Is my website compliant in France? The 2-minute quiz, with the maximum fines

On 16 October 2025, a specialist catalogue distance-selling company was fined €3,000 (in French) by the CNIL (the « Commission nationale de l’informatique et des libertés », France’s data protection authority) on a single ground: its visitors’ consent to cookies. Its name was not published, because decisions under the simplified procedure are not made public. This kind of breach can be spotted in seconds with the developer tools of any browser, and the CNIL often acts on complaints: of the 23 simplified sanctions issued between January and early July 2026, 19 started with a complaint (in French).

This quiz asks the questions an inspector would ask on landing on your site. It starts with four questions about your business, so it only asks about what applies to you, then goes through up to fourteen obligations. At the end you get a score, a list of what is missing, the maximum penalty set by law for each gap and the guide that explains how to fix it. Your answers stay in your browser.

What it does not do: read your pages. It relies on your answers, and a legal notice page that exists but leaves out the host will pass as compliant if you answer “Yes”. The free tools further down cover part of that blind spot.

What are the legal requirements for a business website in France?

Every business website must identify its publisher and its host; GDPR rules kick in as soon as it collects data or places trackers, and consumer rules as soon as it sells to consumers. The table below lists the fourteen points in the quiz, with the text that imposes each one and the maximum penalty.

For GDPR and cookie penalties, the cap is whichever is higher: a fixed amount or a percentage of worldwide annual turnover. Consumer Code fines are administrative fines imposed by the DGCCRF (the French consumer protection authority); penalties under the LCEN (« loi pour la confiance dans l’économie numérique », the Law on Confidence in the Digital Economy) are criminal penalties imposed by a court. For obligations that go beyond the website, see the mandatory legal documents for a business in France.

What is EU-wide and what is French? The GDPR applies across the EU, and the cookie consent rule comes from Article 5(3) of the ePrivacy Directive, which France transposed in article 82. The content of the legal notice under the LCEN, the amounts of the LCEN and Consumer Code penalties, and the CNIL’s simplified procedure are French.

What must a legal notice on a website in France include?

The publisher of a business website must display its identity, address, phone number, the name of the publication director and the details of its host; a company adds its share capital and registered office address, and any registered business its RCS number (« registre du commerce et des sociétés », the trade and companies register) or, for a craftsperson, its number in the RNE (« registre national des entreprises », national business register). This is article 1-1 of the LCEN since the SREN law of 21 May 2024, no longer the old article 6-III.

These are the first three obligations the quiz checks: leaving them out is a criminal offence, punishable by prison, and it can be spotted at a glance.

The second paragraph of the same article makes the company itself criminally liable: it faces a fine under article 131-38 of the Criminal Code, that is five times the amount, hence the €375,000, and a ban on carrying on the activity concerned for up to five years.

Watch the host line. A coach who built her site on Wix must name Wix, with its address and phone number, not the registrar of her domain name. A Shopify store names Shopify. The details, business type by business type, with an annotated template, are in our guide to the legal notice on a website in France, and the free legal notice checker checks your page item by item.

Do I need a cookie banner on my website in France?

Yes, as soon as the site places a tracker that is not strictly necessary for it to work: non-exempt analytics, advertising pixels, embedded YouTube videos, share buttons. The law does not require a banner as such, it requires prior consent, and the banner is how you collect it.

The quiz draws three questions from it. Nothing may fire before the visitor has chosen. Refusing must be as easy as accepting: the CNIL cites two buttons “at the same level and in the same format” (in French), “Accept all” and “Reject all”. Finally, a page must explain the purposes, name the companies that place trackers and let visitors withdraw consent at any time.

The cap is set by IV, 7° of article 20 of the French Data Protection Act (« loi Informatique et Libertés »): €10 million or 2% of worldwide annual turnover. On 1 September 2025, the CNIL applied it to SHEIN: €150 million for trackers placed as soon as visitors arrived on the site and a refusal that did not stop new ones being placed. Everything is covered in our guide to the CNIL-compliant cookie banner.

Is a privacy policy mandatory for a website?

Yes, as soon as the site collects any personal data, even through a simple contact form: Article 13 of the GDPR requires you to inform people at the time of collection. This is the obligation with the highest cap in the quiz, up to €20 million or 4% of worldwide turnover (GDPR, Article 83(5)).

This rule is EU-wide. The policy must say who processes the data, why and on what legal basis, who receives it, how long it is kept, and how people can exercise their rights, including by complaining to the CNIL. A consultant running a SASU (a single-shareholder simplified company) who only collects quote requests through a form is just as concerned as an online shop. The expected content, section by section, is in our guide to the privacy policy.

Is HTTPS a legal requirement for a website?

No text names HTTPS, but Article 32 of the GDPR requires security appropriate to the risk, and the CNIL asks you to make TLS mandatory “for all the pages of your site” (in French). A form that sends data unencrypted therefore exposes you to a breach of the security obligation.

The cap is the one in Article 83(4) of the GDPR: €10 million or 2% of worldwide turnover. “Insufficient data security” comes up often in the list of simplified sanctions published by the CNIL (in French), usually alongside other breaches. Check that every page, not just the payment page, redirects to HTTPS: it is also one of the points checked by the free audit described below.

Does a small business need a GDPR record of processing?

Yes in most cases: the exemption for organisations with fewer than 250 employees does not cover regular processing, and the CNIL itself lists managing customers and prospects (in French) among the “non-occasional” processing that must be recorded.

The record does not show on the website, but it must be made available to the CNIL on request (GDPR, Article 30(4)). Not having one falls under the cap in Article 83(4) of the GDPR (€10 million or 2% of worldwide turnover). A shop with a customer file, a newsletter and one employee already has three or four processing activities to describe: our guide to the GDPR record of processing gives filled-in examples.

What must an online shop show before the customer orders in France?

Before the customer pays, the site must give the information listed in article L221-5 of the Consumer Code (including the legal guarantees and the mediator), show an order summary and have the customer confirm with a button reading « commande avec obligation de paiement » (order with obligation to pay) or similar wording. The « CGV » (terms of sale) are the usual place for this information.

The quiz checks four points:

• Terms of sale available before ordering. Put a link on the basket or checkout page, not just in the footer: the customer must be able to read them before confirming. Failing to give the information in article L221-5 can lead to an administrative fine of €15,000 for an individual and €75,000 for a company (art. L242-10).
• Order summary and order button. Article L221-14 requires the characteristics and the price to be restated before the order, and a “clear and legible” statement on the confirmation button. Same cap.
• Legal guarantees. Point 5° of article L221-5 covers the legal guarantees: the legal guarantee of conformity and the guarantee against hidden defects. Same cap.
• Mediator. The trader must give the mediator’s contact details “visibly and legibly on its website” and in its terms of sale (art. R616-1), with the address of the mediator’s website. Leaving it out is capped at €3,000 for an individual and €15,000 for a company (art. L641-1).

These obligations only apply when you sell to consumers: a graphic designer who only invoices businesses has no mediator to display. What changes between business and consumer customers is explained in our guide to terms of sale in France.

Is the withdrawal button mandatory in 2026?

Yes: since 19 June 2026, a trader that concludes distance contracts with consumers through an online interface must give them a function to withdraw free of charge (art. L221-21). It is labelled « renoncer au contrat ici » (withdraw from the contract here) or with similarly unambiguous wording, and confirmation goes through « confirmer la rétractation » (confirm withdrawal) or equivalent wording (art. D. 221-5).

The function itself comes from EU law, Directive (EU) 2023/2673; the French labels, articles and fines above are the French transposition. It is the most recent obligation in the quiz. Not offering it can lead to an administrative fine of €15,000 for an individual and €75,000 for a company (art. L242-13). The pre-contract information, in practice your terms of sale, must also state that this function exists and where to find it (art. L221-5, 7°). Our guide to the EU withdrawal button details the required steps and the options on Shopify and WooCommerce.

Maximum penalty or actual fine: what does a small business really risk?

The amounts in the quiz are the maximums set by law, not estimates. For straightforward cases, the CNIL can use the simplified procedure, where the fine is capped at €20,000 (French Data Protection Act, art. 22-1).

That cap rises to €100,000 when worldwide annual turnover exceeds €50 million, and the decision is not made public. The CNIL uses it when “the case presents no particular difficulty” (CNIL, in French). Between January and early July 2026, it issued 23 sanctions this way, €133,750 in total, and cookies (incomplete banner, trackers placed before any action, refusing harder than accepting) are among the most frequent breaches. A few recent decisions, all under the simplified procedure, give the order of magnitude:

Source: Les sanctions prononcées par la CNIL (in French). Procedures, amounts and appeals are covered in detail in our guide to CNIL fines.

On the consumer side, the first real risk is an inspection. In November 2023, the DGCCRF said it had inspected 9,182 websites (in French) since the start of the year. These inspections were not random (targeting or complaints): about half the sites had an irregularity, and the follow-up included 2,267 warnings, 1,974 compliance orders and 242 official offence reports. To see where French online shops stand in 2026, read our 2026 compliance study of French e-commerce sites.

Where should I start to make my website compliant?

Start with the legal notice, a criminal offence that is easy to fix, then with trackers placed without consent, a breach that can be spotted online and that the CNIL regularly fines under the simplified procedure. Next come the sales obligations, then the GDPR paperwork.

flowchart TD
  A["Your website"] --> B{"Legal notice complete?"}
  B -->|No| C["Fix first: criminal risk"]
  B -->|Yes| D{"Trackers before consent?"}
  C --> D
  D -->|Yes| E["Block trackers and add Reject all"]
  D -->|No| F{"Selling to consumers?"}
  E --> F
  F -->|Yes| G["Withdrawal, terms of sale, summary, mediator"]
  F -->|No| H["Privacy policy, HTTPS, record"]
  G --> H

What can’t the quiz see?

The quiz measures what you know about your site, not what your site actually displays. A broken link, a legal notice page that lost the host line during a redesign, or a pixel quietly added by a plugin all slip under its radar.

If you do not yet know which obligations apply to your business beyond the website, the obligations check starts from your SIREN (French company registration number). All the tools are on the free tools page, and the overall approach is set out on the compliance page.