How to write a cookie policy (with a structure you can copy)

A cookie policy is the page that explains, in plain words, what your website stores on the visitor's device, why, for how long, who else receives the data, and how the visitor can accept, refuse or change their mind. It needs a table of the actual cookies, a description of each purpose, the names of the third parties, and a way back to the preferences. It is not the same document as the privacy policy, although the two link to each other, and it is only as good as the inventory it is written from.

What the law requires you to say

Article 5(3) of the ePrivacy Directive allows storage on the device only after the user "has been provided with clear and comprehensive information" about the purposes. The GDPR's article 13 adds the identity of the controller, the legal basis, the recipients, the retention period, the rights and the right to withdraw consent. The Court of Justice ruled in Planet49 (1 October 2019) that the information must include the duration of the cookies and whether third parties may have access to them.

National guidance makes this concrete. The CNIL's recommendation asks that visitors be told the purposes and the identity of all parties using trackers subject to consent, and that an up-to-date list of those parties be permanently available at an easily accessible place on the site. The ICO's guidance says to name the third parties on the first layer of the banner or make their identities accessible through a clearly signposted second layer, and to keep consent requests specific to each purpose. Your cookie policy is where the complete version of that information lives; the banner carries the summary and the link.

The structure

1. Who we are and what this page covers

One paragraph: the company name and contact, the websites the policy applies to, the date of the last update. Say that the page covers cookies and similar technologies (local storage, pixels, SDKs), because the rules do.

2. What cookies and trackers are

Two or three sentences a non-technical reader can follow. First-party versus third-party, session versus persistent. Keep it short; nobody comes to this page for a tutorial.

3. The categories you use

Describe each category and what it is used for on your site:

• Necessary: what the site cannot work without (session, cart, security, the consent choice). No consent is asked for these, and the policy should say why each one is necessary.
• Functional: preferences and embedded content that the visitor can switch on.
• Analytics: audience measurement, heatmaps, A/B tests, naming the tool.
• Marketing: advertising and social media pixels, naming each provider.

4. The cookie table

This is the heart of the page. One row per cookie or storage entry:

Add a column for where the data goes if a provider is outside the EEA, or cover transfers in a separate section. Build the table from an audit, not from memory: the cookie audit checklist explains how to capture the real list.

5. How to accept, refuse and change your choice

Say that the banner offers Accept all and Reject all, that refusing keeps only necessary cookies, and how to reopen the preferences later: a link in the footer, an icon, or a sentence like "Open cookie settings" that triggers the preferences centre. Say that withdrawing consent is as easy as giving it and what happens to data collected before the withdrawal.

6. How long we remember your choice

State the period for which the choice is stored before the banner is shown again. The CNIL considers six months a good practice for both consent and refusal; the ICO suggests the same six months before asking again someone who declined.

7. Third parties and transfers

List the providers that receive data, the country where they process it, and the safeguard used for transfers outside the EEA (an adequacy decision, standard contractual clauses). Link to each provider's privacy policy.

8. Your rights and how to contact us

Access, rectification, erasure, objection, the right to complain to the supervisory authority, and the contact for requests. Link to the privacy policy for the full version.

9. Changes

The date of the version, and a sentence saying the table is updated after each scan or change of tools.

Writing tips

• Write for the visitor, not for the regulator. Short sentences, concrete purposes ("counts visits and pages viewed" rather than "optimises your experience").
• Do not call something necessary because it is useful to you. The CNIL fined Condé Nast €750,000 in November 2025 in part for presenting cookies as strictly necessary without useful information about their purposes.
• Publish the policy in each language your banner uses. A French visitor who reads a French banner should land on a French policy.
• Keep the policy in sync with the site. A table that lists a tool you removed, or misses one you added, is a finding in an audit.

Generating one from a scan

Writing the table by hand is the slow part. Cookiequiet generates a cookie policy, a privacy policy and terms of use from a questionnaire prefilled by its scan, with the cookie table and the processors list filled in from what the scan found, in English and French, hosted at a stable URL or copied as Markdown and HTML. The cookie policy generator explains the questionnaire. The output is a template written for the GDPR, the UK GDPR, the ePrivacy rules, the CCPA/CPRA, the LGPD and the Swiss FADP; it is a starting point you should read and adapt, not legal advice, and every generated page says so.