An online site for three years, never updated on the legal side: this is the most common scenario. Legal notices are, however, a requirement for any website publisher, whether an independent, a small business, or an association. Since the update of the LCEN by the SREN law of May 21, 2024, some requirements have changed, and old copy-paste models are no longer sufficient.
SREN Law and new Article 1-1 of the LCEN: what has changed for the publisher
Law No. 2024-449 known as SREN (Securing and Regulating the Digital Space) has reorganized the provisions of the LCEN of June 21, 2004, by creating a specific Article 1-1 dedicated to the identification notices of the publisher. In practice, this means that guides published before this date often cite obsolete article numbers.
The most concrete change concerns the obligation to identify all data storage providers, and not just the main host. If your connection logs, customer database, or analytical tools are managed by a third party distinct from your host, their identity must appear in your legal notices. For example, this requirement can be found in the legal notices of Backlink Links, which detail the technical chain beyond just the host.
Many sites still settle for the triptych of publisher, publication director, and host. Since the SREN law, this approach is incomplete as soon as a third-party provider is involved in storage.
Mandatory legal notices: the concrete list according to your status
The content of the notices varies depending on whether one is a natural person or a legal entity. Here we summarize the information required in both cases.
For a sole proprietor or micro-entrepreneur
- Name, first name, and address, accompanied by the mention “sole proprietor” or the initials EI
- Registration number with the RCS, email address, and contact phone number
- VAT identification number
- Complete identity of the host (name or corporate name, address, phone) and, where applicable, of third-party storage providers
- For a regulated activity: name and address of the authority that issued the authorization
For a company
The same information is required, to which are added the corporate name, legal form, and amount of share capital. The address indicated is that of the registered office, not that of the director.
An e-commerce site must supplement its notices with the general terms and conditions of sale, including payment, delivery, withdrawal, and mediation terms. These GTC do not replace the legal notices: they are two distinct obligations.
Personal data and cookies: drafting the GDPR section without jargon
The section related to the protection of personal data is the one that generates the most confusion. We regularly see sites displaying a generic privacy policy with no real link to their operations.
In practice, your legal notices page (or a dedicated page accessible from it) must specify three elements.
First, the purposes of data collection: contact form, newsletter, analytical tracking, shopping cart. Each purpose must be named.
Next, the legal basis for processing. For a contact form, legitimate interest or consent is generally invoked. For a third-party analytical cookie, prior consent is required, and the cookie banner must offer a refusal as simple as acceptance.
Finally, the recipients of the data. If a tool like an external CRM or an email marketing platform receives the collected addresses, it must be mentioned. Naming data processors is a GDPR obligation often overlooked on showcase sites.
Sanctions for absent or incomplete legal notices
Failure to comply with the legal notice obligation is punishable by a fine of up to 75,000 euros for a natural person and 375,000 euros for a legal entity, along with a penalty of up to one year in prison. These amounts are provided for by the LCEN.
Beyond the fine, a site without legal notices loses credibility with clients and partners. Advertising platforms and some professional directories now check compliance before accepting a site.
Feedback varies on this point, but it is noted that checks target e-commerce sites and sites collecting sensitive data more than personal blogs without forms.
Intellectual property and host: two sections often neglected
Notices related to intellectual property are frequently forgotten. If your site uses images, illustrations, or photographs, you must indicate their source and respect copyright. For borrowed texts, permission from the author or at least citation of the source is required.
On the host side, the mention must be complete: corporate name, physical address, and phone number. A simple “hosted by OVH” is not enough. The postal address and phone number of the host are required by law.
Updating your legal notices rarely takes more than an hour, but that hour prevents disproportionate complications. With the SREN law, the primary point of vigilance remains the identification of the complete data storage chain. If your notices page has not changed since 2023, it is probably the first element to correct.
