# How to write a cookie policy (with a structure you can copy)

> A cookie policy says which cookies you use, why, for how long, who else gets the data and how to change the choice. What to include, section by section.

Source: https://cookiequiet.com/guides/how-to-write-a-cookie-policy
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Inventory the cookies and trackers** Run an audit or a scan of the site and list every cookie, storage entry, script and embed with its provider and duration.
2. **Assign a purpose and a category to each item** Write one plain sentence per item describing what it does for the visitor or for you, and sort it into necessary, functional, analytics or marketing.
3. **Fill in the table** Name, provider, purpose, category, duration, and the country of processing for each third party.
4. **Describe the choice mechanism** Explain the banner buttons, how refusal works, how to reopen the preferences and withdraw, and how long the choice is remembered.
5. **Add the legal sections** Controller identity, recipients and transfers, rights, the supervisory authority, the contact, and the date of the version.
6. **Link it and keep it current** Link the policy from the banner and the footer, publish it in each banner language, and update the table after every scan or tool change.

A cookie policy is the page that explains, in plain words, what your website stores on the visitor's device, why, for how long, who else receives the data, and how the visitor can accept, refuse or change their mind. It needs a table of the actual cookies, a description of each purpose, the names of the third parties, and a way back to the preferences. It is not the same document as the privacy policy, although the two link to each other, and it is only as good as the inventory it is written from.

## What the law requires you to say

Article 5(3) of the ePrivacy Directive allows storage on the device only after the user "has been provided with clear and comprehensive information" about the purposes. The GDPR's article 13 adds the identity of the controller, the legal basis, the recipients, the retention period, the rights and the right to withdraw consent. The Court of Justice ruled in Planet49 (1 October 2019) that the information must include the duration of the cookies and whether third parties may have access to them.

National guidance makes this concrete. The CNIL's recommendation asks that visitors be told the purposes and the identity of all parties using trackers subject to consent, and that an up-to-date list of those parties be permanently available at an easily accessible place on the site. The ICO's guidance says to name the third parties on the first layer of the banner or make their identities accessible through a clearly signposted second layer, and to keep consent requests specific to each purpose. Your cookie policy is where the complete version of that information lives; the banner carries the summary and the link.

## The structure

### 1. Who we are and what this page covers

One paragraph: the company name and contact, the websites the policy applies to, the date of the last update. Say that the page covers cookies and similar technologies (local storage, pixels, SDKs), because the rules do.

### 2. What cookies and trackers are

Two or three sentences a non-technical reader can follow. First-party versus third-party, session versus persistent. Keep it short; nobody comes to this page for a tutorial.

### 3. The categories you use

Describe each category and what it is used for on your site:

- **Necessary**: what the site cannot work without (session, cart, security, the consent choice). No consent is asked for these, and the policy should say why each one is necessary.
- **Functional**: preferences and embedded content that the visitor can switch on.
- **Analytics**: audience measurement, heatmaps, A/B tests, naming the tool.
- **Marketing**: advertising and social media pixels, naming each provider.

### 4. The cookie table

This is the heart of the page. One row per cookie or storage entry:

| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| `cq_consent` | This website | Stores your cookie choices | Necessary | 6 months |
| `_ga`, `_ga_*` | Google Analytics 4 (Google LLC) | Distinguishes visitors for statistics | Analytics | 2 years |
| `_fbp` | Meta Pixel (Meta Platforms Ireland) | Measures and targets advertising | Marketing | 3 months |

Add a column for where the data goes if a provider is outside the EEA, or cover transfers in a separate section. Build the table from an audit, not from memory: the [cookie audit checklist](/guides/cookie-audit-checklist) explains how to capture the real list.

### 5. How to accept, refuse and change your choice

Say that the banner offers Accept all and Reject all, that refusing keeps only necessary cookies, and how to reopen the preferences later: a link in the footer, an icon, or a sentence like "Open cookie settings" that triggers the preferences centre. Say that withdrawing consent is as easy as giving it and what happens to data collected before the withdrawal.

### 6. How long we remember your choice

State the period for which the choice is stored before the banner is shown again. The CNIL considers six months a good practice for both consent and refusal; the ICO suggests the same six months before asking again someone who declined.

### 7. Third parties and transfers

List the providers that receive data, the country where they process it, and the safeguard used for transfers outside the EEA (an adequacy decision, standard contractual clauses). Link to each provider's privacy policy.

### 8. Your rights and how to contact us

Access, rectification, erasure, objection, the right to complain to the supervisory authority, and the contact for requests. Link to the privacy policy for the full version.

### 9. Changes

The date of the version, and a sentence saying the table is updated after each scan or change of tools.

## Writing tips

- Write for the visitor, not for the regulator. Short sentences, concrete purposes ("counts visits and pages viewed" rather than "optimises your experience").
- Do not call something necessary because it is useful to you. The CNIL fined Condé Nast €750,000 in November 2025 in part for presenting cookies as strictly necessary without useful information about their purposes.
- Publish the policy in each language your banner uses. A French visitor who reads a French banner should land on a French policy.
- Keep the policy in sync with the site. A table that lists a tool you removed, or misses one you added, is a finding in an audit.

## Generating one from a scan

Writing the table by hand is the slow part. Cookiequiet generates a cookie policy, a privacy policy and terms of use from a questionnaire prefilled by its scan, with the cookie table and the processors list filled in from what the scan found, in English and French, hosted at a stable URL or copied as Markdown and HTML. The [cookie policy generator](/cookie-policy-generator) explains the questionnaire. The output is a template written for the GDPR, the UK GDPR, the ePrivacy rules, the CCPA/CPRA, the LGPD and the Swiss FADP; it is a starting point you should read and adapt, not legal advice, and every generated page says so.

## Questions

### What is the difference between a cookie policy and a privacy policy?

The privacy policy covers all personal data processing: accounts, orders, newsletters, support, and cookies in summary. The cookie policy goes into detail on what is stored on the device and how to control it. Small sites sometimes merge them into one page with a cookies section; both approaches are fine if the content is complete.

### Do I need to list every single cookie?

You need to give clear and comprehensive information, including duration and third-party access. The usual way to meet that is a table with every cookie or at least every provider with its cookies grouped. Leaving out a provider that sets cookies is the mistake to avoid.

### How often should the policy be updated?

Every time the site's tools change, and after each scan that finds something new. Put the date of the version on the page so visitors and auditors can see it.

### Can I copy a template from another site?

A template gives the structure, which is what this guide provides. The table and the purposes must describe your own site, and a policy that names tools you do not use, or misses ones you do, is worse than a shorter accurate one.

## Sources

- [Directive 2002/58/EC (ePrivacy Directive), article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [Regulation (EU) 2016/679 (GDPR), article 13](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [CJEU, press release on Planet49 (C-673/17), 1 October 2019](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf)
- [CNIL, Recommandation « cookies et autres traceurs » (PDF)](https://www.cnil.fr/sites/cnil/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf)
- [ICO, Guidance on the use of storage and access technologies: how do we manage consent in practice?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/)