Cookie policy template

What a cookie policy is, and what this builds

A cookie policy is the “clear and comprehensive information” the EU’s ePrivacy rule asks for before a site stores or reads anything on a visitor’s device. In practice it is a list: every cookie, who uses it, what for and for how long, filed under the same groups the banner offers. The banner asks the question; the policy is the page the banner links to so the answer is informed.

This builder keeps the list as a ledger by group, writes the policy around it, and reads back what the list implies for the banner: which switches it needs, which it does not, and how a visitor gets back in to change their mind. For the banner itself, run the cookie banner checklist; for the rest of your notice, the privacy policy checklist.

How to use this cookie policy template

1. Get the real list. Open your site in a private window, accept everything, then open the browser’s developer tools and read the cookies under Application (Chrome, Edge) or Storage (Firefox). If you run a consent platform, its scan report is quicker: paste its rows into the builder.
2. Copy the vendor’s own words. Name, purpose and lifetime come from the vendor’s cookie page. Where a vendor publishes no lifetime, read the expiry date in the same developer-tools panel and write that.
3. Sort each cookie into a group. “Strictly necessary” is a narrow door: the builder flags any cookie filed there whose purpose reads like analytics or ads.
4. Read the banner line. The switches it lists are the ones your banner must offer, with the same group names. A group with no cookies needs no switch.
5. Publish it where the banner links, and change the date whenever a tool is added or removed.

Keep the policy and the banner saying the same thing

Regulators read the two side by side. A policy that promises a reject button the banner lacks, or lists four cookies when the site sets nine, is the cheapest finding there is. Each promise the generated text makes has a matching job on the site:

Banner patterns that get this right, and the patterns regulators objected to, are collected in our cookie banner examples. If you are choosing a tool to run the banner and the scan, start with the consent management platforms compared on these rules.

Worked example: the candle shop's list

The pre-filled shop runs on Shopify, with the Meta Pixel for its ads, Klaviyo for its email sign-up and a YouTube video on product pages. Its 10 cookies, each read on the vendor’s own page on 22 Oct 2026:

What the builder reads back: 6 of 10 cookies wait for consent, so the banner needs statistics and marketing switches and no preferences switch. It raises 2 points: Meta’s developer page gives no lifetime for _fbp, so the shop reads the expiry in its own browser and writes it in; and the YouTube player’s session cookie needs a decision on whether it is California “sharing”.

First party is about the domain, not about who you trust

Two of the vendors in the example say outright that their cookie lives on the shop’s own domain. Meta says the Pixel “automatically saves a unique identifier to an _fbp cookie for the website domain”, and Klaviyo notes that the values “are stored in a browser cookie on your domain”. Browsers file both as first party, but the company reading them is Meta or Klaviyo, which is why the policy names a provider for every line instead of leaning on the first-party label.

Shopify draws the line from the other side: “We do not set advertising cookies through our merchants’ storefronts ourselves, though merchants may choose to do so independently.” Every ad cookie in the example arrives through an app or pixel the shop chose, so it is the shop’s to list.

Jurisdiction notes

EU. The consent duty for cookies sits in the ePrivacy Directive, Art. 5(3), and the quality of that consent comes from the GDPR: specific, informed, and withdrawable as easily as it was given (Art. 7(3)). The EDPB’s cookie banner taskforce adds that legitimate interests cannot be the basis for placing cookies (¶ 24). If your main analytics tool is the reason for the banner, a cookieless analytics tool can shrink the list.

California. Ad cookies are where cookie law meets the CCPA: if a cookie lets another company use visits for cross-context behavioral advertising, that is “sharing”, and the site must process opt-out preference signals and post the opt-out link (only a site that processes the signals frictionlessly may leave the link off, regs § 7025(e), (g)). Our guide to the “Do Not Sell or Share” link covers when the link is needed; the GPC checker shows what the signal looks like from your own browser.

Colorado, Oregon, New Jersey. Each state’s regulator names Global Privacy Control as a signal businesses must honour (Colorado since 1 July 2024, New Jersey from 15 July 2025, Oregon from 1 January 2026). Where another state law requires honouring an opt-out preference signal, its text does not name one.

Questions