Your website almost always collects personal data: a contact form, a newsletter sign-up, visitor statistics. The GDPR (General Data Protection Regulation) and French law therefore set a few rules. The good news: for a showcase website, they are easy to follow.
This article covers the main points for a website operated in France. For a specific situation, contact the CNIL (the French data protection authority) or a legal professional.
The legal notice
Every professional website must display a legal notice, accessible from every page (usually in the footer). It includes the company's identity (name or company name, legal form, SIREN or RCS number, address), a means of contact, the name of the publication director and the details of the website's host.
The privacy policy
It explains, in clear terms, what data you collect, why, on what legal basis, how long you keep it, who it is shared with, and how people can exercise their rights: access, rectification, erasure, objection.
It must reflect reality: if you use an emailing or analytics tool, it must be listed.
Cookies
Cookies needed for the website to work can be set without consent. However, non-exempt audience measurement, advertising or social media cookies require the visitor's prior consent.
The banner must make it as easy to refuse as to accept: a "Refuse" button as visible as "Accept". Until the visitor has accepted, these cookies must not be set, and visitors must be able to change their mind at any time.
Forms
Only ask for the information you really need: for a simple contact, a name, an email address and a message are enough. Add a short notice under the form explaining how the data is used, with a link to the privacy policy.
For a newsletter, sign-up must be voluntary (no pre-ticked box), and every email must include an unsubscribe link.
The most common mistakes
An incomplete legal notice, or one copied from another website. A cookie banner without a refuse button. Analytics or advertising tools that fire before consent. A form that collects too much information. A privacy policy that is never updated.
These mistakes are easy to fix, and fixing them gives your business a serious image.
How we do it
Every website we build includes the legal pages, a compliant consent banner and forms limited to what is necessary. If your current website is not up to date, an audit quickly shows where you stand.