A cookie policy tells visitors which cookies your website sets, why, for how long, who else receives the data and how to change their choice. To write one, scan your site for cookies, group them into categories, then fill in seven sections: an introduction, what cookies are, a cookie table, how consent works, how to withdraw it, third parties and contact details. The template below gives you those sections with sample wording to adapt.
Every privacy law that touches cookies, from the ePrivacy Directive and the GDPR to the CCPA and the UK's PECR, expects the same thing: tell visitors what you set, why you set it and what choices they have. If that information is wrong, the consent your banner collects is built on the wrong facts, however well the banner is designed.
Regulators check. In 2025 the CNIL, France's data protection authority, imposed 83 sanctions totalling €486.8 million, with cookies among the main subjects. In January 2025 the UK's Information Commissioner's Office communicated concerns to 134 of the top 200 UK websites in its review of cookie banners.
What a cookie policy is, and how it differs from a privacy policy
A cookie policy is a standalone page, or a clearly marked section of a privacy policy, that explains how your website uses cookies and similar technologies. It covers cookie names, purposes, durations, categories and third-party providers.
A privacy policy covers all personal data processing across your organisation: customer databases, email lists, employee records and everything else. Cookies are one part of that picture. Some sites combine the two, but a separate cookie policy is easier for visitors to find and easier to keep up to date.
The legal requirements behind your cookie policy
Three frameworks set what a cookie policy must say. Article 5(3) of the ePrivacy Directive requires clear and comprehensive information before a non-essential cookie is stored, and exempts strictly necessary cookies from consent. Articles 13 and 14 of the GDPR require transparency about what personal data is collected, for which purposes, on what legal basis, who receives it and how long it is kept. In California, the CCPA requires disclosure of the categories of personal information collected, including data gathered through cookies.
The UK follows the same model through PECR and the UK GDPR. Since 5 February 2026, PECR as amended by the Data (Use and Access) Act 2025 lets some statistics and appearance cookies run without consent, as long as visitors are told about them and can object, so a UK policy should explain how to object.
Missing information is a finding in its own right. When the CNIL fined Shein €150 million in September 2025, the cookies set before any choice were joined by incomplete information about them.
Cookie policy template: the sections and sample wording
Copy the template, replace every part in square brackets and delete the notes that do not apply to your site. It follows the two-level approach regulators describe: your banner gives the short version, and this page gives the detail.
Cookie policy
Last updated: [date]
1. Who we are
This cookie policy explains how [company name] ("we") uses
cookies and similar technologies on [website address].
You can contact us at [email address] or [postal address].
[If you have a data protection officer: Our data protection
officer can be reached at [email address].]
2. What cookies are
Cookies are small text files that a website stores in your
browser. We also use [local storage or pixels], which store or
read information on your device in a similar way. In this
policy, "cookies" covers all of them.
3. The cookies we use
[Table with one row per cookie: name, provider, purpose,
category, duration, first-party or third-party.]
Strictly necessary: needed for the site to work, such as
keeping you signed in or remembering your cookie choice.
They do not need your consent.
Analytics: [for example, Google Analytics counts visits and
shows which pages are used]. Set only if you accept them.
Marketing: [for example, the Meta Pixel measures our ads].
Set only if you accept them.
4. How we ask for your consent
When you first visit, a banner lets you accept all cookies,
reject all non-essential cookies or choose by category.
Non-essential cookies stay blocked until you choose. We keep
a record of your choice for [period].
[UK sites using the statistics or appearance exception:
explain which cookies run without consent and how to object.]
5. How to change or withdraw your choice
You can change your choice at any time through [Cookie
settings link or button], as easily as you gave it. You can
also delete cookies in your browser settings.
6. Third parties
These companies set cookies on our site or receive data
from them: [Google Ireland Limited, Meta Platforms Ireland
Limited, ...]. Their privacy policies: [links].
[If data leaves the EU or UK: name the safeguard, such as
the EU-US Data Privacy Framework.]
7. Changes to this policy
We update this policy when the cookies on our site change.
The date at the top shows the latest version. Questions:
[email address].For the banner itself, a short cookie statement can sit on the first layer. Name the purposes and companies, and give both choices equal weight:
We use cookies that the site needs to work. With your permission, we also use Google Analytics to count visits and the Meta Pixel to measure our ads. You can accept all, reject all or choose by category, and change your mind at any time in Cookie settings. Read our cookie policy for details.
Pair it with three buttons of equal weight: "Accept all", "Reject all" and "Manage preferences".
The seven sections of a cookie policy and the rule behind each
Step 1: run a cookie scan
Before writing a word, you need an inventory of every cookie your site actually sets. Open your browser's developer tools, clear all storage, visit your site and check the Application tab. A cookie scanning tool goes further: it crawls many pages and records cookies set by iframes, third-party scripts and tags that load later.
Record four things for each cookie: its name (for example _ga, _fbp or PHPSESSID), its purpose, its duration and whether it is first-party or third-party. For an unfamiliar name, look it up in the Cookie database. This inventory becomes the backbone of your policy.
A one-time scan is not enough. Plugins update, marketing teams add tracking pixels and platforms change how they use cookies. Scan again on a schedule, monthly at least and weekly if your site changes often.
Step 2: categorise your cookies
Group each cookie into one of the standard cookie categories. Regulators and consent banners use these groupings to structure the choices and the disclosures.
| Category | Purpose | Consent required? | Examples |
|---|---|---|---|
| Strictly necessary | Core functions: sessions, sign-in, security, load balancing | No, but list them | PHPSESSID, csrftoken |
| Functional | Settings the visitor chose: language, region, display | Often no, when the visitor chose the setting. Yes if reused for analytics or ads | wp_lang, a language cookie |
| Analytics | Usage measurement and performance | Yes in most countries, with narrow exemptions | _ga, _ga_<container-id>, _hjSession |
| Marketing | Ad targeting, retargeting, cross-site tracking | Yes | _fbp, IDE, NID |
The CNIL lists interface personalisation such as a language choice among the trackers that need no consent, as long as it is an expected part of the service. Be honest about the rest: a marketing cookie labelled "functional" to skip consent misinforms visitors and gives a regulator an easy finding.
Step 3: write each section of the policy
The template above has the structure. To generate a cookie policy instead of writing it by hand, a generator can fill the same sections from your scan. Either way, here is what each section needs.
Introduction
State what the document is, who publishes it (your company name and contact details) and when it was last updated. One paragraph is enough. Write for a general audience and avoid jargon.
What cookies are
Explain briefly that cookies are small text files stored on a visitor's device. Mention related technologies too, such as local storage and pixels, because the ePrivacy Directive covers any technology that stores or reads information on the device, not just HTTP cookies.
Cookie table
This is the core of the policy. List every cookie with its name, provider, purpose, category, duration and whether it is first-party or third-party. A table works best. If you have dozens of cookies, group them by category.
How consent is collected
Explain how your banner works. Say which categories are blocked by default and set only after opt-in consent, and that strictly necessary cookies are set without consent but listed in the policy.
How to manage or withdraw consent
Tell visitors how to change their choice. Under Article 7(3) of the GDPR, withdrawing consent must be as easy as giving it, so a revisit button or a "Cookie settings" link in the footer belongs in this section, with browser settings as a second route.
Third-party cookies and data recipients
Name every third party whose cookies appear on your site, such as Google, Meta, LinkedIn or Hotjar, and link to each provider's privacy policy. This is where many cookie policies fall short. The CNIL's guidance describes a second level of information that lists the companies responsible for the processing.
Data retention and cookie duration
State how long each cookie lasts. No EU law sets a maximum cookie lifetime. Regulators recommend limits instead: the CNIL, for example, accepts consent-free audience measurement only when its cookies last no more than 13 months and the data is kept for at most 25 months. Give the duration in the cookie table and summarise it here.
Contact details and updates
Give an email address or contact form for cookie questions. Say how often the policy is reviewed and how visitors will learn of changes. If you have a data protection officer, list their contact details here.
Step 4: connect the policy to your cookie banner
A cookie policy on a page nobody visits does not inform anyone. Link it from three places: your cookie banner (where visitors make their choice), your website footer and your privacy policy. The banner text should name the policy directly, with a link such as "Read our cookie policy", reachable in one click.
A common home for the page is /cookie-policy, linked in the footer next to the privacy policy.
Step 5: keep the policy accurate over time
Cookie policies go stale faster than most legal documents. Every time you install a new WordPress plugin, add a Meta Pixel, embed a YouTube video or switch analytics providers, your cookie inventory changes. If the policy does not reflect those changes, it misinforms visitors.
Build a review into your release process. Before any new script goes live, check whether it sets cookies, and if it does, update the policy. Pair this with regular scans to catch cookies that third-party updates introduce without anyone on your team changing anything.
Common mistakes to avoid
Vague purpose descriptions are the most frequent problem. "This cookie improves your experience" tells a visitor nothing. Be specific: "This cookie stores your selected language so the site shows content in that language when you return."
Generic copy-paste policies come second. A policy that lists cookies your site does not set, or misses ones it does, misleads visitors and shows a regulator that nobody checked.
Third is forgetting social media embeds. A Facebook Like button, an X (formerly Twitter) feed or an embedded Instagram post each sets its own cookies, and they belong in your policy even though you did not write the code that creates them.
Questions about writing a cookie policy
Do I need a cookie policy if my site only uses strictly necessary cookies?
Usually yes in practice. No consent is needed for strictly necessary cookies, but regulators expect them to be listed, and the GDPR requires information wherever they process personal data. A short policy covers it.
How often should I update my cookie policy?
Every time you add a new third-party script, plugin or analytics tool. Scan your site at least monthly so the policy matches the cookies your pages actually set.
Can I use a cookie policy generator instead of writing one manually?
Yes, as long as it works from an accurate cookie list. A generator that reads your scan results fills the cookie table for you, but review the output before publishing, because a scan only sees the pages it reaches.
Is there a different cookie policy template for the UK?
The structure is the same. A UK policy refers to PECR and the UK GDPR, and if you rely on the statistics or appearance exceptions in force since 5 February 2026, it must explain how visitors can object.
Where should the cookie policy be accessible on my website?
Link it from your cookie banner, your website footer and your privacy policy, so visitors can find it when they make their choice and at any time afterwards.
Generate a cookie policy from your scan results
Kukie.io's cookie policy generator scans your site, fills the cookie table from what it finds and builds the policy from a short questionnaire about your business. You can publish it on a hosted page or embed it on your own site, and regenerate it when your cookies change.
