Mandatory legal notices for a French startup: a complete guide

You do not have to have a website to create a startup. But once it goes live, you become the publisher of an “online public communication service” and must publish specific, easily accessible and current legal notices. In France, this requirement comes from Article 6, III of the LCEN (Law no. 2004‑575 of 21 June 2004), available on Legifrance — French legislation portal. This guide gives you the exact list, a ready-to-use template and the GDPR/cookie/terms-of-sale additions to remember.

Who is concerned and when should legal notices be published?

Any French startup (SAS/SARL/self-employed entrepreneur) publishing a showcase website, SaaS product, marketplace, blog or mobile app. Notices must be permanently accessible from every page (footer) and updated without delay. Official “Legal notices” guidance on Service Public Pro — business guidance portal reiterates this obligation.

List of mandatory legal notices (LCEN, art. 6, III)

1) Publisher identification (startup incorporated as a company)

• Full company name
• Legal form (e.g. SAS), registered office address
• Amount of share capital
• SIREN number and registration in the Trade and Companies Register (RCS), with the registry's city
• Intra-community VAT number (if subject to VAT)
• Contact details (business email, telephone)

For a sole trader, give the surname, first name, home or business address and contact details (LCEN via Legifrance — French legislation portal and reminder on Service Public Pro — business guidance portal).

2) Publication management and hosting provider

• Publication director (often the president of the SAS)
• Responsible publisher where publication is jointly directed
• Hosting provider: name, postal address and telephone

3) Regulated activities (where applicable)

• Professional title, granting State, references to the professional body/supervisory authority
• Administrative authorisation number if required

These requirements derive from the LCEN and practical guidance from Service Public Pro — business guidance portal.

Strongly recommended additional notices

• Intellectual property rights (text, visuals, trademarks, software), and credits
• Terms of use and moderation/service-use rules — see the key differences between terms of use and terms of sale
• Procedure for reporting unlawful content

GDPR privacy policy: separate but inseparable

If your website collects personal data (form, user account, non-exempt analytics, chatbot, etc.), you must provide information compliant with Articles 13/14 of the GDPR (Regulation (EU) 2016/679, available on EUR‑Lex — EU law portal) and recommendations from CNIL — French data protection authority.

Minimum policy content

• Purposes and legal bases (e.g. performance of a contract, legitimate interest, consent)
• Retention periods for each purpose
• Recipients (processors, partners), transfers outside the EU and safeguards
• Individuals' rights (access, rectification, objection, erasure, portability, restriction)
• Contact details of the controller and, where applicable, the DPO

Our dedicated guide details the structure and preferred wording: drafting a GDPR privacy policy. Remember the record of processing activities too and, where appropriate, appointing a DPO.

Cookies and trackers: prior consent for non-exempt trackers

Strictly necessary audience measurement cookies may be exempt under certain conditions, but every non-essential cookie/feature (advertising, retargeting, certain A/B tests, social media, embedded videos, etc.) requires freely given, specific, informed and unambiguous consent, obtained before placement. CNIL reiterates: no pre-ticked boxes, a “Reject all” button as visible as “Accept all”, proof of consent and withdrawal as easy as giving consent (CNIL — Cookies).

• Retain the user's choice (CNIL generally recommends a consent validity period of 6 months)
• Avoid dark patterns and respect purpose-specific settings
• Document your choices (CMP, consent log)

E-commerce: terms of sale and pre-contractual information

If you sell to consumers (B2C), terms of sale, the right of withdrawal, essential characteristics, the VAT-inclusive price, delivery/payment costs and arrangements, etc., are mandatory before the order (Consumer Code; summaries on Economie.gouv.fr — French economy ministry). In B2B, terms of sale must be provided to any professional buyer who requests them (Commercial Code; Economie.gouv.fr — French economy ministry).

For online software, adapt your documents: see our practical advice on SaaS terms of sale and our guidance on the distinction between terms of use and terms of sale.

Invoice particulars and electronic invoicing in 2026 (do not confuse them)

Website legal notices do not replace mandatory invoice particulars (identity, RCS, VAT, payment terms, penalties, etc.). The reform of domestic B2B electronic invoicing is being phased in from 2026, with clarifications from the Finance Act 2026 (Entreprendre.Service‑Public — Finance Act 2026). Expect new mandatory structured data and plan updates to your invoicing tools.

Where to publish your notices and how to keep them current

• Place a “Legal notice” link in the footer of every page
• Add links to “Privacy policy” and “Cookies”
• Version the document and date the latest update
• Update without delay after any change (name, registered office, capital, etc.)
• Establish an internal process (ticketing/Legal Ops) for each company change

If you are just starting, our article on the legal steps to create your startup and the INPI single window will help you quickly obtain SIREN/SIRET, RCS and VAT details.

Penalties and risks of non-compliance

• Missing/inaccurate legal notices: offences under the LCEN (criminal) — see the text on Legifrance — French legislation portal
• Cookies/GDPR: formal notices and administrative fines of up to 4% of worldwide turnover (GDPR; CNIL — French data protection authority)
• E-commerce: DGCCRF inspections and penalties for failures to inform consumers (Economie.gouv.fr — French economy ministry)

Legal notice template (SAS) — customise before use

Copy and paste, then replace the bracketed text:

• Website publisher: [Company name] — [Legal form: SAS] with share capital of [amount] € — Registered office: [full address]
• Registered with the RCS of [city] under no. [SIREN] — Intra-community VAT: [no.]
• Contact: [business email] — [telephone] — [contact form URL, where applicable]
• Publication director: [Name, capacity]
• Hosting provider: [Name] — [address] — [telephone]
• Regulated activity (if applicable): [professional title, professional body/authority, granting State, authorisation no.]
• Intellectual property rights: the entire website and its content (text, images, trademarks, logos, software) are protected. Any unauthorised reproduction is prohibited.
• For data protection and trackers, see our Privacy policy and our Cookie policy.

Note: since the GDPR came into force, no “CNIL number” needs to be displayed (prior declarations abolished), except in specific cases still governed by CNIL — French data protection authority.

Implementation checklist (60 minutes)

1. Gather company information (KBIS, SIREN/SIRET, RCS, VAT) — INPI — French industrial property office
2. Draft/update the “Legal notice” page (LCEN)
3. Draft the Privacy policy (GDPR art. 13/14) and enable a compliant CMP (CNIL — French data protection authority)
4. Check your terms of sale/consumer information for e-commerce (Economie.gouv.fr — French economy ministry)
5. Place links in the footer, test mobile accessibility and international access (EN/FR for a bilingual website)
6. Document forms and cookies in your record of processing activities