RGPD Compliance English Website France – 2026 Guide
If you run a business in France and your website is written in English, the data protection rules that apply to you are French and European, not those of the country your visitors happen to live in. RGPD compliance for an English website in France, sometimes referred to as ‘RGPD compliance English website France’, is therefore not optional, and it is not solved by copying a privacy page from a British site.
The GDPR, known in France as the RGPD, applies as soon as your organisation processes personal data as part of its activities in the European Union. This guide explains, in plain English, what your site actually needs: a usable privacy notice, a correct cookie banner, clear legal bases and real control over your third-party tools.
RGPD Compliance English Website France – Guide
Reading time: ~10 min
Does GDPR apply to an English-language website run by a French company?
RGPD compliance for an English website in France starts with a clear privacy notice
Moving forward with RGPD compliance for your English website
Does GDPR apply to an English-language website run by a French company?
Yes, in almost every realistic scenario. According to European Commission guidance on the territorial scope of the regulation, an organisation established in the EU is subject to the GDPR when it processes personal data in the context of its activities, even when the processing itself happens outside the EU. Language is not a criterion.
Language does not affect whether the GDPR applies
A gîte in the Vienne that publishes only in English, a consultant in the Dordogne invoicing clients in the UK, an association in the Deux-Sèvres collecting member details: all fall under the same framework because the establishment is in France.
Two layers apply at the same time. The GDPR sets the general rules on legal bases, information, security and data subject rights. The French Data Protection Act, the Loi Informatique et Libertés, adds national specifics, and the CNIL, the French supervisory authority, publishes the operational guidance that matters most for websites, especially on cookies and other tracking technologies. If you are established outside France but target people in France, for example through a shop that ships to French addresses, the GDPR can still apply to that activity because of its extraterritorial reach.
What personal data does your website actually collect?
Most owners underestimate this. Personal data is not limited to a name and an email address. Cookie identifiers, IP addresses and device information count too, which is why analytics and advertising tools are treated seriously by the CNIL. Before writing a single legal sentence, we always start with a personal data inventory, because you cannot describe processing you have never mapped.
Typical personal data collected by an English website in France
Here are the website elements that usually trigger processing and that belong in your register:
Contact, quotation and booking forms, including the message field where visitors sometimes write sensitive information.
Newsletter subscriptions and the record of who consented and when.
Customer accounts, e-commerce orders, delivery addresses and payment references.
Analytics, advertising pixels, chat widgets, embedded videos, maps and social media scripts.
Server logs, security logs, spam filters and backups held by your host.
For each item you need a processing purpose, a legal basis, a data retention period, a list of recipients and the storage location. That record is the backbone of your processing register, and it is the first thing a supervisory authority asks for.
| Website feature | Personal data typically collected | Usual legal basis | Point to check |
|---|---|---|---|
| Contact form | Name, email, phone, message | Legitimate interests or pre contractual steps | Data minimisation and retention period |
| Newsletter | Email, subscription status | Consent | Proof of consent and easy withdrawal |
| Analytics | Cookie IDs, IP related data, device data | Consent unless an exemption applies | No script loading before the choice is made |
| Advertising pixels | Identifiers, browsing behaviour | Consent | Granular choice by purpose |
| Online orders | Identity, address, order and payment data | Performance of a contract and legal obligation | Accounting retention versus marketing reuse |
RGPD compliance for an English website in France starts with a clear privacy notice
Core elements of a GDPR-compliant privacy notice
A GDPR privacy policy on an English website has to be readable by the people who use the site, which means genuine English rather than a machine translation of a French template. The notice should identify the data controller and give contact details, describe each processing purpose, state the legal basis for each one, list the categories of personal data, name the recipients or categories of recipients, explain international data transfers and the safeguards used, state retention periods or the criteria that determine them, and set out data subject rights.
Those rights include the right of access, the right to obtain a copy of the data, rectification, the right to erasure, restriction, portability and objection. The European Commission presents access and the right to receive a copy of your personal data as central individual rights, so your notice must explain how someone exercises them and who answers. Add the method for consent withdrawal and the possibility of lodging a complaint with the supervisory authority, which in France is the CNIL.
One practical detail is often missed. An English privacy policy for a French website should not sit only in the footer. Every form that collects data should link to the relevant privacy information before submission, so the visitor is informed at the moment that matters.
Good to know
If part of your audience is French speaking, publishing the privacy notice in both languages avoids any argument about whether the information was clear and accessible. A bilingual site built properly makes this straightforward, which is something we handle routinely through our website creation service.
French cookie consent requirements and CNIL rules
French rules for cookie banners and trackers
This is where most English websites in France fail. CNIL guidance states that users must be informed and give consent before cookies or other trackers are placed or read, unless an exemption under Article 82 of the French Data Protection Act applies. Strictly necessary cookies, such as a shopping basket or a session identifier, are generally exempt. Non-essential cookies used for analytics, advertising or social sharing are not.
Valid consent must be free, specific, informed and given through a clear affirmative action, as the European Data Protection Board has repeatedly summarised. Continued browsing, scrolling or silence does not count. Pre-ticked boxes do not count either. French public service guidance also recommends that the banner lets visitors accept, refuse or choose by purpose, and that a persistent mechanism such as a link to manage cookies remains available on every page so choices can be changed or withdrawn later.
A compliant cookie banner therefore explains the purposes, names the controllers or third parties involved, offers refusal as easily as acceptance, blocks non-essential trackers until a choice is made, records evidence of consent and allows that consent to be withdrawn at any time. A consent management platform makes this easier, but installing a plugin and leaving the default settings untouched is not compliance. The banner must actually block the scripts.
GDPR requirements for contact forms and newsletters
The legal basis for processing should be chosen purpose by purpose. A contact form used to answer a request can usually rely on legitimate interests or on steps taken at the request of the person before entering into a contract. An order relies on performance of a contract. An invoice retained for accounting purposes relies on a legal obligation. Sending promotional emails to a new prospect normally relies on consent, in line with electronic marketing rules.
Three errors come up again and again on contact forms. The first is asking for information that serves no purpose, such as a postal address for a simple enquiry, which conflicts with data minimisation. The second is bundling a newsletter opt in with the submit button, which removes the specific and freely given character of consent. The third is keeping enquiries indefinitely, with no retention period and no deletion routine. A separate unticked checkbox for the newsletter, a short explanatory sentence next to the form and a defined retention period solve most of it.
Third-party scripts and international data transfers
The most frequent technical failure is simple. Tags fire before the visitor has chosen anything. Tag manager containers, analytics tags, advertising pixels, embedded video players, map widgets, hosted fonts, chat tools and A/B testing scripts all deserve inspection. A proper audit checks first party and third party cookies, network requests, local storage and embedded resources, both before and after consent, because a banner that displays correctly while the scripts run anyway offers no protection.
The second issue is where the data ends up. Many popular tools are operated by providers outside the European Economic Area, or rely on subprocessors and support teams who can access data from elsewhere. For each vendor you should identify the storage location, the access points, the subprocessors, the transfer mechanism such as standard contractual clauses or an adequacy decision, and whether supplementary safeguards are needed. You also need a data processing agreement with each processor, including your host, your email marketing platform and your form provider.
Important
If your site involves large scale monitoring of visitor behaviour or sensitive categories of data, a data protection impact assessment may be required before you launch, not after.
A GDPR web agency checklist for your site
Whether you build the site yourself or work with a professional, the same ground has to be covered. Use this checklist as a working document rather than a one off exercise, and repeat the tests after every redesign or plugin update.
Governance: name the data controller, map every data flow, record purposes, legal bases, retention periods and security measures in a processing register, and decide whether an impact assessment is needed.
Documentation: publish a clear English privacy notice, link it from every form, describe recipients and international transfers, and explain rights, consent withdrawal and complaints.
Technical: scan and classify all cookies, block non-essential trackers before consent, provide accept and refuse options of equal prominence, keep consent evidence, enforce HTTPS, restrict admin access, update the CMS and plugins, and back up securely.
Operational: define who answers data subject requests, how identity is verified, how deadlines are tracked and how processors are informed of deletions.
Common mistakes on English websites in France
The belief that an English site escapes French rules remains the most damaging misconception, and it does not survive contact with the territorial scope of the GDPR. The issues below recur on the sites we review.
| Mistake | Why it fails | Fix |
|---|---|---|
| Assuming English escapes French rules | Establishment in France triggers the GDPR regardless of site language | Treat the site as fully subject to the RGPD from day one |
| Easy accept, hard refuse | Not a genuine choice under CNIL guidance | Give accept and refuse equal prominence |
| Treating analytics as harmless | The tool sets identifiers and reads device data | Classify it and require consent unless exempt |
| Relying on the privacy policy as a shield | It cannot compensate for early scripts or excessive collection | Fix technical implementation alongside documentation |
| Treating consent as permanent | Choices must remain reversible | Provide a persistent way to withdraw consent |
A redesign is often the right moment to fix all of this at once, because consent, performance and content structure are easier to rebuild together than to patch separately. If you are unsure where your current site stands, a content and structure review gives you a clear starting point, and mobile behaviour deserves the same attention, as covered in our guide on responsive mobile websites.
When to consult a privacy professional
This guide is informational and does not replace legal advice. If you process health data, biometric data, data about children, large volumes of profiling data, or if you operate a complex e-commerce environment with many processors, speak to a data protection lawyer or a certified privacy specialist. For a standard brochure site, a small shop or a booking page, careful implementation and honest documentation will usually get you where you need to be.
Moving forward with RGPD compliance for your English website
Compliance is less about legal vocabulary than about knowing what your site does and saying so plainly. Map the data, pick the right legal basis, write the notice in real English, block the trackers until the visitor decides and keep records you could show tomorrow.
If you want a bilingual site that is clear, fast and correctly set up from the start, you can reach us through our contact page, and you will find more practical guides on our blog.
FAQ – Frequently asked questions
Do I need to appoint a data protection officer for a small website?
Most small businesses do not. The obligation applies mainly to public authorities, to organisations whose core activities involve large scale regular monitoring, and to those processing large volumes of sensitive data. You still need someone identified internally who handles requests and keeps the register updated.
Does a cookie consent plugin make my site compliant automatically?
No. A plugin provides the interface, but compliance depends on configuration. The decisive test is whether non-essential scripts are genuinely blocked before consent, whether refusal is as easy as acceptance and whether proof of consent is stored.
Must my privacy notice also be available in French?
The law requires information to be clear, intelligible and easily accessible for the people concerned. If any part of your audience is French speaking, a French version is the safest approach, and it also helps with local trust and search visibility.
How long can I keep contact form enquiries?
There is no single figure in the regulation. You define a retention period that matches the purpose, document it in your register and state the criteria in your privacy notice, then delete or archive the data when that period ends.
Where do visitors complain if they are unhappy with how I handle their data?
In France, to the CNIL, which is the competent supervisory authority. Your privacy notice must mention that right, and in practice most complaints start because a request for access or deletion went unanswered.