Most shops built outside Europe have one page, called something like legal information, that contains an address, a paragraph about cookies and a sentence about privacy. It fails for a reason that has nothing to do with effort: it answers separate obligations with one block of text. Each of them has its own trigger, its own level of detail, its own enforcer, and its own national variations — and the one that gets you noticed is almost never the one you worried about.
Separate obligations that end up on the same page
- Identifying the seller. Who sells, under what legal form, from what address, registered where and under what number, with a tax identification where applicable, and reachable by a means that allows rapid, direct contact — including an electronic address. Where the activity is regulated, the supervising authority is named too. This is the information society duty, and it applies to the site itself, whether or not anything is sold on it.
- Informing the consumer before the order. The main characteristics of the product, the total price including taxes and delivery charges, the arrangements for payment and delivery, the existence and conditions of the right of withdrawal with the model form, the legal guarantee of conformity and any commercial warranty, the cost of returning the goods, how complaints are handled and which dispute scheme applies. This is consumer law, it is owed per order, and the proof that it was given before the click belongs to you.
- Obtaining consent for trackers. Cookies and equivalent technologies that are not strictly necessary to provide the service require consent before they are placed — freely given, specific, informed, provable, and as easy to refuse and to withdraw as to give. This comes from the rules on electronic communications, not from the general data regulation, which is why it is enforced by a different team and sanctioned on a different basis.
Why the form and the level of detail change from one member state to the next
Much of this comes from European texts that are transposed into national law rather than applied directly, and transposition leaves room. Member states add their own required mentions, their own language rules, their own expectations about where the information sits and how visible it must be, and their own route for enforcing it. Some also layer sector rules on top — distance selling of certain product families, regulated professions, anything involving credit or health. A page copied from a shop that trades in one country is therefore a draft in the next, never a template, and the honest answer to « what exactly must it say » is that it depends on where you sell.
Practical consequences follow. The information has to be easily, directly and permanently accessible — which in practice means a link present in the footer of every page, reachable before the order and not reconstructed inside a chat window. And incomplete identification is the cheapest thing in the world to attack: in several member states it is sanctioned through procedures that do not require a court, and in most of them a competitor or a consumer association can act where no authority has bothered. Nobody needs access to your accounts to notice that the trader is not named.
Cookie banners that no longer pass
The banner that accepts everything with a bright button and hides refusal behind a link called « learn more » is the pattern now being attacked, and it is attacked because it is visible from a browser without any investigation. Refusing has to be as easy as accepting: same level, same number of actions, comparable prominence. Nothing non-essential may load before the choice is made — not the analytics script, not the advertising pixel, not the font loaded from a third party, not the embedded video player. Boxes may not be pre-ticked, purposes have to be separable, withdrawal has to be as simple as consent and permanently reachable, and you have to be able to show what was consented to and when.
A page structure that holds in several countries
- A legal notice page: the trading entity, its legal form, its registered address, its registration and tax identification, the name of whoever is responsible for the site, the hosting provider, and a contact that reaches a human. Linked from the footer of every page, in every language version.
- Terms of sale carrying the consumer information: characteristics, total price and charges, payment and delivery, withdrawal with the model form reproduced, the legal guarantee of conformity, returns and who pays for them, complaint handling and the dispute scheme.
- A privacy notice naming the controller and, for a seller established outside the Union, its representative inside the Union, with purposes, lawful bases, recipients, transfers, retention and the rights and how to exercise them.
- A tracker policy listing what is placed, by whom and for what, plus a permanently available link that reopens the choice. Keep it separate from the privacy notice: it is a different obligation with a different enforcer.
- A per-country layer rather than a per-country rewrite: the identification block identical everywhere, the consumer information and the dispute scheme adapted to the state, and the whole set in the language of that state.
- A dated version history kept outside the site. When a complaint arrives about an old order, what matters is what the page said then, not what it says now.
Who actually reads this page
Rarely the customer, and that is why it is neglected. The payment provider reads it when it opens your account, and again whenever a chargeback pattern makes it look at you. The marketplace reads it during seller verification. The B2B buyer reads it before a first order, because it is the quickest way to find out who it would be contracting with. A competitor reads it when you start taking its sales, and a consumer association reads it when a complaint arrives. Which makes the page a sales document as much as a legal one: for a seller nobody has heard of, a complete identification block is the cheapest trust signal available.
Build the identification block once, in a single source file, with the exact legal name, form, address, registration, tax identification, the data representative and a role mailbox — then publish it unchanged in every language and on every channel, including your marketplace shops and your invoices. Most failures are not wrong rules; they are an address that changed in one place and not the others. Adapt only the consumer-information layer per country, and have it read by someone practising in that country before you sell there, not after the first complaint.