Website Compliance Insights
Lexmagis reviewed, on its own initiative and without remuneration, a pilot sample of 15 randomly selected law firms’ websites in France to examine how key digital regulatory and transparency requirements are implemented in practice. The review considered several interconnected areas of website compliance, including legal information, privacy and cookie documentation, consent mechanisms, and the observable behaviour of cookies and tracking technologies.Law firms’ websites were selected for this pilot because legal services operate within a highly regulated professional environment, where regulatory awareness and professional obligations form an integral part of everyday practice.
The findings nevertheless demonstrate that digital compliance gaps can arise even in highly regulated sectors. This provides a useful illustration of why website compliance should not be presumed on the basis of an organisation’s profession, expertise or regulatory environment alone.Website compliance cannot be assessed reliably from the presence of individual documents or banners alone. A privacy policy may be present but outdated, a cookie banner may be displayed while trackers are already being deposited, or information presented to users may not correspond with the website’s observable technical behaviour. A structured review therefore considers how these different elements operate together rather than assessing their presence in isolation.The findings below present selected patterns identified through the pilot review.
The assessment was conducted using publicly available information and observable website behaviour. Results are presented on an aggregated and anonymised basis, and no individual lawyer or law firm is identified.The indicators presented represent selected aspects of the review and should not be interpreted as an exhaustive website compliance checklist.
The charts below explore these patterns in greater detail and show how individual compliance indicators relate to one another. This review illustrates why compliance should not be assumed and why regular, structured website reviews remain important.
Key findings
Privacy information on sites requiring a cookie banner
Among the websites requiring a cookie banner, 38.5% provided an accurate Privacy/Cookies Policy, while 61.5% displayed an outdated policy. This indicates that the presence of privacy documentation does not necessarily mean that the information provided is current and aligned with the website’s actual use of cookies and tracking technologies.
Cookie management controls
Among websites requiring a cookie banner, 77.8% provided a cookie management button allowing users to revisit their cookie preferences, while 22.2% did not. Users should be able to withdraw or modify their consent at any time through an easily accessible mechanism.
Cookies placed before consent
Among websites where cookies were placed before consent, 66.7% displayed a cookie banner, while 33.3% did not. The presence of a cookie banner therefore does not, by itself, demonstrate that consent is obtained before non-essential cookies or trackers are placed.
Tracker deposition before consent
Among websites that disclosed the use of trackers or analytics tools, 63.6% deposited trackers before consent was obtained, while 36.4% deposited them only after consent. The finding highlights a significant failure to respect the principle that non-essential trackers must not be deposited before the user has provided valid consent. Disclosure of tracking practices alone is therefore not sufficient where the technical implementation does not respect the requirement to obtain consent before tracker deposition.
Key terms used in this analysis
Privacy / Cookies Policy
Information provided to website users concerning privacy, personal-data processing and the use of cookies or similar technologies. The scope and adequacy of this information depends on the website and the processing activities concerned.
Cookie banner
An interface through which users may be informed about, and where required make choices concerning, cookies and similar technologies. The presence of a banner does not by itself demonstrate that the underlying consent mechanism operates correctly.
Cookie management
Functionality allowing users to revisit or modify previously expressed cookie preferences.
Trackers / analytics technologies
Technologies used to measure, analyse or otherwise observe website usage. Their regulatory treatment depends on their purpose, configuration and circumstances of use.
Deposition before consent
For this analysis, this refers to relevant cookies or trackers being observed before the user had expressed a consent choice.
These definitions are provided to assist interpretation of the findings and do not constitute an exhaustive description of the applicable requirements or Lexmagis review methodology.