Legal notice and privacy policy generator for a website in France
Free, no e-mail
Nothing is saved
Word and copy in one click
Step 1 of 5
Who publishes the website
Your status decides what the legal notice must show. An empty field stays marked “to complete” in the text.
You are:
French law asks for a phone number. A business line is fine.
For a business, the address is mandatory. If you work from home, you can give the business’s registered address (premises, domiciliation company) when it has one.
Nothing is saved: everything happens in your browser.
Live preview
10 items to complete
The documents are always written in French, for a website run in France. Only this page is in English.
Mentions légales
Éditeur du site
Le site [À COMPLÉTER : adresse du site] est édité par :
Nom : [À COMPLÉTER : nom ou raison sociale], entrepreneur individuel (EI)
Adresse : [À COMPLÉTER : adresse]
Téléphone : [À COMPLÉTER : téléphone]
E-mail : [À COMPLÉTER : adresse e-mail]
SIREN ou SIRET : [À COMPLÉTER : numéro SIREN ou SIRET]
Immatriculation : Registre du commerce et des sociétés (RCS) de [À COMPLÉTER : ville du greffe]
TVA : TVA non applicable, article 293 B du CGI
Directeur de la publication
[À COMPLÉTER : nom ou raison sociale]
Hébergement
Le site est hébergé par :
Hébergeur : [À COMPLÉTER : nom ou raison sociale de l’hébergeur]
Adresse : [À COMPLÉTER : adresse de l’hébergeur]
Téléphone : [À COMPLÉTER : téléphone de l’hébergeur]
Données personnelles et cookies
La façon dont ce site recueille et utilise vos données personnelles, et les cookies qu’il dépose, sont expliqués dans sa politique de confidentialité.
Propriété intellectuelle
Les textes, photos et éléments graphiques de ce site sont la propriété de [À COMPLÉTER : nom ou raison sociale] ou sont utilisés avec l’accord de leurs auteurs. Leur reproduction sans autorisation est interdite.
Politique de confidentialité
Qui est responsable de vos données
Le responsable du traitement des données recueillies sur [À COMPLÉTER : adresse du site] est [À COMPLÉTER : nom ou raison sociale], [À COMPLÉTER : adresse]. Pour toute question sur vos données : [À COMPLÉTER : adresse e-mail].
Les données recueillies, pourquoi, et sur quelle base légale
Formulaire de contact : nom, adresse e-mail, téléphone le cas échéant et message, pour répondre à votre demande. Base légale : notre intérêt légitime à répondre aux messages reçus (article 6.1.f du RGPD), ou des mesures précontractuelles quand vous demandez un devis (article 6.1.b).
Qui reçoit vos données
Vos données sont destinées à [À COMPLÉTER : nom ou raison sociale] et ne sont ni vendues ni louées. Elles peuvent être traitées, pour notre compte, par nos prestataires techniques :
l’hébergeur du site, [À COMPLÉTER : nom ou raison sociale de l’hébergeur]
Transferts hors de l’Union européenne
Certains de nos prestataires (par exemple Google, Meta ou un prestataire de paiement) peuvent transférer des données hors de l’Union européenne, notamment aux États-Unis. Ces transferts sont encadrés par les garanties prévues par le RGPD : une décision d’adéquation de la Commission européenne ou des clauses contractuelles types.
Combien de temps nous les gardons
Demandes de contact, si vous n’êtes pas devenu client : 3 ans à compter de la demande ou de votre dernier contact (référentiel de la CNIL sur la gestion commerciale).
Cookies et autres traceurs
Ce site ne dépose que les traceurs nécessaires à son fonctionnement, qui ne demandent pas votre accord.
Vos droits
Vous pouvez demander à accéder à vos données, à les faire rectifier ou effacer, à en limiter l’utilisation, vous opposer à leur traitement et les recevoir dans un format réutilisable (portabilité).
Pour exercer ces droits, écrivez à [À COMPLÉTER : adresse e-mail].
Si vous estimez, après nous avoir contactés, que vos droits ne sont pas respectés, vous pouvez adresser une réclamation à la CNIL : en ligne sur www.cnil.fr/fr/plaintes, ou par courrier à la CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris.
Is your website GDPR compliant? The tool reads your home page, spots the trackers loaded before the visitor’s choice (Google Analytics, Meta, Hotjar, YouTube…), the consent tool and the mandatory links.
Every business website in France, sole traders included, must say who publishes it, how to reach them, where they are registered and who hosts the site. As soon as it collects data, it also needs a privacy policy. This generator writes both live from your answers, for your status: sole trader, company, association, regulated profession or private individual. The addresses of common hosting providers (OVHcloud, o2switch, IONOS, Wix, Shopify…) are already filled in, the retention periods come from CNIL texts, and anything missing stays marked “to complete”. The documents are in French, for a website run in France, to copy or in Word.
Tool made by Léo Guillaume, freelance developer near Rennes, France. I build and tidy up websites for small businesses, and I keep finding the same forgotten legal pages: I wrote the generator I would have liked to hand them.
Updated on
What French law says
Legal notice and GDPR in France in 2026, text by text
The rules the generator applies, re-read on 8 November 2026 on Légifrance, Service-public.fr and the CNIL website.
French digital economy law, article 1-1
Who publishes the website, and how to reach them
A natural person shows their full name, address, phone number and, when registered, their number at the trade or crafts register. A company shows its name, registered office, phone number, registration number and share capital. In both cases, the website names its publication director.
The hosting provider, and the private individual’s anonymity
The website gives the name, address and phone number of its hosting provider. A private individual publishing on a non-professional basis may stay anonymous: they show only the host’s name and address, provided they gave the host their identity.
A business selling online adds its e-mail address and VAT number. A regulated profession also gives its professional rules, its title, the State that granted it and the order or body it is registered with.
That is the penalty when this information is missing, for a natural person or a company manager. For the company itself, the fine is the one of article 131-38 of the French criminal code, that is €375,000 according to Service-public.fr.
As soon as it collects data, the website says who is responsible, which data, why, on which legal basis, who receives it, how long it is kept, what your rights are and how to complain to the CNIL. The link must be visible on every page, separate from the terms of sale. Failure to inform: a €1,500 fine.
The data of a prospect who did not become a customer is kept 3 years from its collection or their last contact. Customer data is kept for the relationship, then archived within the limitation period.
Trackers that are not essential wait for the visitor’s consent, and refusing must be as easy as accepting. The CNIL considers keeping the choice, consent or refusal, for 6 months a good practice. Exempted audience measurement keeps its trackers 13 months and its data 25 months at most.
Every business selling to consumers, whatever its size, offers a consumer mediator and shows its details on its website. Without this information: up to €3,000 for a sole trader, €15,000 for a company.
This generator writes a template, not legal advice: it covers a showcase website or a small online shop. It writes neither terms of sale nor terms of use. For a website handling health data, running targeted advertising or selling abroad, have the result reviewed by a lawyer.
By status
What your legal notice must contain, status by status
The base is the same for everyone: who publishes, how to reach them, who hosts. What changes is the registration.
Micro-business, sole trader
Your name, followed by “EI”
Full name with “entrepreneur individuel” or “EI”, address, phone number, e-mail, SIREN, registration (RCS or RNE), and VAT number or the exemption line “TVA non applicable, article 293 B du CGI”.
You are also the publication director.
SARL, EURL, SAS, SASU, SA
Company name, form and capital
Name, legal form and share capital, registered office, phone number, e-mail, RCS number with the city of the register, EU VAT number, and the name of the publication director, usually the manager or the chair.
1901-law association
The same rules as any legal person
Name of the association, registered office, phone number, and the publication director, often the chair. The RNA number is not required by law, but it helps identify the association: the generator adds it if you give it.
Regulated profession
Your title and your order
On top of the mentions of your status: the professional title, the State that granted it, the order or body you are registered with, and your professional rules, with where to read them.
Lawyer, architect, chartered accountant, health professions…
Privacy policy
What your privacy policy must contain
Article 13 of the GDPR sets the list. The generator follows this order, which is also the order in which a visitor looks for an answer.
1
Who is responsible for the data
The name of the business or association, its address and an e-mail for any question. The data protection officer, if there is one.
The usual mistake A “noreply” address, or the one of the agency that built the website.
2
Which data, why, on which legal basis
One line per use: contact form, booking, newsletter, customer account, payment, analytics. For each, the legal basis: contract, legitimate interest, legal obligation or consent.
The usual mistake Writing “we collect your data to improve our services” without saying which.
3
Who receives it
You, and the providers that process it on your behalf: hosting provider, e-mail tool, payment provider, analytics tool.
The usual mistake Forgetting the newsletter tool, which holds the whole subscriber list.
4
Transfers outside the European Union
Google, Meta and many payment providers may send data to the United States. The policy says so, with the safeguard that frames the transfer.
The usual mistake Promising that “the data never leaves France” with Google Analytics installed.
5
How long you keep it
One period per use: 3 years after the last contact for a prospect, the relationship then the limitation period for a customer, 10 years for invoices.
The usual mistake “As long as necessary”, which says nothing.
6
The visitor’s rights, and the CNIL
Access, rectification, erasure, restriction, objection, portability, withdrawal of consent, the address to write to, and the right to complain to the CNIL.
The usual mistake Pointing to a contact form that no longer works.
7
Cookies and the banner
Which trackers need consent, which tool collects it, and the “Manage my cookies” link to change one’s mind.
The usual mistake Describing a banner the website does not have, or no longer has.
In the field
The mistakes seen on small business websites
What I find most often when I open the legal notice page of a small business website.
Hosting provider
No host, or the wrong one
No hosting provider at all, or the domain registrar instead of the website’s host. A website built on Wix or Shopify is hosted by Wix or Shopify, even if the domain was bought elsewhere.
Registration
No SIREN, no RCS
A trading name and an address, but no number. Yet that is what lets a customer check the business exists.
Copy and paste
A policy copied from another website
It shows another company’s name, an online shop the website does not have, or tools it does not use. The visitor no longer knows what is true.
Cookies
A banner that blocks nothing
The banner shows, but Google Analytics or the YouTube video are already loaded before any click. The text says one thing, the website does another.
Contact
The webmaster’s e-mail from five years ago
The contact address for data is the one of the agency or the nephew who built the website, and nobody reads it any more. A data access request goes unanswered.
Outdated texts
References from another era
“Under article 6-III of the LCEN…”: since May 2024, the publisher’s mentions fall under article 1-1 of the law. A legal page still quoting the old article has often not been re-read for years.
Frequently asked questions
Legal notice and privacy policy in France: your questions
Is a legal notice mandatory for a sole trader in France?
Yes. A micro-entrepreneur shows their name followed by “EI”, their address, phone number, e-mail, registration number and, if they have one, VAT number, plus the hosting provider. Without it, French law provides up to one year in prison and a €75,000 fine for a natural person.
Can I stay anonymous on my website?
Only if you publish on a non-professional basis, as a private individual. The law then lets you show only your host’s name and address, provided you gave it your identity. As soon as there is a business activity, even a micro-business, anonymity is not possible.
What is the difference between legal notice, terms of sale, terms of use and privacy policy?
The legal notice says who publishes the website and who hosts it. Terms of sale set the conditions of sale: they are mandatory when you sell to consumers. Terms of use set the rules of a service, useful when the website has accounts or content posted by visitors. The privacy policy explains what you do with personal data, and must stay separate from the terms. This generator writes the first and the last.
Do I need a data protection officer (DPO)?
The GDPR requires one in three cases: a public body, an activity that monitors people regularly and on a large scale, or that processes sensitive or criminal data on a large scale. A craftsperson, a shop or a practice with a showcase website usually does not need one. If you appointed one, their details go in the privacy policy.
What is the risk if the legal notice is missing?
Up to one year in prison and a €75,000 fine for a natural person or a manager, and €375,000 for a company. Failure to inform about personal data is punished by €1,500, and a missing consumer mediator by €3,000 (sole trader) or €15,000 (company). The most common risk is simpler: a customer or a competitor reporting it, and a website that inspires less trust.
Where should the legal notice link go?
At the bottom of every page, in the footer: the law asks for easy, direct and permanent access. Put the privacy policy link next to it, visible on every page, and, if you have a cookie banner, a “Manage my cookies” link to change one’s mind at any time.
Does an association need a legal notice?
Yes, like any legal person publishing a website: its name, registered office, a phone number, the name of the publication director (often the chair) and the host. The RNA number is not required by law, but it reassures. If the association collects memberships or donations online, it also needs a privacy policy.
Do I also need the legal notice in English?
The generator writes in French, for a website run in France. If your website has an English version, you can add a translation of both pages there, keeping the French version. The English and Spanish interfaces of this tool produce the same documents in French.
How much does a lawyer charge for a legal notice?
It depends on the status, on what the website does (online sales, customer accounts, advertising) and on the review time: I give no figure, ask a lawyer for a quote. For a simple showcase website, this template covers the essentials. For an online shop, health data or targeted advertising, a legal professional’s opinion is worth the cost.
Is this generator enough?
No. It writes a template from your answers, with the rules of the law and the CNIL periods, but it is not legal advice. Read every line, fill in what is marked “to complete”, and check that the text describes what your website really does: a cookie banner described but missing is worse than no text.
My website is on Wix or Shopify: who is the hosting provider?
The platform. For Wix, the French contract names Wix.com Ltd., in Tel Aviv; for Shopify, Shopify International Limited, in Dublin; for WordPress.com, Automattic Inc., in San Francisco. The registrar of your domain name (OVHcloud, Gandi, IONOS…) is not the host if it only handles the domain. The generator prefills these addresses.
Do I have to show my home address?
A business must give its address: if your registered office is at home, that is your address, unless you use a domiciliation company or premises. A private individual publishing without business activity may show nothing but their host. The generator offers that option only for the “private individual” status.
Would you like me to check your website?
Send me the address. I read your legal pages, look at what the website loads before the cookie banner, and tell you what is missing, within 24 hours.
