The obligation to display legal notices on a website is based on a specific text: the Law for Confidence in the Digital Economy (LCEN) of June 21, 2004. Since the SREN law of May 21, 2024, the identification provisions for the publisher, the publication director, and the host have been moved from Article 6, III to Article 1-1. The associated penalty is now found in Article 1-2. The essence of the obligation has not changed, but its codification has been reorganized.
SREN Law of May 2024: What Has Changed in the Codification of Legal Notices
Most online articles still cite Article 6 of the LCEN as the sole basis. This reference has been partially outdated since the enactment of Law No. 2024-449 of May 21, 2024. The identification obligations have migrated to Article 1-1, while the criminal penalties are grouped in Article 1-2.
In practice, the required content remains the same: name or corporate name of the publisher, contact details, identity of the publication director, contact details of the host. What changes is the architecture of the reference text. A legal audit based solely on the old Article 6, III overlooks the new legislative structure.
For a concrete example of a compliant page, the legal notices of the Digital Breizh site illustrate how to structure this information in a readable and up-to-date format.
Legal Notices and GDPR Privacy Policy: Two Distinct Obligations
Confusing legal notices and privacy policy is a common mistake, even among web service providers. Legal notices identify the publisher, while the privacy policy governs the processing of personal data.
As soon as a site collects personal data (contact form, newsletter, analytical cookies), Articles 13 and 14 of the GDPR require specific information to be provided at the time of collection. This information pertains to the purposes of processing, the legal basis chosen, the retention period, and the rights of the individuals concerned.
A page of legal notices does not replace this GDPR information. Both can coexist on the same page, provided that each block is clearly identified. However, legally, the absence of a privacy policy constitutes a distinct breach from the absence of legal notices, with different supervisory authorities: the CNIL for personal data, and the courts for identification notices.
GDPR Elements Often Missing from Legal Notice Pages
- The legal basis for processing (consent, legitimate interest, contractual performance): many sites simply state “your data is protected” without specifying the legal basis
- The retention period for collected data, which must be indicated explicitly or by reference to an objective criterion
- The contact details of the Data Protection Officer (DPO) when designation is mandatory, or alternatively, the contact point to exercise rights
Penalties for Absence of Legal Notices on a Professional Site
The absence of legal notices is a criminal offense. For individuals, the LCEN provides for a penalty of up to one year in prison and a fine. For legal entities, the amount of the fine is multiplied according to the usual rules of the penal code.
Beyond the theoretical penalty, we find that the real risk mainly materializes in two situations: a competitor reporting the breach, or an unhappy consumer contacting the DGCCRF. Official checks remain rare for small sites, but a third-party complaint triggers a rapid procedure.
For e-commerce sites, the risk is heightened. Legal notices accumulate with the pre-contractual information obligations of the consumer code: identity of the seller, withdrawal conditions, legal guarantees. A commercial site without complete legal notices is exposed to administrative and criminal sanctions on multiple simultaneous grounds.
DSA and Platforms: Obligations That Add to Classic Legal Notices
The Digital Services Act (DSA) imposes additional requirements on intermediary services and online platforms. We are talking here about mechanisms for reporting illegal content, obligations for transparency on moderation, and periodic reporting.
These obligations do not replace LCEN legal notices. They overlay them. A host of third-party content or a marketplace must display its classic identification notices and meet DSA requirements, under penalty of distinct sanctions.
What the DSA Changes in Practice
- A single point of contact must be designated for authorities and users, with publicly accessible contact details
- The general terms must mention moderation policies, internal appeal mechanisms, and the algorithmic recommendation tools used
- Platforms reaching certain audience thresholds are subject to independent audits and enhanced advertising transparency obligations
For a classic showcase site, the DSA does not add direct constraints. But as soon as a site allows third parties to publish content (open comments, marketplace, forum), the boundary between editorial site and intermediary service deserves analysis.
Drafting Legal Notices: Persistent Technical Errors
Displaying a legal notice page is not enough if its content is incomplete or outdated. Among the recurring defects: the absence of the RCS number or the registration number in the trades register for artisans, the omission of the name of the publication director, or host contact details limited to a simple trade name without an address.
Each legal status imposes specific notices. A sole proprietor must indicate their SIRET number and the city of registration in the RCS or the trades directory. A company adds the amount of share capital, the address of the head office, and the VAT number if applicable. Regulated professions must mention the authority that granted the license to practice and the applicable professional rules.
A final often overlooked point: legal notices must remain accessible from all pages of the site, generally via a footer link. An orphan page, not linked, or accessible only via a direct URL does not meet the accessibility requirement set by the LCEN.
