The legal notices of an e-commerce site are not limited to a copy-paste of a template found online. They engage the responsibility of the publisher under the law for confidence in the digital economy (LCEN) of June 21, 2004, and must reflect the legal and operational reality of each online sales activity.
Relationship between legal notices, general terms and conditions of sale, and privacy policy on an e-commerce site
We regularly observe confusion between three mandatory but distinct documents. The legal notices identify the publisher of the site. The general terms and conditions of sale (CGV) frame the commercial relationship. The privacy policy details the processing of personal data.
Merging these documents into a single page undermines compliance. The CNIL recommends treating the privacy policy as a separate and operational document, specifying the purposes, legal basis, recipients, retention periods, and how to exercise rights. Integrating it as a simple clause in the legal notices exposes a significant lack of transparency.
For a concrete example of compliant architecture, the legal notices of the site www.bebe-9.ch illustrate this separation between the identification of the publisher and the reference to dedicated contractual documents.
Each document responds to a different legal text: LCEN for legal notices, Consumer Code for CGV, GDPR for the privacy policy. A shortcoming in one does not compensate for the presence of the other.
Mandatory information of the publisher: what the LCEN really requires
The LCEN imposes a set of information allowing for unambiguous identification of the editorial manager of the website. For a legal entity operating an online sales site, the following information is required:
- Company name, legal form, address of the registered office, amount of share capital, and registration number with the trade and companies register (RCS)
- Name of the publication director and contact details including an email address or phone number
- Name, designation, or business name and address of the website host
- VAT number if the company is subject to it
For self-employed individuals or natural persons, the personal address may be replaced by that of the domiciliary, provided that they forward the correspondence. The omission of even one of these mentions constitutes an offense punishable by criminal sanctions.
Regulated activities add specific obligations. A site selling health products must mention the authority that issued the operating license. A site selling alcohol must remind users of the applicable legal restrictions.
Cookie and tracker obligations: a distinct scope from legal notices
The legal notices do not cover obligations related to cookies and trackers. The CNIL has repeatedly reminded that merchant sites must inform users and obtain their consent before installing any cookie that is not strictly necessary for the functioning of the service.
In practice, this implies three elements separate from the legal notices:
- A consent banner or module presented on the first visit, with a refusal button as accessible as the acceptance button
- A dedicated page for the cookie policy detailing each category of tracker (analytical, advertising, social networks) with their purpose and lifespan
- A mechanism allowing the user to modify their choices at any time, accessible from every page of the site
Failure to comply with these rules is subject to active monitoring. The CNIL has imposed significant sanctions against merchant sites that only included a generic mention in their legal notices without a real consent mechanism.
Email commercial prospecting: a separate compliance risk
Email or SMS prospecting is often treated as a secondary topic to legal notices. We recommend addressing it as a standalone compliance risk. Prior consent from the recipient is the rule for individuals (B2C).
The exception for existing customers is strictly regulated: it only applies if the products or services offered are similar to those already purchased, and provided that a simple opt-out option was offered during the initial collection, and then in each subsequent message.
The CNIL specifies that a message presented as relational (order confirmation, delivery tracking) can be requalified as prospecting if it contains a significant promotional component. Inserting a commercial offer into a transactional email without consent exposes one to a sanction.
Keeping legal notices up to date: concrete triggers
Legal notices drafted at the creation of the site quickly become outdated. Any change in legal form, registered office, host, or publication director requires immediate updating.
A change of payment provider or the addition of a new sales channel (marketplace, mobile app) can also modify reporting obligations. The transfer of hosting to a server located outside the European Union, for example, has direct consequences on the data protection policy that must be consistent with the legal notices.
Quarterly verification of these documents is not an excess of caution. It is the minimum rhythm for an active e-commerce site whose technical infrastructure and business partners evolve regularly.
