Website legal notices: new rules to be implemented as of May 21, 2024

Legal notices on a website are essential to guarantee transparency for users and to comply with legal obligations.

With the entry into force of article 48 of law no. 2024-449 of May 21, 2024 aimed at securing and regulating the digital space, these obligations have been updated.

The new LCEN requirements

Article 1-1 of the French Law for Confidence in the Digital Economy (LCEN) now imposes a clear distinction in the identification of service providers involved in hosting a website:

1. The website host: the person who hosts the web pages ;
2. The data host: the one who hosts the data processed via the website.

The updated text provides that publishers of online services must mention these two types of host in their legal notices:

“Persons whose activity is to publish a service of communication to the public online make available to the public, in an open standard:

[…]

4° The name, designation or company name, address and telephone number of the hosting service provider;

5° Where applicable, the name, designation or corporate name and address of the natural or legal persons who provide, even free of charge, the storage of data processed directly by them in the course of publishing the service.”

Why this change?

According to the explanatory memorandum to the amendment introducing this obligation, data hosting (for example, data collected or processed by an application) is often entrusted to a service provider other than the one hosting the web pages. This situation limited transparency and user recourse.

From now on, website publishers must indicate:

• The contact details of the web page host ;
• The identity of the host of personal or non-personal data collected or processed via the website.

A concrete example

Let’s imagine a website whose pages are hosted by a service provider, while the data collected via the site’s contact form is stored on a CRM provided by another service provider:

• Before the reform: Only the website hosting provider had to appear in the legal notices;
• Since the reform: the CRM provider must also be mentioned, as the host of the data processed via the website.

A dissuasive sanction

Failure to comply with this obligation carries heavy penalties: publishers may be liable to a fine of up to 375,000 euros for legal entities, according to article 1-2 of the LCEN.

How to comply?

To avoid any risk, it is essential to:

• Identify your service providers: Check that the data processed via your site is stored by a host separate from that of the web pages.
• Update your legal notices: Add information about the hosting provider concerned.

Need help checking or writing your legal notices? Please do not hesitate to contact us.