The micro-entrepreneur regime simplifies administrative management, but an online presence generates specific legal obligations that most guides address superficially. Since the SREN law of May 2024, the legal framework for legal notices has changed profoundly. Ignoring these developments exposes one to sanctions that are no longer trivial.
Legal Notices After the SREN Law: What Has Changed for Online Auto-Entrepreneurs
Law No. 2024-449 of May 21, 2024 (SREN law) has repealed the former Article 6 III of the LCEN. The obligations for identifying website publishers now rely on the articles 1-1 and 1-2 of the law of June 21, 2004, in effect since May 23, 2024.
Article 1-1 imposes five distinct blocks of information: identity of the publisher (name, first name, address, with the mention “individual entrepreneur” or “EI”), phone number, registration number (SIREN/SIRET, RCS or RM depending on the activity), publication director, and complete contact details of the hosting provider (including address and phone).
A technical point often overlooked: the text requires that this information be made available in an open standard. In practical terms, this means an accessible HTML page, readable without proprietary technology. A protected PDF or an image containing your legal notices does not meet this requirement.
Article 1-2, created by the same law, organizes a specific sanction regime in case of non-compliance. We recommend checking the compliance of your legal notices with this five-block structure, as models prior to May 2024 are obsolete. For more in-depth information, the details available on the legal page of Auto-Entrepreneur du Web outline the requirements specific to micro-entrepreneurs.
GDPR and Cookies: Technical Obligations for a Micro-Entrepreneur’s Website
The GDPR applies regardless of the size of the business. An auto-entrepreneur operating a website that collects personal data (contact form, newsletter, analytics) is considered a data controller under the European regulation.
Three technical obligations arise as soon as your site sets non-strictly necessary cookies:
- A compliant consent banner, with a “reject” button as accessible as the “accept” button, without pre-checked boxes or dark patterns steering the user’s choice
- A privacy policy distinct from the legal notices, specifying the legal basis for each processing, the data retention period, and the rights of individuals (access, rectification, deletion, portability)
- A processing register, even simplified, describing each purpose of collection, the categories of data concerned, and any subcontractors (host, emailing tool, payment platform)
We observe that many micro-entrepreneurs install a WordPress theme with a cookie plugin without ever configuring the categories of trackers. The plugin alone guarantees nothing if the configuration does not reflect the cookies actually set by the site.
Electronic Invoicing and Online T&Cs: Often Confused Requirements
When an auto-entrepreneur sells services or products via their site, two sets of rules overlap: invoicing obligations and general terms of sale.
Invoicing in Micro-Enterprise Online
Each invoice issued must include the mention “VAT not applicable, article 293 B of the CGI” as long as the micro-entrepreneur benefits from the VAT exemption. The absence of this mention constitutes a formal irregularity that can lead to a reassessment.
The invoice must also bear the SIREN number, the mention “EI” or “individual entrepreneur,” and a sequential invoice number without breaks. Dematerialization does not exempt any of these mentions.
T&Cs for Online Sales
The general terms of sale are mandatory for any distance selling activity. They must be accepted before the order is validated. Their minimal content includes:
- The payment, delivery, and contract execution terms
- The 14-day withdrawal right (sales to consumers), with the standard withdrawal form or a link to it
- The legal guarantees of conformity and hidden defects
- The procedures for handling complaints and, if applicable, the referral to a consumer mediator
The consumer mediator must be specifically named on the site, along with their contact details. This obligation, stemming from the Consumer Code, is one of the most frequently overlooked by auto-entrepreneurs.
Telemarketing: The New Ban from August 2026
The decree of July 23, 2026, established the transition to a prior consent regime for telemarketing, applicable since August 11, 2026. Commercial phone calls to prospects who have not given their explicit consent are now prohibited.
For an auto-entrepreneur who prospects by phone via their site (callback form, appointment booking), the consent collection mechanism must be traceable. A simple “be called back” form is no longer sufficient: there must be a timestamped proof of consent specific to telemarketing, distinct from consent to be contacted for order follow-up.
This rule also applies to auto-entrepreneurs who subcontract their prospecting. The responsibility of the principal remains engaged even if the call is made by a third party.
Insurance and Professional Civil Liability Online
No law requires professional liability insurance for all auto-entrepreneurs. However, certain regulated activities require mandatory insurance (construction, financial advice, transport). For non-regulated activities conducted online, professional liability insurance remains optional but covers a real risk: erroneous advice, a defective product, or a data breach can engage the civil liability of the micro-entrepreneur without a cap related to their status.
The website itself must mention, if professional insurance is taken out, the name of the insurer, the geographical coverage, and the contact details. This mention falls under the information obligations provided by the Consumer Code for service providers.
The legal compliance of an online auto-entrepreneur is not limited to legal notices. It encompasses GDPR, invoicing, T&Cs, telemarketing, and insurance. Each aspect responds to a different text, with its own sanctions. It is better to audit your site once a year than to discover non-compliance during a check or a client dispute.