The Page Behind a Code Is a French Website, Footer or Not
Think about how someone reaches a page opened from a code. They were standing in front of a poster, a window, a table tent or a parcel. They scanned. One page loaded. They read it, did the thing, and closed the tab.
They never saw a homepage. They never scrolled to a footer, because on a single-purpose page there often is no footer worth scrolling to. They have no idea who published what they just read, and under French law that is your problem rather than theirs.
The obligation moved, and everyone is still citing the old address
For twenty years, French practitioners cited "article 6, III de la LCEN" for the mentions légales. That reference is now wrong, and worth correcting in your own templates.
The loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique, the loi SREN, restructured the loi n° 2004-575 du 21 juin 2004 pour la confiance dans l'économie numérique to align it with règlement (UE) 2022/2065 on digital services. The identification obligation now sits at article 1-1 de la LCEN, and the criminal sanction at article 1-2, which sets one year of imprisonment and a fine of 75 000 euros for a natural person. Article 6 still exists, but its III now deals with something else entirely.
Nothing about the substance got easier. The obligation is on "les personnes dont l'activité est d'éditer un service de communication au public en ligne", and a landing page reached from a code is one.
What has to be reachable from that page
The text requires the information to be made available to the public "dans un standard ouvert", which in practice means ordinary readable web content and not an image, a PDF or something behind a script.
For a legal person: the denomination or raison sociale and the registered office, a telephone number, and, where the entity is subject to registration formalities, its registration number, its capital and the address of its establishment. For a natural person acting professionally: name, forenames, domicile and telephone number, plus the registration number where one applies. Alongside that, the name of the publication director, and the name or denomination and the address of whoever hosts the service.
There is a separate route for people publishing in a non-professional capacity. They may keep their identity off the page by publishing the host's details instead, having given their own identity to the host, who is bound to professional secrecy over it. That matters for an association, a club or an individual putting a code on a noticeboard, and it does not help a business.
If the page sells anything, a second list applies. Article 19 de la LCEN requires anyone carrying on electronic commerce to give "un accès facile, direct et permanent utilisant un standard ouvert" to their identity, address, email, telephone, registration number, capital and VAT identification number. It transposes article 5 of directive 2000/31/CE, which is why the same idea appears across the European Union. It is generally accepted that a hyperlink satisfies this, provided the link itself is easy, direct and permanent. A link in a footer six screens down, on a page a scanner opened, is arguably none of the three.
The specific failure a code creates
Every one of these obligations assumes a visitor who can navigate. Codes break that assumption in a way ordinary web traffic does not:
- There is no upstream. No homepage, no nav, no breadcrumb. The page is the entry point and often the exit.
- The session is short. A person standing in a shop reads one screen. Anything below the fold is theoretical.
- The page may be the whole site. Many codes point at a single hosted page with no other pages behind it. In that case the page is not part of a site that has mentions légales somewhere. It is the site.
- The visitor may be offline moments later. A page that loads its legal notice from a third-party script is a page whose legal notice sometimes does not exist.
So a compliant landing page needs the link in the page itself, above or near the primary action, not only in a footer. One line of small type reading "Mentions légales" and "Données personnelles", linked, in the first screen. It costs nothing and it settles the question.
What else belongs on that page, depending on what it does
Work through this as a short decision list rather than pasting everything onto every page.
| If the page... | it also owes |
|---|---|
| collects any personal data | the information required at collection by the RGPD: who you are, why, on what basis, how long, and the person's rights |
| stores or reads anything non-essential on the device | a choice before that happens, under article 82 de la loi n° 78-17 du 6 janvier 1978 |
| sells to consumers | pre-contractual information under the code de la consommation, and the mediator details |
| is published by a business at all | the mediator's name and website, which article L. 616-1 du code de la consommation requires, communicated per article R. 616-1 in a clearly visible and legible way on the website and in the general terms |
That last one surprises people. A consumer-facing business has to tell consumers which consumer mediator covers it, and the site is one of the places the implementing article names.
The part the page cannot cover at all
There is one thing a landing page genuinely cannot reach, and it is worth knowing where the boundary falls. A dynamic code resolves through a redirect, and the redirect server receives and logs the request before your page exists. Any notice or choice presented on the page governs what happens next, not the hit that got the visitor there. Our piece on scan tracking, consent and retention works through that in general terms.
The practical consequence is that the physical object carrying the code is the only place you can say anything before the scan. One short line next to a code, naming who published it, is the cheapest trust signal available and the only one that reaches someone who has not scanned yet.
A checklist for the page behind a code
- A visible link to mentions légales in the first screen, not only in a footer.
- Real readable text behind that link, not an image or a PDF.
- Publisher identity matching the register: the same denomination, the same registration number, the same registered office.
- Host name and address, which is the line most often missing.
- Publication director named.
- A privacy notice reachable from the same place, saying what the redirect log holds and for how long.
- Consumer mediator named, if you sell to consumers.
- Nothing load-bearing below the fold, because on a phone opened from a sticker there is effectively no below the fold. Our guide to mobile-first landing pages covers the layout consequences.
- The whole thing tested at the size and in the light the scan will actually happen in.
This is general information rather than legal advice, and where a page sells, processes health data or targets minors, the list gets longer and a lawyer should see it. But the structural point stands on its own: a code hands a stranger one page with no context. Build the page as though it were the only thing you publish, because for that visitor it is.
