Mandatory information on a company's website
Verified 13 October 2026 - Entreprendre Service Public / (Prime Minister)
The website of a company (whether it is a business or an individual business) must display multiple mandatory particulars. The absence of this information on the site is punished.
A professional website must in particular:
A professional website should enable users toeasily identify the company that edits it and its host. Some information must therefore be included: it constitutes what is known as legal notice.
For a legal person (businesses such as SAS, SARL, SA, etc.) | For a natural person (individual business or micro-company) | |
|---|---|---|
Identity of the company | Company name, legal form and amount of share capital. | Surname and first name, accompanied by the words " individual contractor » or initials « IS » for an individual entrepreneur. |
Contact details of the company | Address of head officecompany, email address and phone number to contact the company. | Address of domiciliation of company, email address and phone number to contact the company. |
Identification of the company | Depending on the type of activity:
| Depending on the type of activity:
|
TVA | Individual TVA identification number, where applicable. | Individual TVA identification number, where applicable. |
Website host | Name or corporate name of the host, address and telephone number. | Name or corporate name of the host, address and telephone number. |
Warning
These statements may be inserted in the general terms and conditions (CGV) or on a dedicated page. Failure to comply with this obligation to provide information shall be punishable by €375,000 fine for a business and €75,000 fine for an individual business (micro-entrepreneur or non-micro-entrepreneur scheme).
Other mandatory particulars may be added as appropriate:
- For a site publishing an online public communication service, the name of the publisher, the name of the editor, if any, and the contact details of thesite host.
- The photographs, illustrations, texts, videos, logos and other content used on the site may be protected by intellectual property rights. The company must therefore ensure that it has the necessary rights to use them, for example by obtaining the authorization of their author or by using content whose license allows this use.
- If it is a regulated activity, the website must indicate the name and address of the authorizing authority. For example, a private security company must mention the French national council for private security activities (CNAPS), while a road freight company must indicate the name and address of the Dreal: titleContent competent authority, if that authority is the authority which issued its authorization to practice.
- If the company exercises a regulated profession, it must display the professional title, the applicable professional rules, the Member State where the title was granted and the name of the professional body or association with which it is registered. For example, an architectural firm must mention its professional title and the information relating to its registration with the Order of Architects.
Information about the publisher of an online public communication service
Penalties for failure to comply with a mandatory requirement
Obligations of intermediary service providers
Mandatory information to be included on a professional website
Creating a professional website implies compliance with the obligations related to the protection of personal data.
One personal data refers to any information relating to a natural person identified or identifiable, directly or indirectly, by means of an identifier or one or more elements specific to its identity (surname, first name, e-mail address, location, IP address, identity card number, photo, etc.).
The identification of a natural person can be carried out on the basis of a single data item (a name for example) or on the basis of a data intersection (a man living at a given address, born on a given date and a member of an association, for example).
When a company collects, consults, uses, saves, modifies, retains or deletes the personal data of an Internet user, it carries out a " processing of personal data ».
Example :
Filling out a contact form, keeping a customer's contact details, using their e-mail address to send them a newsletter or deleting their data constitute personal data processing.
The company must therefore identify the data it uses, determine why and how it uses them, inform the data subjects and, where necessary, obtain their consent.
1Identify the personal data collected
The company must first identify the personal data that its site allows to collect or use.
In particular, it must check the various functionalities of the site:
- Contact form : name, e-mail address, telephone number, message content
- Creating a customer account : identity, e-mail address, password, delivery address
- Order online : contact details necessary for ordering, delivery and billing
- Subscription to a newsletter : e-mail address
- Online appointment booking : identity, contact details and information required for the appointment
- Personal space : information associated with the account and its use
This verification also makes it possible to distinguish personal data from information that does not make it possible to identify a natural person. The general contact details of a company, such as a generic e-mail address or the switchboard telephone number, do not in themselves constitute personal data.
The company must also ensure that collect only the data necessary for the objective pursued. For example, a form that simply asks for information does not, in principle, need to ask for the date of birth of the Internet user.
2Determine how data is used
For each data collected, the company must determine why it is collected and what it will do with it.
In particular, it must ask itself:
- Why is this data collected? : For example, the email address is collected to respond to a request sent from the contact form.
- Is it necessary for this purpose? : For example, the phone number is not required if the company only replies by e-mail.
- Who will be able to access the data? : For example, the sales department or a service provider responsible for managing appointments.
- How long will they be kept? : For example, the data of a contact request may be retained for the time necessary for its processing and then deleted according to the applicable retention rules.
- Will the data be used for another purpose? : For example, an email address provided to receive a response cannot be automatically used to send a newsletter if the conditions for such prospecting are not met.
The company must also determine, for each treatment, which legally allows him to use the data: performance of a contract, compliance with a legal obligation, legitimate interest or consent. Consent is therefore not always necessary.
Please note
This step is important because it then allows to determine what information to provide to the user and whether to obtain his consent.
3Inform people about the use of their data
At the time of collection of personal data, the user must be informed (when filling out a contact form, for example). It must also be informed in the event of a subsequent change in their use.
When the site collects personal data, the company must inform the data subjects of how their data will be used.
This information must be clear, understandable and easily accessible. In particular, it must specify:
- Identity and contact details of the company responsible for data processing : name or company name, address, contact details and, where designated, contact details of the Data Protection Officer (DPO).
- Personal data collected : the categories of data collected, for example name, e-mail address, telephone number or login data.
- Purpose pursued by the processing : the use that will be made of personal data, for example to process an order, respond to a contact request or send a newsletter.
- Legal basis for processing : the reason that allows the company to process the data, for example the consent of the user, the performance of a contract or compliance with a legal obligation.
- Mandatory or optional collection of personal data : the data that must be provided and the consequences of not providing it, for example the impossibility of processing an order.
- Recipients of personal data : the persons or bodies likely to have access to or receive them, for example employees of the company, an IT service provider or a carrier.
- Retention period of personal data : the period for which the data are kept or, where this period cannot be specified, the criteria for determining it.
- Rights of the user on his data: in particular the right to access, rectify, request deletion or, in certain cases, oppose or request the limitation of their processing.
- Modalities for the exercise of these rights : the means by which one can exercise one's rights, for example an email address, a postal address or an online form.
- Right of the user to lodge a complaint with the Cnil: titleContent : the possibility to contact Cnil if the user considers that his personal data is not processed in accordance with the applicable regulations.
- Transfer of data to a country outside the EU, where necessary : for example, where the data is hosted or accessed from a country outside the EU, information on that transfer and the safeguards put in place.
- Possibility to withdraw consent, when the treatment is based on it : for example, the possibility of unsubscribing from a newsletter or withdrawing consent to the use of certain data.
The Cnil provides various examples of information:
Please note
Failure to provide any such information shall be punishable by a fine of €1,500.
On the website, it is possible to use a link directly to the data protection policyclearly visible on each page of the site, clearly titled (" Personal data ’ or ‘ Confidentiality » for example).
This privacy policy must be distinct from the general terms and conditions of sale (CGV) or the general terms and conditions of use (GCU) of the website.
4Collect consent when necessary
The company must determine, for each use of personal data, if the consent of the user is necessary.
The consent is not routinely required : the data may in particular be used without this agreement when they are necessary for theperformance of a contract (order, delivery or creation of a customer account) or imposed by legal obligation (e.g. retention of certain data to comply with an accounting obligation). Other situations may fall within the scope oflegitimate interest of the company or a mission of public interest.
Example :
The contact details necessary for the delivery of an order may be used without obtaining consent, as such use is necessary for the performance of the contract. However, using the e-mail address for a newsletter requires the explicit consent of the user unless the latter has already purchased a similar product in the company or is a professional.
To determine whether consent is necessary or whether another possibility is available to use the data (contract, legal obligation, legitimate interest, etc.), consult the Cnil fact sheets on the legal basis:
When the consent is necessary, it must be free, specific, enlightened and unambiguous. The user must be able to accept or refuse the treatment and withdraw his consent at any time. The company must also be able to prove that it has obtained such consent.
Please note
The fact that a user gives his consent for a specific use of data does not automatically apply to another use. For example, the email address provided to receive a response to a contact request cannot be used to send a newsletter without the conditions for sending it being met.
To learn more about the collection of consent from internet users :
GDPR compliance: how to collect people's consent?
French data protection agency, Cnil
Pour en savoir plus
Please note
The computer processing of data collected without consent shall be punished by €300,000 a fine and 5 years' imprisonment.
The information collected during these various steps may in particular be grouped together in the Register of processing activities (RAT). This register makes it possible in particular to identify the personal data used, their purposes, the legal basis for the processing, the recipients or the storage periods.
For learn more about the register of processing activities :
EvalRGPD allows online measurement of the company's level of GDPR compliance :
EvalRGPD: the free self-diagnosis to assess a company's GDPR compliance
Penalties for personal data collected without consent
Penalty for failure to provide information about a user's personal data
Websites may use cookies and other trackers to ensure their operation, measure their attendance or display targeted advertisements. The company must inform Internet users about the use of these devices and, when necessary, obtain their consent.
To do so, it must identify the cookies and others plotters used on its website and identify their purpose. It must then determine which ones require consent: for example, advertising trackers in principle require prior consent, unlike certain trackers strictly necessary for the operation of the site.
To determine if consent is required, the Cnil: titleContent makes available to the user the list of cookies and other tracers identifying their purpose and the conditions under which they may be used without consent:
Cookies and trackers: how do I bring my website into compliance?
French data protection agency, Cnil
Pour en savoir plus
Where consent is required, one consent banner must allow the user to accept or refuse the tracers as easily, and to choose those that he authorizes.
Example :
A website uses cookies to display personalized advertisements. These cookies must not be placed before the user has accepted their use. The headband may propose « Accept everything », « Refuse All » and access to the finality setting.
The company must also allow the user to modify or withdraw his consent at any time, for example through a link " Manage my cookies » accessible from all pages of the site.
Example :
An Internet user who has accepted advertising cookies during his first visit must be able to return to this choice without having to search for the browser settings or contact the company.
For know all the rules applicable to the use of cookies and other tracers :
Rules applicable to the use of cookies and other tracers
French data protection agency, Cnil
Pour en savoir plus
Please note
To learn more, see our practical fact sheet on the management of cookies and other tracers on a company's website.
When a website sells products or services online, the company must provide certain information to the customer and comply with specific regulations when concluding and executing the contract.
The general terms and conditions (CGV) frame the business relationships.
They inform customers, in a legible and understandable manner, of their rights and obligations when selling products and/or services.
This transparency obligation significantly reduces the risk of litigation between customers and the company.
The mandatory nature and content of the general terms and conditions of sale vary depending on whether the offer of goods or services is addressed to private individuals or to professional :
Individual Customers
CGV must be included obligatory on the website. Failure to comply with this obligation to provide information is punishable by €15,000 of fine.
The general conditions of sale must contain the information following:
- Essential characteristics of goods and/or services
- Price TTC: titleContent in euro
- Costs, date and delivery terms
- Terms of performance of the contract
- Payment methods: authorized methods of payment and question of late payment
- Right of withdrawal: deadline and conditions for canceling and returning the order
- Legal guarantee of conformity and guarantee of hidden defects
- Commercial warranty and after-sales service: cost of remote communication
- Duration of the contract and conditions for termination, if applicable
- Deposit or guarantee to be provided by the customer, if applicable
- Minimum duration of the customer's contractual obligations, if applicable
- Existence of a code of conduct applicable to the contract, if applicable
- Dispute resolution: competent court and possibility of recourse to a mediator
Business Customers
Enter professional, the CGV: titleContent are optional, but they must be available upon request.
Refusal of communication is punishable by €75,000 of fine.
The general conditions of sale must contain the following information:
- Price HT: titleContent in euro: price schedules or method of price calculation
- Discounts and discounts: price reductions, one-time promotional discounts and deferred discounts. They must be set according to precise and objective criteria.
- Commercial discounts: discount granted to a customer in case of prepayment
- Payment methods: authorized payment methods and penalties applied in case of delay
- Charges and delivery date
- Dispute resolution: competent court
It is also possible to add a retention of title clause, a limitation of liability clause, a clause relating to cases of force majeure or the conditions of termination of the contract.
Please note
Of Separate CGV may be imposed for each category of customer (wholesalers, retailers, etc.). In this case, customers in a category can only require the disclosure of the CGV that concerns them.
For more information, refer to the fact sheet on general terms and conditions (CGV).
In addition, any company subject to extended producer responsibility (EPR) must mention its unique identification number (UDI) and the environmental characteristics of its products.
Please note
Other obligations apply to traders who sell products or services online, in particular concerning the information to be provided before ordering and concluding the contract. Consult the sheet « Doing e-commerce ».
General obligation to provide pre-contractual information
Since 1er june 2023, a free feature must be made available to the consumer to allow him to terminate your online subscription agreement. That obligation applies even when the original contract has not been concluded electronically.
To meet this obligation, the following steps must be implemented:
1Implement an easily accessible termination feature
The functionality to terminate a subscription must be directly and easily accessible from the website or mobile application on which the contract can be concluded.
It must be clearly identifiable, with the « terminate your contract » or an equivalent formula that leaves no ambiguity and is displayed in legible characters. It must also present, in a legible and comprehensible manner, the terms of termination applicable to the contract, in particular the possible existence of a notice period, compensation for termination or the consequences of termination.
Please note
The trader may not require the consumer to create a custom space at the time of notification of termination to access this feature. On the other hand, he can ask him to use a personal space that he would have created previously.
2Allow contract identification
Termination functionality must include headings for the consumer to provide or confirm the information necessary to identify the contract.
It must thus make it possible to provide or confirm:
- the surname and first name the consumer or, where the contract has been concluded with a legal person, sa reason or corporate name
- one email address or, failing that, a postal address enabling the trader to confirm receipt of the notification
- any reference previously communicated by the professional to identify the holder and the contract concerned, for example a customer or contract number
- the desired termination date, subject to the applicable legal or contractual provisions
- for electronic communications services, the telephone number corresponding to the line(s) concerned
Please note
When the contract can be terminated before its term for a legitimate reason (moving, hospitalization, etc.), the functionality must allow the consumer indicate this reason and provide the requested proof. For this, it must indicate a e-mail address and a postal address to send this proof, or to propose its transmission directly online.
Example :
The consumer may terminate in advance its internet subscription contract if it is the subject of a over-indebtedness. The functionality must allow it to transmit the decision of the judge granting its request for treatment of a situation of over-indebtedness.
3Allow verification of information
After filling in or confirming the necessary information, the consumer must access a summary page allowing it to verify the information provided and, if necessary, to modify it.
This page should allow the consumer to notify its termination by activating a function directly accessible from the summary page. This function shall be presented under the « notification of termination » or in an analogous formula, unambiguously and displayed in legible characters.
4Confirm receipt and notify termination of contract
Upon receipt of the request, the company shall confirm to the consumer that it has received its notice of termination.
It must then inform him, on a durable support and within a reasonable time, the effects of the termination and the date the contract ends.
Warning
The absence of functionality allowing online termination is subject to a fine of €75,000 for a natural person (individual business or micro-company) or a fine of €375,000 for a business.
For learn more about the so-called « termination » in 3 clicks » :
Implementation of the functionality
Information to be collected
Notification of termination
Online Termination
Administrative penalties
Who can help me?
The Public Service company Advisors
Do you have a project, a difficulty, a question of everyday life?
Simple and free: you are called back within 5 days by THE advisor who can help you.
By post
3 Place de Fontenoy
ASD 80715
75334 Paris cedex 07
Cnil does not receive the public and does not provide any information on the spot.
By phone
+33 1 53 73 22 22
Telephone reception open Monday to Friday from 9:30 am to 5 pm.
Legal information open on Monday, Tuesday, Thursday and Friday from 10am to 12pm.
By email
Access to contact form
General obligation to provide pre-contractual information
Online Termination
Implementation of the functionality
Information to be collected
Notification of termination
Administrative penalties
Penalties for infringements of human rights resulting from computer files or processing (legislative part)
Penalties for infringements of human rights resulting from computer files or processing (regulatory part)
Obligation to inform the user of the use of cookies and other tracers
Information about the publisher of an online public communication service
Penalties for failure to comply with a mandatory requirement
Obligations of intermediary service providers
Mandatory information to be included on a professional website
French data protection agency, Cnil
French data protection agency, Cnil
French data protection agency, Cnil
French data protection agency, Cnil
French data protection agency, Cnil
French data protection agency, Cnil
French data protection agency, Cnil
France Num
