The legal notices refer to all the information that a website must display to identify its responsible parties. This obligation, established by the law for confidence in the digital economy (LCEN) of June 21, 2004, applies to all websites, whether they are professional, associative, or personal with a commercial purpose. The protection of online privacy is based on a second regulatory pillar, the GDPR, which governs the collection and processing of visitors’ personal data.
Trackers and ePrivacy Directive: what the cookie banner does not cover
Most websites display a cookie consent banner. This interface reflects only part of the obligations related to trackers.
The guidelines from the European Data Protection Board on Article 5(3) of the ePrivacy Directive encompass much more than just traditional cookies. Tracking pixels, unique identifiers, and link tracking mechanisms are also included in the scope. A compliance audit limited to just the cookie banner leaves blind spots.
The control also focuses on the actual balance between accepting and refusing trackers. The CNIL fined Google 325 million euros on September 1, 2025, in a case where the cookie refusal procedure was deemed more burdensome than acceptance. This type of sanction shows that compliance is not limited to displaying a banner but requires real symmetry between the choices offered to the user.
To obtain more information about Secrets d’Hommes and their transparency policy, the legal notices page of the site details the trackers used and their associated purposes.
Mandatory legal notices: content according to the publisher’s status
The content of the legal notices varies depending on whether the publisher of the site is a natural or legal person, and according to the nature of their activity.
For a company or an association, the notices must include:
- The company name, registered office address, phone number, and contact email address
- The registration number in the trade and companies register (RCS) or the trades directory, as well as the VAT number if applicable
- The name of the publication director and the contact details of the site’s host (company name, address, phone)
Regulated professions (lawyers, doctors, accountants) must add a reference to the applicable professional rules and the authority that granted the right to practice. E-commerce sites supplement this information with their general terms of sale.
The absence of legal notices or their incomplete nature exposes the publisher to criminal sanctions provided by the LCEN.
GDPR and personal data: information obligations towards visitors
The General Data Protection Regulation requires any site collecting personal data (contact form, newsletter subscription, account creation) to clearly inform the individuals concerned.
This information must specify the purposes of the processing, the legal basis used (consent, legitimate interest, execution of a contract), the recipients of the data, and the retention period. The visitor must also be aware of their rights: access, rectification, erasure, portability, and objection.
A often overlooked point: deleting a data point and removing it from a search engine are two distinct processes. The right to erasure, provided by Article 17 of the GDPR, obliges the data controller to delete the data. Dereferencing from a search engine is a separate request, addressed directly to the search engine operator. The two procedures do not yield the same result and may sometimes need to be carried out in parallel.
Generative AI and privacy: recent recommendations from the CNIL
The rise of generative artificial intelligence systems raises new questions regarding online privacy protection. In February 2025, the CNIL published recommendations on the application of the GDPR to AI systems.
When an AI model is trained with personal data that may be retained, the individuals concerned must, in principle, be informed of this use. The CNIL also recommends integrating privacy protection from the design stage of the system, according to the principle of privacy by design already included in the GDPR.
This aspect remains absent from the majority of current legal notice pages. A site that uses a chatbot or an AI tool processing visitor data should mention this processing in its privacy policy, specifying the purposes and the safeguards in place.
Consent on the web: what distinguishes real compliance from mere display
Displaying a consent collection form is not enough to comply with the GDPR. Consent must be free, specific, informed, and unambiguous. In practical terms, this means that pre-checked boxes are prohibited and that refusal must be as easy as acceptance.
Three criteria allow for the evaluation of the real compliance of a consent mechanism:
- The refusal button is visible at the same level as the acceptance button, without muted color or ambiguous wording
- Each processing purpose can be accepted or refused individually, not just in bulk
- The withdrawal of consent is accessible at any time from a clearly identified page of the site
The CNIL has increased controls on these points. Sanctioned companies have often been penalized not for the total absence of a banner, but for unbalanced consent mechanisms making refusal more cumbersome than acceptance.
The compliance of a website relies on the articulation between complete legal notices, detailed privacy policy, and balanced consent mechanism. These three layers do not function in isolation: a site with impeccable legal notices but a cookie banner that steers towards acceptance remains exposed to sanctions.
