Skip to main content
Resources · Website and email exposure · France

Is your website quietly exposing your business?

Regulators, courts and criminals can check four things about your business from the outside, without asking you: whether someone can send email in your name, whether your website follows visitors before they agree, whether customers with a disability can buy, and how safe your payment pages are. This room shows what each one is, what it can cost you, and how to close it.

Free, in ten seconds

Can someone send email as you?

Type your web address and see, in plain words, what every mail server checks before it trusts an email from you.

Check my domain
72%

of monitored French domains had no effective DMARC protection in September 2026.

DmarcDkim.com, Sep 2026
€486.8M

in fines from the CNIL, France's data protection regulator, in 2025, across 83 sanctions. Cookies were a main theme.

CNIL, 9 Feb 2026
$3.0bn

reported lost to fake invoices and payment requests by email in the US in 2025 alone.

McDonald Hopkins, 7 Apr 2026
69%

of disabled online shoppers leave a website they find hard to use.

AbilityNet, 11 Feb 2020

The four exposures

What can be seen from outside


How it works

From blind spot to proof, in days

01Assess

Answer the questions here, or ask for our free scan.

02See it

A private report with screenshots and plain explanations.

03Fix it

Fixed price, done for you, mostly within two weeks.

04Prove it

A dated record of what was found and fixed, to show a regulator, a court or a client.

05Keep it

A weekly re-scan catches the next add-on or tracking tool that breaks it.

Free exposure scan

Confirm it with a real scan

We read only what any visitor can see, and your domain's public settings: no login, no testing of your systems. You get a private report by email with screenshots, a score for each of the four exposures, and fixed prices.

How we use your details: privacy notice.


Your sector

The same four exposures, read for your business

Creators, brands and agencies

Running a campaign with creators?

Who the rules reach in France, the UK and the Netherlands, the 16 checks of a campaign, recent decisions and a two minute self-check.

See the checks

Myths and better beliefs

What owners tell themselves

What owners often believe
What is closer to true
"Regulators only go after the giants."
The headlines are about giants. The volume is not: the CNIL, France's data protection regulator, issued 23 fast-track fines against smaller organisations in the first half of 2026 alone, most of them after a complaint from a member of the public.
"Nobody would bother faking our emails."
Small firms are the easier target. Without the right email settings, anyone can send an invoice from your exact address, and your customer cannot tell.
"We have a cookie banner, so we are fine."
A banner that lets tracking start before the visitor answers, or hides the Refuse button, is the breach regulators fine most often.
"Accessibility is for public sector websites."
Since 28 June 2025 the law also requires most online shops in the EU with 10 or more staff or over €2 million turnover to work for customers with disabilities.
"An accessibility widget solves it."
A widget is an add-on laid over your site: it does not fix the page underneath. Automated tools find only some of the problems. Real fixes are made in the page itself.
"Our payment provider handles security."
If card details are typed on your own pages, the card companies' rules now require you to list and watch every script, each piece of code, on that page.

Start with the four minute assessment

Sixteen questions, a score per exposure, a 30 day action list and a price. Nothing is sent unless you ask for the free scan.

Start the assessment
Marketing Lioness · The Exposure Room. Not legal advice. Figures as published by the sources listed, checked 8 November 2026.