The legal pages of a small business website in France: what is mandatory

This article gives general guidance. It does not replace the advice of a legal professional, who will take your exact situation into account.

Even a modest business website must display certain information. Leaving it out exposes you to penalties and, above all, worries careful visitors. Here are the pages to plan, from the most universal to the most specific. They follow French law, which applies to sites published from France.

1. The legal notice: always

The 2004 French law on confidence in the digital economy (LCEN) requires every website publisher to be identifiable. Failing to comply is a criminal offence, with fines of up to €75,000 for an individual.

For a business, the page states:

• the trade or company name, and the legal form;
• the registered office address;
• a phone number and an email address;
• the registration number (trade register or national business register) and, for a company, the share capital;
• the EU VAT number, if there is one;
• the name of the publication director;
• the name, address and phone number of the hosting provider.

Some professions add their own information: professional body, registration number, insurance, ethical rules. This is the case for lawyers, health professionals, architects and estate agents.

A private individual publishing on a non-professional basis may remain anonymous to the public, provided they have given their identity to the hosting provider.

2. The privacy policy: as soon as you collect data

A contact form, a newsletter sign-up, an analytics tool: as soon as a site processes personal data, the GDPR requires informing people (article 13). The privacy policy explains, in plain terms:

• who the controller is and how to reach them;
• which data is collected, why, and on which legal basis (consent, contract, legitimate interest, legal obligation);
• how long it is kept;
• who receives it, including providers (host, email service) and any transfer outside the European Union;
• people's rights (access, rectification, erasure, objection, restriction, portability) and the option to complain to the CNIL, the French data protection authority.

The common mistake: copying another site's policy. It then describes processing you do not do, and forgets what you actually do. Start from reality: list your forms and tools, then write.

3. Cookies: a banner only when needed

Cookies strictly necessary for the site to work (cart, session, remembering the language choice) need no consent. Others, notably advertising and most analytics tools, do.

According to the CNIL's guidelines:

• refusing must be as easy as accepting, with a "Reject all" button at the same level as "Accept all";
• no cookie requiring consent is set before the choice;
• the choice can be changed at any time, for example from a footer link;
• the CNIL recommends keeping the choice for six months.

The best option for a small business website: do without non-essential cookies. Some analytics tools, properly configured, are exempt from consent; the CNIL publishes the configurations it has reviewed. With no cookie requiring consent, there is no banner at all, and a short cookie page is enough.

4. Terms of sale: if you sell online

A site selling products or services to consumers must present its terms of sale before the order, and have them accepted. They state in particular:

• the essential characteristics and the price including taxes;
• payment, delivery or performance terms;
• the 14-day right of withdrawal and its exceptions;
• the legal guarantees of conformity and against hidden defects;
• the consumer mediator the customer can contact free of charge, whose appointment is mandatory.

For downloadable digital content, such as a template, the right of withdrawal can end when the download starts, provided the customer expressly agreed to immediate performance and acknowledged losing that right. Without both, they keep their 14 days.

A site presenting a business without selling online (a builder receiving quote requests) does not need online terms of sale, but its terms must be given to the client before the quote is signed.

5. Terms of use: optional but useful

Terms of use are not mandatory. They become useful as soon as visitors can act on the site: create an account, post a review, upload a file. They set the rules of that use and the consequences of breaking them.

Where to put these pages

In the footer of every page, with explicit labels: "Legal notice", "Privacy", "Cookies", "Terms of sale". Search engines do not need them; your visitors do.

Saving time without copying

Forge's legal page generator produces a legal notice, a privacy policy, a cookie page, terms of sale and terms of use from your answers to a questionnaire, in HTML or Markdown. The generated texts are templates: have them reviewed by a professional before publishing, especially if your business is regulated.