How to write a cookie policy: structure and examples

A cookie policy is a page that tells visitors which cookies and similar technologies your site uses, what each one does, who sets it, how long it lasts and how to change their consent. To write one, audit your site’s cookies, group them by purpose, document each in a table, explain visitors’ choices in plain language, and update it whenever your tags change.

Why do you need a cookie policy?

Because privacy laws require you to inform people before you store or read information on their devices. A cookie policy is the most practical place to give that information in full, and your consent banner links to it.

Several rules point in the same direction:

• ePrivacy Directive, Article 5(3): consent to cookies must be based on clear and comprehensive information, in particular about their purposes.
• GDPR: when cookies process personal data, its transparency obligations apply, including telling people who you are, why you process their data, who receives it and how long you keep it. Consent is only valid if it is informed.
• CCPA/CPRA: businesses must give notice of the personal information they collect and explain how consumers can opt out of its sale or sharing, which often covers advertising cookies.

A policy does not replace consent. In the EU and UK, it informs the choice your banner collects.

What should a cookie policy include?

It should cover who you are, what you set and why, who receives the data, how long it is kept, and how visitors can change their choices:

• Who you are: the organization responsible and how to contact it.
• What cookies and similar technologies are: include localStorage, pixels and SDKs if you use them.
• Categories and purposes: strictly necessary, preferences, analytics and marketing, or whichever categories your banner uses.
• A per-cookie list: name, provider, category, purpose, duration, and whether it is first- or third-party.
• Third parties: the vendors that receive data, links to their privacy information, and any transfers outside the EEA or UK.
• Legal basis: consent for non-essential cookies, and the exemption for strictly necessary ones.
• How to change or withdraw consent: a link that reopens your consent settings.
• Browser controls: a short note that browsers also let users block or delete cookies.
• US opt-out rights, if relevant: your “Do Not Sell or Share My Personal Information” link and how you honor Global Privacy Control.
• A last-updated date.

If you are unsure where a cookie belongs, see types of cookies and what counts as a strictly necessary cookie.

What is a good outline for a cookie policy?

Adapt this ten-section structure to your site. Each item is a section heading followed by a sample sentence.

1. Introduction. “This policy explains how Example Ltd uses cookies and similar technologies on example.com, and how you can control them.”
2. What are cookies? “Cookies are small text files stored on your device when you visit a website. We also use similar technologies, such as local storage and pixels, and this policy covers them too.”
3. How we use cookies. One short paragraph per category, for example: “Analytics cookies help us understand how many people visit, which pages they use and where they came from. We only set them if you agree.”
4. Cookies we use. The cookie table described in the next section.
5. Third parties. “Some cookies are set by partners such as our analytics and advertising providers. They may use the data as described in their own privacy policies, linked below.”
6. Your choices. “You can accept or reject non-essential cookies in our banner and change your mind at any time using ‘Cookie settings’ in the footer.”
7. Browser settings. “Most browsers let you block or delete cookies. Blocking strictly necessary cookies may stop parts of the site from working.”
8. Your US privacy rights (if applicable). “To opt out of the sale or sharing of your personal information, use the ‘Do Not Sell or Share My Personal Information’ link. We also treat Global Privacy Control signals as a valid opt-out request.”
9. Changes to this policy. “We update this policy when our use of cookies changes. Last updated: [date].”
10. Contact. “Questions about this policy? Contact privacy@example.com.”

What does a good cookie table look like?

A good table lets a visitor find any cookie and understand it in a single row. Use the same category names as your banner, and describe each purpose concretely.

Name	Provider	Category	Purpose	Duration	Type
session_id	example.com	Strictly necessary	Keeps you signed in	Session	First-party
cart	example.com	Strictly necessary	Remembers items in your cart	7 days	First-party
consent_state	example.com	Strictly necessary	Stores your cookie choices	12 months	First-party
lang	example.com	Preferences	Remembers your language	12 months	First-party
_ga	Google Analytics	Analytics	Distinguishes visitors for usage statistics	2 years (default)	First-party, set by Google’s script
ad_uid	Example Ads Network	Marketing	Measures ad conversions and builds interest profiles	90 days	Third-party

These rows are illustrative. Your real names and durations come from your own scan, and vendor cookie durations can vary with configuration.

How do you write a cookie policy in plain language?

Write for a visitor, not a regulator. Short sentences and concrete purposes are easier to read and do more for transparency than legal boilerplate.

• Replace vague phrases like “to improve your experience” with what actually happens, such as “to count visits and see which pages are popular.”
• Open with a short summary for people who will not read the whole page.
• Do not claim you “never share data” if marketing pixels send identifiers to ad platforms.
• Make tables readable on mobile, for example with horizontal scrolling or stacked cards.

How do you keep a cookie policy up to date?

Treat the policy as a living document tied to your tag inventory. Cookies change every time someone adds a tool, edits a tag manager container or embeds new content.

Schedule regular scans, plus one whenever you add a feature or vendor. Our guide on how to run a cookie audit walks through the process. When a new purpose appears, update both the banner and the policy, and ask for consent again where the change affects what visitors agreed to.

Be wary of generic templates and generators. A policy that lists cookies you do not use, or misses ones you do, misinforms visitors and weakens the consent you rely on.

Bottom line

A strong cookie policy is specific, accurate and current: built from a real audit, organized by purpose, with a clear table and an easy route to change consent. Keep it in step with your banner and your tags. Tools like Cookiesh can automate cookie scanning so the inventory behind your policy stays current.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.