How to write a cookie policy: step-by-step guide + template

The cookie banner is the part everyone sees, so it gets most of the attention. The cookie policy — the document the banner links to — is usually thrown together in five minutes by copying someone else's. Yet the policy is the first thing a data protection authority opens during an inspection. The good news: writing a proper one is not hard. In this guide we cover what a cookie policy must contain, how to build one step by step from a template structure, and how to keep it up to date without rewriting it by hand every month.

What a cookie policy is and why you need one

A cookie policy is a publicly accessible page that tells visitors which cookies and similar technologies your website stores, what they are for, how long they stay in the browser, and how consent to them can be withdrawn.

The obligation does not come from a single clause but from a combination of three pieces of legislation:

• GDPR (Articles 12 and 13) — if cookies process personal data (and regulators treat identifiers like _ga or _fbp as personal data), you must inform about the processing transparently.
• National ePrivacy implementations — across the EU, storing cookies requires opt-in consent, with an exception for strictly necessary ones. Consent is only valid when it is informed — and the policy is what provides the information.
• The ePrivacy Directive — the European foundation the national rules are built on.

In practice it boils down to one thing: without a cookie policy there is no valid consent. A cookie banner linking to an empty or missing page collects consents that would not survive an inspection.

Cookie policy vs. privacy policy

Two documents that even experienced site owners mix up:

• Privacy policy covers all processing of personal data — orders, newsletters, invoicing, complaints, CCTV.
• Cookie policy deals exclusively with cookies and similar technologies: localStorage, tracking pixels, third-party SDKs.

You can merge them into one document, but we advise against it. Cookies change far more often than the rest of your processing — every new marketing tool brings its own. A standalone page is easier to keep current, and the cookie banner can link to it directly instead of pointing at page ten of a privacy novel.

What a cookie policy must contain

A checklist of the required elements no final document should be missing:

• Who the controller is — company name, registration number, and contact details.
• What cookies are — two or three sentences in plain language.
• Which cookies the site actually uses — a table with the cookie name, provider, purpose, lifespan, and category. This is the core of the whole document and the part most often missing.
• Cookie categories — necessary, preferences, analytics, marketing — and what each is for.
• Legal basis — strictly necessary cookies run without consent; everything else requires it.
• Third parties and transfers outside the EU — Google, Meta, Hotjar and friends, including information about data transfers to third countries.
• How to withdraw consent — a concrete procedure, ideally a link or button that reopens the cookie banner.
• How to manage cookies in the browser — links to the help pages for Chrome, Firefox, Safari, and Edge.
• Date of the last update — without it, nobody (including you) can tell whether the document still matches reality.

How to write a cookie policy step by step

Step 1: Find out which cookies your site actually uses

The most common mistake is writing the policy from memory, based on what you think runs on the site. Reality tends to differ — a developer added Hotjar once, the reviews plugin brought its own tracking, and the embedded YouTube video sets cookies too. Open the site in an incognito window with DevTools (Application tab, Cookies section), or save yourself the work with an automatic cookie scanner. We cover the full process in Cookie audit: How to find out what cookies you use.

Step 2: Sort the cookies into categories

The standard is four categories: necessary (login, cart, storing the consent itself), preferences (language, currency), analytics (Google Analytics, Matomo), and marketing (Google Ads, Meta Pixel). Important: your cookie banner must use the same categories. If the banner offers three categories and the policy describes four, the consent does not match the documentation.

Step 3: Build the cookie table

For every cookie, list five things: name, provider, purpose, lifespan, and category. An example row: cookie _ga, provider Google Analytics, purpose distinguishing visitors for traffic statistics, lifespan 2 years, category analytics. It sounds tedious — and by hand it is, especially with thirty cookies on the site. That is why Consentio generates this part automatically from scan results.

Step 4: Describe how to withdraw consent

Article 7(3) of the GDPR says withdrawing consent must be as easy as giving it. In practice, the policy needs a sentence like "You can change your cookie settings at any time by clicking the Cookie settings button" — and that button must genuinely exist, typically in the website footer.

Step 5: Connect the policy to the cookie banner

The banner links to the policy, the policy links to the banner settings. The loop closes and visitors can get wherever they need from either side. What the banner itself should look like is covered in Cookie banner: How to set it up correctly under GDPR.

A template structure for your cookie policy

If you are starting from a blank page, this outline covers everything that matters:

1. Who we are — controller identification and contact details
2. What cookies are and why we use them
3. Which cookie categories we distinguish
4. Table of specific cookies (name, provider, purpose, lifespan, category)
5. Who else has access to the cookies (third parties, transfers outside the EU)
6. How to give and withdraw consent
7. How to block or delete cookies in the browser
8. Date of the last update

The most common cookie policy mistakes

1. A document copied from another website. It describes cookies you do not have and says nothing about the ones you do. During an inspection it looks worse than no document at all — it proves you have no overview of your own processing.
2. No table of specific cookies. A generic "we use analytics and marketing cookies" does not meet the transparency requirement. Regulators want to see concrete cookies with lifespans.
3. The policy and the banner do not match. The banner mentions different categories or different tools than the document. Typically after marketing added a new pixel and nobody updated the policy.
4. A dead link from the banner. The site was redesigned, the policy page changed its URL, and the banner link now leads to a 404. Consent collected without accessible information is invalid.
5. The document was written once and untouched for a year. An average website adds or changes cookies several times a year — with every new tool, plugin, or campaign.

How to keep the policy current without manual work

A cookie policy is not a write-once document. It is living documentation of your website — and manual updates are exactly the kind of work that always gets forgotten.

That is why we built the Consentio cookie policy generator, which assembles the document automatically from regular scans of your site: the cookie table, categories, lifespans, and third parties fill themselves in and regenerate on every change. You just place the link in your banner and footer. Together with the scanner and the cookie banner, the whole setup takes a few minutes — the free plan is enough. And if you want to be sure everything else is covered too, walk through our GDPR cookie compliance checklist.