# Is my website compliant in France? The 2-minute quiz, with the maximum fines

> A business website must at least identify its publisher and host (LCEN, art. 1-1), obtain consent before any non-exempt tracker (French Data Protection Act, art. 82) and tell people how their data is processed (GDPR, art. 13). A site that sells to consumers adds terms of sale, an order summary, legal guarantees, a consumer mediator and, since 19 June 2026, an online withdrawal function. For a company, maximum penalties range from €15,000 (mediator) to €375,000 (legal notice), and up to €10 million or €20 million, or 2% or 4% of worldwide turnover, for cookies and the GDPR; under the simplified procedure, reserved for straightforward cases, a CNIL fine is capped at €20,000.

Source: https://legalnest.io/en/guides/website-compliance-quiz/
Updated on 8 October 2026. Checked against the law in force on 07/10/2026.
General information, not personalised legal advice.

On 16 October 2025, a specialist catalogue distance-selling company was [fined €3,000](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) (in French) by the CNIL (the « Commission nationale de l’informatique et des libertés », France’s data protection authority) on a single ground: its visitors’ consent to cookies. Its name was not published, because decisions under the simplified procedure are not made public. This kind of breach can be spotted in seconds with the developer tools of any browser, and the CNIL often acts on complaints: of the 23 simplified sanctions issued between January and early July 2026, [19 started with a complaint](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees) (in French).

This quiz asks the questions an inspector would ask on landing on your site. It starts with four questions about your business, so it only asks about what applies to you, then goes through up to fourteen obligations. At the end you get a score, a list of what is missing, the maximum penalty set by law for each gap and the guide that explains how to fix it. Your answers stay in your browser.

What it does not do: read your pages. It relies on your answers, and a legal notice page that exists but leaves out the host will pass as compliant if you answer “Yes”. The free tools further down cover part of that blind spot.

*Interactive tool available on the page: https://legalnest.io/en/guides/website-compliance-quiz/*

## What are the legal requirements for a business website in France?

Every business website must identify its publisher and its host; GDPR rules kick in as soon as it collects data or places trackers, and consumer rules as soon as it sells to consumers. The table below lists the fourteen points in the quiz, with the text that imposes each one and the maximum penalty.

| Obligation | Who | Text | Maximum penalty | Guide |
|---|---|---|---|---|
| Legal notice (publisher, phone number, registration number, publication director) | Every business website | [LCEN, art. 1-1 and 1-2](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568616) | 1 year in prison and €75,000, €375,000 for a company | [Legal notice](/en/guides/legal-notice-website-france/) |
| Host identified | Every business website | LCEN, art. 1-1, 4° | Same | [Legal notice](/en/guides/legal-notice-website-france/) |
| Share capital, registered office | Companies | LCEN, art. 1-1, 2° | Same | [Legal notice](/en/guides/legal-notice-website-france/) |
| No tracker before consent | Sites with non-exempt trackers | [French Data Protection Act, art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) | €10m or 2% of worldwide turnover | [Cookie banner](/en/guides/cookie-banner-france-cnil/) |
| Refusing as easy as accepting, on the first screen | Same | Art. 82, [CNIL](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) (in French) | €10m or 2% of worldwide turnover | [Cookie banner](/en/guides/cookie-banner-france-cnil/) |
| Information about cookies | Same | Art. 82 | €10m or 2% of worldwide turnover | [Cookie banner](/en/guides/cookie-banner-france-cnil/) |
| Privacy policy | Sites that collect data | [GDPR, art. 13](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | €20m or 4% of worldwide turnover | [Privacy policy](/en/guides/privacy-policy-france/) |
| HTTPS and security | Same | [GDPR, art. 32](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | €10m or 2% of worldwide turnover | [CNIL fines](/en/guides/cnil-fines/) |
| Record of processing activities | Same | GDPR, art. 30 | €10m or 2% of worldwide turnover | [GDPR record](/en/guides/gdpr-record-of-processing/) |
| Online withdrawal function | Online sales to consumers | [Consumer Code, art. L221-21](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) | €15,000, €75,000 for a company | [Withdrawal button](/en/guides/withdrawal-button-eu/) |
| Terms of sale available before ordering | Same | [Consumer Code, art. L221-5](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) | €15,000, €75,000 for a company | [Terms of sale](/en/guides/terms-of-sale-france/) |
| Order summary and “order with obligation to pay” button | Same | [Consumer Code, art. L221-14](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226854) | €15,000, €75,000 for a company | [Terms of sale](/en/guides/terms-of-sale-france/) |
| Legal guarantees mentioned | Same | Consumer Code, art. L221-5, 5° | €15,000, €75,000 for a company | [Terms of sale](/en/guides/terms-of-sale-france/) |
| Consumer mediator | Same | [Consumer Code, art. L616-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762) | €3,000, €15,000 for a company | [Terms of sale](/en/guides/terms-of-sale-france/) |

For GDPR and cookie penalties, the cap is whichever is higher: a fixed amount or a percentage of worldwide annual turnover. Consumer Code fines are administrative fines imposed by the DGCCRF (the French consumer protection authority); penalties under the LCEN (« loi pour la confiance dans l’économie numérique », the Law on Confidence in the Digital Economy) are criminal penalties imposed by a court. For obligations that go beyond the website, see the [mandatory legal documents for a business in France](/en/guides/mandatory-legal-documents-france/).

What is EU-wide and what is French? The GDPR applies across the EU, and the cookie consent rule comes from Article 5(3) of the [ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058), which France transposed in article 82. The content of the legal notice under the LCEN, the amounts of the LCEN and Consumer Code penalties, and the CNIL’s simplified procedure are French.

## What must a legal notice on a website in France include?

The publisher of a business website must display its identity, address, phone number, the name of the publication director and the details of its host; a company adds its share capital and registered office address, and any registered business its RCS number (« registre du commerce et des sociétés », the trade and companies register) or, for a craftsperson, its number in the RNE (« registre national des entreprises », national business register). This is article 1-1 of the LCEN since the SREN law of 21 May 2024, no longer the old article 6-III.

These are the first three obligations the quiz checks: leaving them out is a criminal offence, punishable by prison, and it can be spotted at a glance.

**What the law says**

> Est puni d’un an d’emprisonnement et de 75 000 euros d’amende le fait, pour une personne physique ou le dirigeant de droit ou de fait d’une personne morale dont l’activité est d’éditer un service de communication au public en ligne, de ne pas respecter les I et II de l’article 1er-1.
> 
> *Unofficial translation:* Failure to comply with I and II of article 1-1 by a natural person, or by the de jure or de facto manager of a legal entity, whose activity is publishing an online public communication service, is punishable by one year’s imprisonment and a fine of 75,000 euros.
>
> Source: [Loi n° 2004-575 du 21 juin 2004 (LCEN), art. 1-2, al. 1 (Law on Confidence in the Digital Economy, paragraph 1)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568616)

The second paragraph of the same article makes the company itself criminally liable: it faces a fine under article 131-38 of the Criminal Code, that is five times the amount, hence the €375,000, and a ban on carrying on the activity concerned for up to five years.

Watch the host line. A coach who built her site on Wix must name Wix, with its address and phone number, not the registrar of her domain name. A Shopify store names Shopify. The details, business type by business type, with an annotated template, are in our guide to the [legal notice on a website in France](/en/guides/legal-notice-website-france/), and the [free legal notice checker](https://app.legalnest.io/tools/legal-notice?lang=en) checks your page item by item.

## Do I need a cookie banner on my website in France?

Yes, as soon as the site places a tracker that is not strictly necessary for it to work: non-exempt analytics, advertising pixels, embedded YouTube videos, share buttons. The law does not require a banner as such, it requires prior consent, and the banner is how you collect it.

**What the law says**

> Tout abonné ou utilisateur d’un service de communications électroniques doit être informé de manière claire et complète, sauf s’il l’a été au préalable, par le responsable du traitement ou son représentant : 1° De la finalité de toute action tendant à accéder, par voie de transmission électronique, à des informations déjà stockées dans son équipement terminal de communications électroniques, ou à inscrire des informations dans cet équipement ; 2° Des moyens dont il dispose pour s’y opposer. Ces accès ou inscriptions ne peuvent avoir lieu qu’à condition que l’abonné ou la personne utilisatrice ait exprimé, après avoir reçu cette information, son consentement qui peut résulter de paramètres appropriés de son dispositif de connexion ou de tout autre dispositif placé sous son contrôle.
> 
> *Unofficial translation:* Any subscriber or user of an electronic communications service must be informed clearly and completely, unless they have already been informed, by the controller or its representative: 1° of the purpose of any action seeking to access, by electronic transmission, information already stored in their electronic communications terminal equipment, or to write information to that equipment; 2° of the means available to them to object to it. Such access or writing may only take place on condition that the subscriber or user has given their consent, after receiving this information; that consent may result from appropriate settings of their connection device or of any other device under their control.
>
> Source: [Loi n° 78-17 du 6 janvier 1978, art. 82, al. 1 à 4 (French Data Protection Act, paragraphs 1 to 4)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978)

The quiz draws three questions from it. Nothing may fire before the visitor has chosen. Refusing must be as easy as accepting: the CNIL cites [two buttons “at the same level and in the same format”](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) (in French), “Accept all” and “Reject all”. Finally, a page must explain the purposes, name the companies that place trackers and let visitors withdraw consent at any time.

The cap is set by IV, 7° of [article 20 of the French Data Protection Act](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049578536) (« loi Informatique et Libertés »): €10 million or 2% of worldwide annual turnover. On 1 September 2025, the CNIL applied it to SHEIN: [€150 million](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil) for trackers placed as soon as visitors arrived on the site and a refusal that did not stop new ones being placed. Everything is covered in our guide to the [CNIL-compliant cookie banner](/en/guides/cookie-banner-france-cnil/).

## Is a privacy policy mandatory for a website?

Yes, as soon as the site collects any personal data, even through a simple contact form: Article 13 of the GDPR requires you to inform people at the time of collection. This is the obligation with the highest cap in the quiz, up to €20 million or 4% of worldwide turnover ([GDPR, Article 83(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)).

This rule is EU-wide. The policy must say who processes the data, why and on what legal basis, who receives it, how long it is kept, and how people can exercise their rights, including by complaining to the CNIL. A consultant running a SASU (a single-shareholder simplified company) who only collects quote requests through a form is just as concerned as an online shop. The expected content, section by section, is in our guide to the [privacy policy](/en/guides/privacy-policy-france/).

## Is HTTPS a legal requirement for a website?

No text names HTTPS, but Article 32 of the GDPR requires security appropriate to the risk, and the CNIL asks you to [make TLS mandatory “for all the pages of your site”](https://www.cnil.fr/fr/securiser-vos-sites-web-vos-applications-et-vos-serveurs) (in French). A form that sends data unencrypted therefore exposes you to a breach of the security obligation.

The cap is the one in [Article 83(4) of the GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679): €10 million or 2% of worldwide turnover. “Insufficient data security” comes up often in the [list of simplified sanctions](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) published by the CNIL (in French), usually alongside other breaches. Check that every page, not just the payment page, redirects to HTTPS: it is also one of the points checked by the free audit described below.

## Does a small business need a GDPR record of processing?

Yes in most cases: the exemption for organisations with fewer than 250 employees does not cover regular processing, and the CNIL itself lists [managing customers and prospects](https://www.cnil.fr/fr/RGDP-le-registre-des-activites-de-traitement) (in French) among the “non-occasional” processing that must be recorded.

The record does not show on the website, but it must be made available to the CNIL on request ([GDPR, Article 30(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)). Not having one falls under the cap in Article 83(4) of the GDPR (€10 million or 2% of worldwide turnover). A shop with a customer file, a newsletter and one employee already has three or four processing activities to describe: our guide to the [GDPR record of processing](/en/guides/gdpr-record-of-processing/) gives filled-in examples.

## What must an online shop show before the customer orders in France?

Before the customer pays, the site must give the information listed in article L221-5 of the Consumer Code (including the legal guarantees and the mediator), show an order summary and have the customer confirm with a button reading « commande avec obligation de paiement » (order with obligation to pay) or similar wording. The « CGV » (terms of sale) are the usual place for this information.

The quiz checks four points:

- **Terms of sale available before ordering.** Put a link on the basket or checkout page, not just in the footer: the customer must be able to read them before confirming. Failing to give the information in article L221-5 can lead to an administrative fine of €15,000 for an individual and €75,000 for a company ([art. L242-10](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563241)).
- **Order summary and order button.** Article L221-14 requires the characteristics and the price to be restated before the order, and a “clear and legible” statement on the confirmation button. Same cap.
- **Legal guarantees.** Point 5° of article L221-5 covers the legal guarantees: the legal guarantee of conformity and the guarantee against hidden defects. Same cap.
- **Mediator.** The trader must give the mediator’s contact details “visibly and legibly on its website” and in its terms of sale ([art. R616-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032808378)), with the address of the mediator’s website. Leaving it out is capped at €3,000 for an individual and €15,000 for a company ([art. L641-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224624)).

These obligations only apply when you sell to consumers: a graphic designer who only invoices businesses has no mediator to display. What changes between business and consumer customers is explained in our guide to [terms of sale in France](/en/guides/terms-of-sale-france/).

## Is the withdrawal button mandatory in 2026?

Yes: since 19 June 2026, a trader that concludes distance contracts with consumers through an online interface must give them a function to withdraw free of charge ([art. L221-21](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520)). It is labelled « renoncer au contrat ici » (withdraw from the contract here) or with similarly unambiguous wording, and confirmation goes through « confirmer la rétractation » (confirm withdrawal) or equivalent wording ([art. D. 221-5](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000053299001)).

The function itself comes from EU law, [Directive (EU) 2023/2673](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023L2673); the French labels, articles and fines above are the French transposition. It is the most recent obligation in the quiz. Not offering it can lead to an administrative fine of €15,000 for an individual and €75,000 for a company ([art. L242-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563232)). The pre-contract information, in practice your terms of sale, must also state that this function exists and where to find it (art. L221-5, 7°). Our guide to the [EU withdrawal button](/en/guides/withdrawal-button-eu/) details the required steps and the options on Shopify and WooCommerce.

## Maximum penalty or actual fine: what does a small business really risk?

The amounts in the quiz are the maximums set by law, not estimates. For straightforward cases, the CNIL can use the simplified procedure, where the fine is capped at €20,000 ([French Data Protection Act, art. 22-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442)).

That cap rises to €100,000 when worldwide annual turnover exceeds €50 million, and the decision is not made public. The CNIL uses it when “the case presents no particular difficulty” ([CNIL](https://www.cnil.fr/fr/la-procedure-de-sanction-simplifiee), in French). Between January and early July 2026, it issued [23 sanctions this way, €133,750 in total](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees), and cookies (incomplete banner, trackers placed before any action, refusing harder than accepting) are among the most frequent breaches. A few recent decisions, all under the simplified procedure, give the order of magnitude:

| Date | Business | Breaches found | Fine |
|---|---|---|---|
| 10 April 2025 | Sporting goods retailer | Data minimisation, retention period and information (CCTV), record of processing, security | €20,000 |
| 4 September 2025 | Collection of prospect data, notably through online competitions | Retention period, legal basis, information, marketing without consent, record of processing | €17,000 |
| 16 October 2025 | Specialist catalogue distance selling | Consent (cookies) | €3,000 |
| 13 November 2025 | Footwear retailer | Consent and information (cookies) | €5,000 |
| 12 March 2026 | Specialist catalogue distance selling | Information (exercising rights), right of access | €5,000 |

Source: [Les sanctions prononcées par la CNIL](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) (in French). Procedures, amounts and appeals are covered in detail in our guide to [CNIL fines](/en/guides/cnil-fines/).

On the consumer side, the first real risk is an inspection. In November 2023, the DGCCRF said it had [inspected 9,182 websites](https://www.economie.gouv.fr/dgccrf/proteger-les-consommateurs-sur-internet-comme-dans-les-magasins) (in French) since the start of the year. These inspections were not random (targeting or complaints): about half the sites had an irregularity, and the follow-up included 2,267 warnings, 1,974 compliance orders and 242 official offence reports. To see where French online shops stand in 2026, read our [2026 compliance study of French e-commerce sites](/en/guides/french-ecommerce-compliance-study-2026/).

## Where should I start to make my website compliant?

Start with the legal notice, a criminal offence that is easy to fix, then with trackers placed without consent, a breach that can be spotted online and that the CNIL regularly fines under the simplified procedure. Next come the sales obligations, then the GDPR paperwork.

```mermaid
flowchart TD
  A["Your website"] --> B{"Legal notice complete?"}
  B -->|No| C["Fix first: criminal risk"]
  B -->|Yes| D{"Trackers before consent?"}
  C --> D
  D -->|Yes| E["Block trackers and add Reject all"]
  D -->|No| F{"Selling to consumers?"}
  E --> F
  F -->|Yes| G["Withdrawal, terms of sale, summary, mediator"]
  F -->|No| H["Privacy policy, HTTPS, record"]
  G --> H
```

**The fourteen points in the quiz, to tick off as you fix them**

- [ ] A **legal notice** page linked from every page: identity, address, phone number, RCS or RNE number if you are registered, publication director
- [ ] The **host** named, with its address and phone number
- [ ] For a company: **share capital and registered office address**
- [ ] **No tracker** that needs consent fires before the visitor has chosen
- [ ] A **“Reject all”** button at the same level as “Accept all”
- [ ] A page listing the **cookies**, their purposes, the companies that place them and how to change your mind
- [ ] A **privacy policy** linked from every form
- [ ] Every page served over **HTTPS**
- [ ] An up-to-date **record of processing activities** (customers, prospects, newsletter, employees)
- [ ] An online **withdrawal function**, available throughout the withdrawal period
- [ ] **Terms of sale** available from the checkout flow
- [ ] An order **summary** and an “order with obligation to pay” button
- [ ] The **legal guarantees** of conformity and against hidden defects in your terms of sale
- [ ] The name and website of your **consumer mediator** on the site and in your terms of sale

## What can’t the quiz see?

The quiz measures what you know about your site, not what your site actually displays. A broken link, a legal notice page that lost the host line during a redesign, or a pixel quietly added by a plugin all slip under its radar.

**With Legalnest**: To check what the quiz cannot see, Legalnest’s **free tools** work without an account and send a report by email: the [website audit](https://app.legalnest.io/tools/website-audit?lang=en) checks the legal links on your home page, HTTPS and the consent mechanism; the [cookie scanner](https://app.legalnest.io/tools/cookies?lang=en) flags known trackers and cookies placed on first load; the [legal notice checker](https://app.legalnest.io/tools/legal-notice?lang=en) checks each item. In the app, the **compliance score** then tracks your documents (legal notice, policies, terms of sale, record of processing) and your declarations, without scanning your site. [See the plans](/en/pricing/).

If you do not yet know which obligations apply to your business beyond the website, the [obligations check](https://app.legalnest.io/tools/obligations?lang=en) starts from your SIREN (French company registration number). All the tools are on the [free tools](/en/tools/) page, and the overall approach is set out on the [compliance](/en/compliance/) page.

## Frequently asked questions

### How do I know if my website complies with French law?

Start with the obligations that apply to every business website: a legal notice identifying the publisher and the host, consent before non-exempt cookies, and a privacy policy as soon as you collect data. If you sell to consumers, add terms of sale, an order summary, legal guarantees, a consumer mediator and an online withdrawal function. The quiz on this page sorts all this out in two minutes; an audit of your home page then confirms that the links really exist.

### What is the fine for a website with no legal notice in France?

Article 1-2 of the LCEN punishes an individual, or the manager of a company, who fails to identify the publisher or host of a business website with up to one year in prison and a €75,000 fine. A company faces up to €375,000, five times that amount, as provided by the French Criminal Code. These are maximums: the court sets the penalty case by case.

### Does a small brochure website have to comply with the GDPR?

Yes, as soon as it collects any personal data, even through a contact form or a newsletter sign-up. It must then inform people (Article 13 of the GDPR), secure the data (Article 32) and, in practice, keep a record of processing, because a customer or prospect file is not occasional processing. If it has no form and no tracker, its obligations come down mainly to the legal notice.

### What does a small business risk from the CNIL?

The legal maximums run into millions of euros, but a straightforward case can go through the simplified procedure, where the fine cannot exceed €20,000 (€100,000 above €50 million in turnover). In 2025, retailers were fined €3,000 to €5,000 for their cookies under this procedure. The company’s name is not published.

### Is the withdrawal button mandatory for every online shop selling in France?

Since 19 June 2026, any trader that concludes distance contracts with consumers through an online interface must offer a free withdrawal function, labelled « renoncer au contrat ici » (withdraw from the contract here) or with similarly unambiguous wording. Failing to do so can lead to an administrative fine of €15,000 for an individual and €75,000 for a company. Business-to-business sales are not affected.


## Sources

- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN, Law on Confidence in the Digital Economy), art. 1-1 (created by Loi n° 2024-449 du 21 mai 2024, art. 48)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568614) (Légifrance)
- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN), art. 1-2](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568616) (Légifrance)
- [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) (Légifrance)
- [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 20](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049578536) (Légifrance)
- [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 22-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442) (Légifrance)
- [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) (EUR-Lex)
- [Regulation (EU) 2016/679 (GDPR), art. 12 to 22: rights of the data subject (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre3) (CNIL)
- [Regulation (EU) 2016/679 (GDPR), art. 24 to 43: controller and processor (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4) (CNIL)
- [Regulation (EU) 2016/679 (GDPR), art. 77 to 84: remedies, liability and penalties (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre8) (CNIL)
- [Directive 2002/58/EC of 12 July 2002 on privacy and electronic communications (ePrivacy Directive), Article 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058) (EUR-Lex)
- [Code de la consommation, art. L221-5 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) (Légifrance)
- [Code de la consommation, art. L221-14 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226854) (Légifrance)
- [Code de la consommation, art. L221-21 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) (Légifrance)
- [Décret n° 2026-3 du 5 janvier 2026, art. 2 (Decree No. 2026-3 of 5 January 2026, art. 2, creating article D. 221-5 of the Consumer Code)](https://www.legifrance.gouv.fr/jorf/article_jo/JORFARTI000053299001) (Légifrance)
- [Directive (EU) 2023/2673 of the European Parliament and of the Council of 22 November 2023 amending Directive 2011/83/EU as regards financial services contracts concluded at a distance and repealing Directive 2002/65/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023L2673) (EUR-Lex)
- [Code de la consommation, art. L242-10 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563241) (Légifrance)
- [Code de la consommation, art. L242-13 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563232) (Légifrance)
- [Code de la consommation, art. L616-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762) (Légifrance)
- [Code de la consommation, art. R616-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032808378) (Légifrance)
- [Code de la consommation, art. L641-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224624) (Légifrance)
- [Cookies et traceurs : comment mettre mon site web en conformité ? (cookies and trackers: making your website compliant, in French)](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) (CNIL)
- [Sécuriser vos sites web, vos applications et vos serveurs (securing your websites, applications and servers, in French)](https://www.cnil.fr/fr/securiser-vos-sites-web-vos-applications-et-vos-serveurs) (CNIL)
- [Le registre des activités de traitement (the record of processing activities, in French)](https://www.cnil.fr/fr/RGDP-le-registre-des-activites-de-traitement) (CNIL)
- [La procédure de sanction simplifiée (the simplified sanction procedure, in French)](https://www.cnil.fr/fr/la-procedure-de-sanction-simplifiee) (CNIL)
- [Les sanctions prononcées par la CNIL (sanctions issued by the CNIL, in French)](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) (CNIL)
- [La CNIL a prononcé 23 nouvelles sanctions depuis janvier au titre de la procédure simplifiée (23 simplified-procedure sanctions since January, in French)](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees) (CNIL)
- [Cookies placed without consent: SHEIN fined 150 million euros by the CNIL](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil) (CNIL)
- [Protéger les consommateurs sur internet comme dans les magasins (protecting consumers online as in shops, in French)](https://www.economie.gouv.fr/dgccrf/proteger-les-consommateurs-sur-internet-comme-dans-les-magasins) (DGCCRF, economie.gouv.fr)