Cookie policy generator
with the table filled in.
Most cookie policies describe categories and never name a cookie. This one builds the table: every cookie, who sets it, what it does and how long it lives, grouped by category, with the consent and withdrawal wording that DPDP, GDPR and ePrivacy actually ask for.
Three documents people confuse
A cookie policy is not a privacy policy, and neither is a consent notice. They overlap, they are often merged badly, and regulators treat them as answering different questions.
| Document | Answers | When it is shown |
|---|---|---|
| Privacy policy | Everything you do with personal data, across every channel | Linked permanently, usually from the footer |
| Cookie policy | Exactly which cookies and similar technologies this site sets, who sets them, what each does and how long it lives | Linked from the banner and the footer |
| Consent notice | The specific purposes you are asking permission for, right now, in plain language | At or before the moment of collection |
Why the table is the whole document
Most cookie policies describe categories in the abstract and never name a cookie. That is the part regulators single out, because a visitor cannot make an informed choice about "analytics cookies" in general: only about the specific cookies actually being set.
The ePrivacy Directive requires clear and comprehensive information before storage or access. The GDPR requires consent to be specific and informed. The DPDP Act requires an itemised notice per purpose. All three point at the same artefact: a table with the cookie name, who sets it, what it is for, and how long it persists. Anything less is a description of a policy rather than the policy itself.
You cannot write that table from memory. Sites accumulate trackers through tag managers, embedded video, chat widgets and marketing pixels that nobody remembers adding. Run the free cookie scan first and copy the real list across.
The categories, and what actually belongs in each
- Strictly necessary. The site genuinely cannot be delivered without them: session, authentication, load balancing, CSRF tokens, and the cookie that records the consent choice itself. This is the only category that may be set before consent, and the bar is necessity to deliver the service the user asked for, not necessity to your business model
- Functional. Remembered preferences such as language, region or interface choices. Useful, not essential, and therefore consented
- Analytics. Aggregate usage measurement. Widely, and wrongly, classified as necessary. Under ePrivacy, first-party analytics still require consent in most member states
- Advertising. Profile building and cross-site targeting. The category regulators examine most closely, and the one most often found firing before consent
- Social media. Embedded content from networks that set their own cookies and process for their own purposes. Embedding a video is enough to trigger this
Prior blocking is the part most sites get wrong
A banner that appears while the trackers have already loaded is not a consent mechanism, it is a notification. Consent must be obtained before a non-essential cookie is written or read, which means the tags have to be gated by the consent state rather than merely accompanied by a banner.
This is the single most common finding in a cookie audit and it is invisible from the front end: the banner looks correct, and the network tab tells a different story. It is also why this generator asks whether you actually block, and writes the honest wording if you do not. A cookie policy that claims prior blocking while analytics fires on load is a documented admission rather than a defence.
Keeping it accurate
A cookie policy decays faster than any other compliance document, because the tracking surface changes whenever marketing adds a tag. Two practices keep it true: re-scan on a schedule, and ask for consent again when the set of cookies changes materially rather than relying on a choice someone made about a different set.
Consent also has a shelf life. There is no single statutory interval, but six to twelve months is the common supervisory expectation in the EU, and re-asking is the defensible default. Whatever you choose, record which version of the notice each choice was given against: that record, not the banner, is what proves consent. The consent manager keeps that ledger.
The things people ask us
Do I need a cookie policy if I already have a privacy policy?
In most cases yes. A privacy policy covers personal data generally; a cookie policy answers the specific question of which technologies this site stores on a visitor's device, who sets them, and for how long. ePrivacy requires that information before storage or access, at a level of detail a general privacy policy does not usually carry.
Do analytics cookies need consent?
In the EU and UK, generally yes, including first-party analytics. The strictly-necessary exemption covers what is required to deliver the service the user requested, and measuring usage is not that. A small number of supervisory authorities take a softer line on anonymous, first-party measurement, but consent is the defensible default.
What counts as strictly necessary?
Cookies without which the service the user asked for cannot be delivered: session and authentication, load balancing, security tokens, and the cookie recording the consent choice itself. Necessity is judged against the user's request, not your business needs, which is why advertising and analytics never qualify, however commercially essential they are.
How long should a consent choice last before I ask again?
No statute fixes an interval. Six to twelve months is the common expectation among EU supervisory authorities, and re-asking on any material change to the cookie set is the stronger position. What matters more than the interval is being able to show which version of the notice a given choice was given against.
Does a cookie banner alone make me compliant?
No, and this is the most frequent finding in a cookie audit. Consent must be obtained before non-essential cookies are set, so the tags have to be gated by consent state. A banner displayed while trackers are already loading is a notification, not a consent mechanism.
How do I find every cookie my site sets?
Scan it. Sites accumulate trackers through tag managers, embedded video, chat widgets and marketing pixels that no one remembers adding, and a list written from memory is always incomplete. Our free cookie scanner loads the page twice, with and without consent, and reports what fired in each pass.
Stop generating documents. Start evidencing controls.
These tools write a document from what you tell them. The platform writes one from what your systems are actually doing, and keeps the proof behind it.