Generate a GDPR-compliant
cookie policy in seconds

What a GDPR cookie policy must contain

A cookie policy is a separate document from the general privacy policy. Under GDPR Article 13(1), it must list the controller's identity and contact, the purpose of each cookie, the legal basis for processing, retention periods, the recipients of the data (Google, Meta, Microsoft Clarity and so on), any transfers to third countries, and a clear summary of the data subject's rights: access, rectification, erasure, objection, and portability.

The ICO's 2023 review of UK media websites found that the majority were still running generic cookie statements ("we use cookies to improve your experience") or stale lists ("we use Google Analytics" while the site actually loaded Hotjar, Microsoft Clarity and three retargeting pixels). The CNIL has been even more aggressive: its 2022 enforcement against Google and Meta turned on cookie disclosure mechanics that did not match what the sites were actually loading.

The Consentio generator automatically wires the scanner's output into the policy template. For every detected cookie, the document includes name, provider, purpose, lifetime and category. Language describing legal basis and data subject rights is drawn directly from EDPB Guidelines 05/2020 on consent: so you don't have to guess which phrasing a UK or EU regulator will accept.

Cross-border data transfer gets particular attention. If the site uses anything from Google (Analytics, Ads, Maps) or Meta (Pixel, Conversions API), the generator includes wording on data transfers to the US under the Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework, which the European Commission adopted in July 2023. This is the Article 13(1)(f) GDPR requirement and is the most common reason policies have failed audits since the Schrems II decision.