishers of mid-sized sites.
Sanctions and controls: a framework that is tightening in layers
Each regulatory text carries its own sanctions. The LCEN provides for criminal penalties for the absence of legal notices. The GDPR allows the CNIL to impose administrative fines proportional to turnover. Digital accessibility also comes with control and reporting mechanisms.
The accumulation of these obligations creates a risk of partial compliance: a site can be impeccable in its legal notices but deficient in the effective management of cookies, or compliant with the GDPR but lacking an accessibility statement. The transparency of a website is now measured across multiple simultaneous axes, and none compensates for the other.
The legal framework continues to evolve. The AI Act, which is being gradually implemented, could eventually impose new transparency obligations on sites using artificial intelligence systems in their interactions with users. For now, the priority remains to solidly cover the three existing pillars: publisher identification, personal data protection, and accessibility.
