Four texts, four obligations that are not handled together
The most common confusion on this subject is to call the whole thing « GDPR compliance ». It is wrong, and it is expensive: it pushes you to treat as one project four obligations that come from four distinct texts, with different scopes, different penalties and different degrees of urgency.
| Obligation | Where it comes from | Who is concerned |
|---|---|---|
| Legal notice | LCEN of 2004, article 6 | Every website publisher, no exception |
| Data privacy information | GDPR, articles 13 and 14 | As soon as one personal data point is collected |
| Tracker consent | French Data Protection Act, article 82 | As soon as one non-necessary tracker is dropped |
| Accessibility | 2005 law and 2019 European directive | Public sector, large companies, and since June 2025 certain consumer services |
Two practical consequences. First, a site with no form and no tracker still owes a legal notice: the obligation does not depend on any collection. Second, the tracker consent obligation is not a GDPR obligation: it comes from the ePrivacy directive, transposed into article 82. That is why it applies even to a tracker that contains no personal data at all.
Step 1: the legal notice, one afternoon
This is the simplest obligation and the most often missed. It requires you to publicly identify who publishes the site and who hosts it, so that a visitor or a judge knows who to address. For a company that covers the trading name, legal form, share capital, registered address, company registration number, VAT number where one exists, a direct means of contact, the name of the publication director, and the full contact details of the host.
Two mistakes come back every time. The first is an outdated registered address, still pointing at a former home or a cancelled registered-office service: that is false information published under your own name, and anyone can check it in thirty seconds. The second is simply forgetting the host, when that is precisely the part the law spells out in most detail.
What to write, including the sole trader and non-profit cases, is covered in our article on legal notice requirements.
Step 2: say what you do with the data
The moment a visitor leaves you an email address in a form, you are processing personal data, and you owe them clear information: what you collect, why, on what legal basis, how long you keep it, who you pass it to, and how they can ask for erasure. That is what the privacy policy is for.
The trap is not writing the document, it is making it true. A copied template announcing three years of retention while your emailing tool keeps everything forever puts you in a worse position than having no page at all: you have published a commitment you do not keep. The right method is to start from the real list of your tools, one by one, and describe what each does.
Our privacy policy template is built in that order: tools first, wording second.
Step 3: trackers, where it touches the code
The rule is easy to state and hard to apply: no non-strictly-necessary tracker may be dropped before consent. Not on page load, not in the background, not « while the visitor reads the banner ». A banner that appears after the tag has already written its cookie is worth nothing, and it is by far the most widespread situation.
This means the analytics script cannot live in the <head>: it has to be injected on the click of « accept ». That is a code change, not a wording change, and it is what makes this step longer than the first two.
Good news in the other direction: some analytics are exempt from consent if they stay strictly limited to measurement, with no cross-site reconciliation and no persistent identifier. Asking consent for an exempt tracker is the mirror-image mistake, and it costs you data for nothing. The conditions are listed in our article on cookies and trackers.
Step 4: accessibility, the only real project
The first three points are solved with text and a little code. Accessibility is of a different nature: it touches page structure, contrast, form labels, keyboard navigation, text alternatives. You do not catch it up the night before a deadline.
Its scope widened on 28 June 2025 with the European Accessibility Act coming into application, covering consumer e-commerce among others, while leaving microenterprises below thresholds outside. Many small businesses are therefore not subject to it. That does not make the subject theoretical: the same corrections that make a site usable by keyboard also make it more readable to a search engine, and a form field with no associated label loses conversions long before it becomes a legal problem.
Our article on web accessibility separates the points that are quick to fix from those that need real work.
Where to start, concretely
The order below follows the ratio between risk avoided and time spent, not the order of the legal texts.
- Publish an accurate legal notice, host included. One afternoon, no technical dependency, and it is the most visible failing.
- List your tools, in a three-column table: the tool, the data it sees, the retention period. That table is the raw material of the privacy policy, and it also feeds the record of processing activities.
- Look at what is dropped before any click. Open your site in a private window, open the cookies tab in the developer tools, and count. If something is already there, the banner is decorative.
- Handle accessibility continuously, on new pages first. Reworking an entire site in one go never works.
A word on timing: the first three points fit in a week of work for a small business site. The fourth is measured in months, which is exactly why it should be opened early, even when it is not mandatory.
What our audit measures
Three report categories touch this silo, for 15 checks in total. The legal compliance category holds 2: the presence of a legal notice page and of a privacy policy, both reachable from the site. The privacy and trackers category holds 6, including cookies dropped before any interaction and the presence of third-party tracking scripts. The accessibility category holds 7: image text alternatives, form labels, language attribute, heading hierarchy, among others.
What the audit does not do, and this matters: it does not read the content of your legal pages. It observes that a page exists and that a link leads to it. It cannot know whether your registered address is current, whether your retention period is accurate, or whether your host is really the one you name. On accessibility, seven automated checks deliver no compliance whatsoever: most of the criteria in the reference framework require a human test. An audit tells you where to look, it signs nothing.
Romain Ben