Cookie Policy
A cookie policy with a real table - each cookie named, with its purpose and how long it lasts.
100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.
Template, not legal advice. This is a template, not legal advice. It describes the cookies you tell it about, so check the list against what your site actually sets - open developer tools, look at Application then Cookies, and compare. A policy that omits a tracker you are running is worse than no policy, and in the UK and EU it is the omission regulators act on.
Start from an example
Fills every answer with a worked example you can edit. Pick the one closest to your business.
Other documents you can generate
Most sites need more than one. A privacy policy without terms, or terms without a refund policy, leaves the obvious gap.
About this tool
A cookie policy is needed as soon as your site runs anything beyond the strictly necessary: analytics, advertising pixels, embedded videos, maps or a chat widget. The part regulators actually read is the table - each cookie named, who sets it, what it does and how long it lasts. A vague "we use cookies to improve your experience" is the sentence that gets quoted back in enforcement notices. This generator builds the policy, and the table, from your answers, grouping cookies into necessary, preferences, analytics and marketing so it matches the categories your consent banner offers. Your answers stay in your browser.
How to use this tool
- List the tools on your siteEnter your site details and tick the analytics, advertising, video and chat tools you use.
- Check the categoriesMake sure each cookie falls under necessary, preferences, analytics or marketing - the same groups your banner will use.
- Publish with your bannerDownload the policy and link it from your cookie banner and footer.
Cookie policy versus cookie banner
A cookie policy is the document that explains which cookies and similar technologies your site uses, what each one does, how long it lasts and who sets it. The banner is the tool that asks for consent. Under the UK PECR and the EU ePrivacy rules, non-essential cookies such as analytics and advertising generally need consent before they are set, and the policy is where people find the detail behind that choice.
The useful policy is a table, not an essay: cookie name, provider, purpose, duration, and whether it is strictly necessary. Listing first-party and third-party cookies separately makes it clear which ones come from services like Google Analytics or Meta.
Key features
- Groups cookies into strictly necessary, preferences, analytics and marketing.
- Explains how visitors change their choice later and how to clear cookies in their browser.
- Names third-party providers such as analytics and advertising platforms where you use them.
- Pairs with the consent banner generator so the banner and policy describe the same categories.
Common uses
- Adding Google Analytics or a Meta pixel to a site with UK or EU visitors.
- Running ads that use remarketing cookies.
- Embedding YouTube videos, maps or chat widgets that set their own cookies.
- Answering a client or auditor who asks which cookies your site sets.
Tips for better results
- Check the cookies your site really sets in developer tools under Application, then Cookies - not the ones you think it sets.
- Pair the policy with a consent banner so visitors can actually refuse the categories described.
- Review the table whenever you add or remove a tracking tool.
Mistakes to avoid
- Listing the cookies you think you set rather than the ones you do - most sites find a tracker nobody remembers adding.
- Publishing a policy with no way for visitors to change their choice later.
- Using only a vague sentence instead of a table of named cookies and lifetimes.
Frequently asked questions
If you have visitors in the UK or EU, analytics cookies are usually treated as non-essential, so you need consent and a clear explanation of what they do. A short policy covering just those cookies is fine.
Open your site in a private window, then check the browser developer tools under Application (Chrome) or Storage (Firefox) before and after accepting the banner. Note each cookie's name, domain and expiry.
It can be a section of the privacy policy or its own page. A separate page is easier to keep current, because cookies change more often than the rest of the policy.
No. It assembles a draft from standard clauses, and every page says so above the preview. Cookie enforcement in the EU and UK is driven by complaints, and complaints are made by people who compared the policy to what their browser actually received.
Broadly, any site running analytics, advertising, embedded video, or a chat widget. The best time to do it is as soon as you add the first script that is not strictly necessary.
Listing the cookies you think you set rather than the ones you do. Open developer tools, look at Application then Cookies, and compare - most sites find at least one tracker nobody remembers adding.
Most people need Cookie Consent Banner and Privacy Policy as well. They cover the gaps this one does not.