The ePrivacy Directive (implemented nationally as the "cookie law") requires that users be given "clear and comprehensive information" about the storage of cookies on their device — before that storage occurs. GDPR's transparency principle (Article 5(1)(a)) adds the requirement that this information be provided "in a concise, transparent, intelligible and easily accessible form." Together, these two instruments set the bar your cookie policy must clear.
Privacy Policy vs Cookie Policy: The Key Difference
Your privacy policy covers the full scope of your data processing: what personal data you collect, why, the lawful basis for each activity, who you share it with, how long you keep it, and what rights individuals have. It applies to data collected through any channel — contact forms, email, purchases, and cookies.
Your cookie policy focuses specifically on cookies and tracking technologies placed on users' devices via your website. It must explain what cookies are, which ones you use, what each one does, how long each one lasts, and how users can control or delete them.
You can combine both into a single document — many sites do. But you cannot replace one with the other, and you cannot satisfy cookie transparency requirements with a paragraph that says "we use cookies to improve your experience."
What GDPR and the ePrivacy Directive Require in a Cookie Policy
The combination of GDPR Articles 13–14 (transparency) and Article 5(3) of the ePrivacy Directive creates a specific set of requirements:
Identity of the data controller — Who is setting cookies? Name, legal entity, and contact details. For third-party cookies (e.g., Google, Meta, HubSpot), you must identify the third party as a separate data controller or processor.
Cookie-by-cookie disclosure — Each cookie must be listed individually (not just by category) with:
- Cookie name (exactly as it appears in the browser)
- Who sets it (first-party or which third party)
- Purpose (what the cookie is used for)
- Category (strictly necessary / functional / analytics / marketing)
- Duration (session cookie or persistent; if persistent, the exact expiry period)
Legal basis for non-essential cookies — For any cookie requiring consent, the policy must state that the legal basis is consent (Article 6(1)(a) GDPR) and that consent was given via the cookie banner.
Opt-out instructions — How can a user withdraw consent? This should reference: (1) the cookie settings panel on your site, (2) browser-level cookie management, and (3) any opt-out links provided by third-party vendors (e.g., Google's ads settings, Meta's off-Facebook activity).
Last updated date — So regulators and users can assess whether the list is current.
How to Build a Cookie Inventory
Before you can write an accurate cookie policy, you need to know what cookies your site actually sets. Many sites have more cookies than their developers realise, because third-party scripts — analytics, chat widgets, social media buttons, ad pixels — set their own cookies independently.
Step 1: Use browser DevTools. Open Chrome or Firefox, navigate to your site, and open DevTools (F12). Go to Application > Cookies (Chrome) or Storage > Cookies (Firefox). This shows every cookie set on the domain during your current session.
Step 2: Use an automated scanner. DevTools shows cookies during a single session. Automated scanners crawl your site across multiple pages and interactions:
- CookieMetrix — free, simple report
- OneTrust Cookie Scanner — free tier available, detailed categorisation
- Cookiebot — free scan, generates a draft cookie policy
Step 3: Check post-interaction cookies. Some cookies only appear after a user submits a form, plays a video, or clicks a button. Test these flows manually and record any additional cookies set.
Step 4: Verify third-party documentation. For each third-party cookie, check the vendor's documentation for the exact purpose and retention period. Google's cookie documentation, Meta's cookie list, and HubSpot's cookie reference are all publicly available and should be your source for third-party cookie descriptions.
Cookie Policy Template Structure
A compliant cookie policy should follow this structure:
1. What Are Cookies?
A plain-language explanation of what a cookie is, the difference between session and persistent cookies, and first-party vs third-party cookies. Keep this section brief — one paragraph.
2. What Cookies We Use
The core of the policy: a table listing every cookie. See the sample format below.
3. How to Control Cookies
Instructions for: using your cookie consent panel to change preferences, managing cookies in major browsers (Chrome, Firefox, Safari, Edge — link to their support pages), and vendor-specific opt-out links for any third-party cookies listed.
4. Contact
Who to contact for questions about your cookie use. Include email address or link to contact form.
Sample Cookie Table Format
| Cookie Name | Set by | Purpose | Category | Duration | Opt-out |
|---|---|---|---|---|---|
_ga | Google LLC | Distinguishes users for Google Analytics | Analytics | 2 years | Google Ads Settings |
_ga_XXXXXXXX | Google LLC | Maintains session state for GA4 | Analytics | 2 years | Google Ads Settings |
_fbp | Meta Platforms Inc | Identifies browsers for Facebook Pixel | Marketing | 90 days | Meta Ad Preferences |
hubspotutk | HubSpot Inc | Identifies visitors for HubSpot CRM | Marketing | 180 days | HubSpot Cookie Policy |
PHPSESSID | Your site | Maintains logged-in session | Strictly necessary | Session | N/A — required |
cookie_consent | Your site | Stores cookie consent preferences | Strictly necessary | 12 months | N/A — required |
Use this exact column structure. Each row must be a real cookie you have confirmed is set on your site — do not copy cookie names from templates without verifying they actually appear on your domain.
Common Mistakes That Create Compliance Risk
Listing categories without cookie names. "We use analytics cookies" is not a cookie policy — it is a sentence. Regulators expect a named inventory.
Out-of-date cookie lists. Marketing tools update their tracking scripts regularly, often adding new cookies without publicising the change. An inventory that was accurate in January may be incomplete by July.
Missing third-party controllers. If Meta Pixel sets _fbp on your site, Meta Platforms Inc must appear in your cookie policy as a separate data controller. Omitting third-party controller identities is a transparency violation.
No renewal date. A cookie policy with no "last updated" date gives regulators no way to assess whether it reflects current practice. Always date-stamp it.
Describing cookies in technical jargon. The EDPB requires cookie information to be "intelligible." Describing _ga as "a client identifier for Universal Analytics using Measurement Protocol v2" is not intelligible to a typical visitor. Use plain language.
How Often to Update
Update your cookie policy immediately when any of the following occurs:
- You add a new third-party script (analytics, chat, advertising, support)
- You remove a tool that was previously listed
- A vendor updates their cookie structure (check vendor release notes)
- You change your consent management platform
Regardless of changes, conduct a full cookie audit at least every six months. Calendar a recurring audit — the two minutes it takes to run a scanner is far less costly than a regulatory investigation triggered by an inaccurate cookie policy.
Build your consent banner and cookie preference centre using our Cookie Consent Generator, which generates the consent logic and pairs with a cookie policy template pre-populated with the most common third-party cookies.