You answer about what the site really does: who publishes it, where it is hosted, what it collects, which tools it loads. Both documents come out together, with no host forgotten on one side and no tool made up on the other.
You will also know whether you need a cookie banner. And if you are building a client's site, they leave with an approval sheet to sign: they are the publisher, and they answer for it.
If it is for a client, the documents will be written in their name: they publish the site, and they answer for it.
Everything happens on your device: the documents are built there, nobody receives your answers, not even us, and it all disappears with the tab.
Information verified on November 5, 2026. No official template exists for these documents: they are composed from the law, Service Public and the CNIL's recommendations, recorded and dated. They are not legal advice, and the site's publisher remains responsible for their accuracy.
The official pages where we read the rules and amounts applied here.
French law puts the obligations on the publisher: the person whose activity is to put the site online. On your site, that is you. On the site you deliver to a client, it is them, even if you wrote everything. What the freelancer owes the client depends on their contract: put it in writing. The approval sheet produced here keeps a record of it, since the client confirms there that they supplied the information and read the texts.
It can be read without an account and without having to hunt for it. For a business website, Service Public lists:
A policy copied from another site is the most common flaw: it announces a newsletter you do not have, forgets the host of your database, or swears no cookie is set while a YouTube video sets some. For each collection, the text must say which data, why, on what basis, for how long and who receives it. The periods used here come from the CNIL, the commercial code and Service Public; for a contact form, no text sets a figure, and the policy speaks of the time needed to reply.
A tracker that is not strictly necessary for the service requested, and does not fall under an exemption such as anonymous audience measurement, needs the visitor's consent before it is set. The banner must follow three rules:
| What the site loads | Visitor consent | Why |
|---|---|---|
| Google Analytics | Yes | Google reuses the data for itself: the CNIL excludes it from the exemption |
| Matomo configured to its guide hosted by the CNIL | No | Anonymous statistics, for you alone, with no cross-site tracking |
| Embedded YouTube or Vimeo video, map, booking tool | Yes | Third-party content sets its trackers as soon as it loads |
| reCAPTCHA | Yes | The CNIL names it: it reuses data beyond security |
| Meta pixel, Google Ads, share buttons that set trackers | Yes | The CNIL exempts neither personalised advertising nor these buttons |
| Cart, login, remembering the cookie choice | No | They serve what the visitor asks for |
The CNIL no longer publishes a list of exempt tools: an audience tool is exempt if it meets its criteria and is configured for it, and the site's publisher answers for that.
Malik, a photographer, puts his portfolio online. No statistics, no advertising: he copies a policy saying « this site sets no cookies ».
At the top of his home page, he has embedded his showreel, hosted on YouTube.
The video loads with the page, and YouTube's trackers with it, before the visitor has chosen anything.
He replaces the video with an image that only loads it on click, with the visitor's consent, and his policy now says what happens: no cookie is set without your consent.
He had no form and no statistics. A single video was enough to make the sentence in his policy false.
Create two separate pages, and link them at the bottom of every page of the site.
Keep the policy separate from your terms and conditions. Service Public asks for it.
Come back to the tool the day you add a tool, a host or a form.
Fill in the questions with them, or from their written answers. It is their name that will be published.
Have them sign the approval sheet before going live, and keep it with the quotation.
Write in your quotations that the client supplies and approves their legal documents, and that you give no legal advice.
Yes, as soon as the site serves their business, even a simple portfolio. Leaving it out is punishable by a fine of up to €75,000 for a sole trader, micro-entrepreneurs included, and €375,000 for a company. The « EI » mention next to your name comes from another rule, the commercial code's rule on a sole trader's documents, which Service Public also applies to the website.
For an individual, the law speaks of their « domicile », and Service Public of the business's registered address. If your business is registered at home, that is the address on the register, and the two are the same. If you use a domiciliation company, Service Public goes by the address declared to the register. The two texts do not say quite the same thing: if in doubt, ask your registry or a lawyer.
For the notice itself, the client, because they publish the site: the law targets the person whose activity is to put it online. What the developer owes the client depends on their contract. To put that split in writing, have your client sign the approval sheet the tool produces, and add a clause to your quotations saying they supply and approve their legal documents.
Yes. Google reuses the data for its own purposes, and for that reason the CNIL excludes it from the exemption granted to audience measurement. A tool set up to produce anonymous statistics, for you alone, with no cross-site tracking, can do without: that is the case for Matomo configured to the guide hosted by the CNIL. It no longer keeps a list of exempt tools, and checking the configuration is up to you.
The law does ask for the host's phone number, and most large hosts show none. Look for it in your contract or customer area, or ask support. Meanwhile, the tool writes « non communiqué par l'hébergeur » rather than a number found in a directory, which could belong to another subsidiary: add the right one as soon as you have it.
Invoicing properly is half the work.
Believemy is the school for solopreneurs. You learn to build, to raise your game with AI, and to sell.
See the courses