Legal notice, GDPR, cookies: what your website must contain

A business website isn’t just a showcase: it’s also a medium subject to legal obligations. Forgetting them exposes you to penalties, but above all to a loss of trust from your visitors. Here’s what every professional website in France must contain. This article is a practical guide and doesn’t replace a lawyer’s advice for specific situations.

1. The legal notice

It’s mandatory for every professional website, whatever its size. It must be easy to access, generally via a link in the footer. For a company, it notably includes:

• the company name, legal form, share capital and registered office address;
• the registration number (RCS or trade register) and the intra-community VAT number;
• an email address and a phone number;
• the name of the publication director;
• the name, address and phone number of the website’s host;
• for a regulated profession (lawyer, architect, chartered accountant…): the professional order or body, the title and the applicable rules.

2. The privacy policy

As soon as your website collects personal data, even through a simple contact form, the GDPR requires you to inform people. Your privacy policy must explain:

• what data is collected and why;
• on what legal basis (consent, contract, legitimate interest…);
• how long it’s kept;
• who has access to it, including your providers (host, CRM, email marketing tool);
• whether it’s transferred outside the European Union;
• how to exercise one’s rights (access, rectification, erasure, objection) and the right to lodge a complaint with the CNIL.

Add a short notice under each form, with a link to this policy. If you connect your website to a sales tool, also read our article on connecting your website to a CRM.

3. The cookie banner

Cookies and trackers that aren’t essential to the website’s operation (non-exempt audience measurement, advertising, social media pixels, embedded videos) can only be placed after the visitor’s consent. According to the CNIL’s recommendations:

• no non-essential tracker may be placed before the visitor makes a choice;
• refusing must be as easy as accepting, with a “Reject all” button at the same level;
• visitors must be able to change their choice at any time;
• the choice must be remembered for a reasonable period, generally six months.

Can you do without a banner?

Yes, if your website only places exempt trackers: technical cookies (cart, session) and audience measurement tools configured according to the CNIL’s conditions, such as Matomo or certain privacy-friendly solutions. A website without a banner is more pleasant and often faster. Google Analytics 4, on the other hand, requires consent.

4. For e-commerce websites

• Terms and conditions of sale: prices, delivery, payment, guarantees, the 14-day right of withdrawal and its exceptions.
• Consumer mediator: mandatory for selling to consumers, with their contact details on the website.
• Withdrawal form made available to customers.
• Prices including VAT clearly displayed, shipping costs shown before the order is confirmed.
• An explicit order button, such as “Order with obligation to pay”.

Shopify provides templates for legal pages, but they must be adapted to your business. See our guide to creating a Shopify store.

5. Special cases

• Lawyers: professional conduct rules on advertising and website content, detailed in our article on the lawyer’s website.
• Real estate agencies: mandatory display of fees and the energy performance certificate. See our article on the real estate agency website.
• Accessibility: some businesses have had to make their website accessible to people with disabilities since June 2025. See our explanations.

Our checklist

1. A complete Legal notice page, linked from the footer.
2. An up-to-date privacy policy, linked under each form.
3. A compliant cookie banner, or no non-exempt trackers.
4. Terms of sale if you sell online.
5. Forms that only ask for useful information.

All the websites we deliver include these elements from the design stage. If you have doubts about your current website, we check it during our free audit, and we can bring it into compliance during a redesign. Is your business established in Belgium? See the obligations of a website in Belgium.