Cookie Confirm
en

Cookie policy template

What a cookie policy must contain under EU and UK rules, the most common mistakes, and a template you can copy and complete for your own website.

Last checked on 13 October 2026

In short

  • If your website uses cookies or similar technologies, you must explain them clearly.
  • For each cookie, name its purpose, who sets it and how long it lasts.
  • Explain how visitors can change or withdraw their choice.
  • Keep it up to date: every new tool can add new cookies.

What is a cookie policy?

A cookie policy, also called a cookie notice or cookie declaration, is the page on your website that explains which cookies and similar technologies you use. In the cookie banner you ask for consent; in the cookie policy you give the full explanation.

The obligation comes from article 5(3) of the ePrivacy Directive in the EU and regulation 6 of PECR in the UK: before you store or read information on a visitor's device, you must give clear and comprehensive information about it. That also applies to cookies that don't need consent. If the cookies process personal data, the GDPR (or UK GDPR) transparency rules apply as well.

What must be in it?

  • Which technologies you use: cookies, but also pixels, local storage and similar techniques.
  • The purpose of each one, grouped by category: strictly necessary, preferences, analytics and marketing.
  • Who sets them: your own site or a third party such as Google or Meta. The ICO asks you to name the third parties clearly and specifically.
  • How long they last. The EU Court of Justice ruled in Planet49 (2019) that the information must include the duration of cookies and whether third parties can access them.
  • Which cookies need consent and which don't.
  • How visitors change or withdraw their choice, for example via a link at the bottom of every page.
  • A link to your privacy notice if personal data is processed, including any transfers outside Europe.
  • Contact details for questions.

Extra for the UK

Since 5 February 2026, PECR allows some analytics and functionality cookies without consent. That exception only applies if you give visitors clear information and a simple and free way to object. If you rely on it, your cookie policy should say so and explain how to object. More in UK cookie law.

Common mistakes

  • An outdated list. Every new plugin, pixel or embedded video can add cookies. If they are not in your policy, your information is incomplete.
  • A copied text that doesn't fit. A policy from another website lists other cookies than yours.
  • No durations or vague purposes, such as "to improve your experience", without saying what the cookie does.
  • No way to change the choice. Visitors must be able to withdraw consent as easily as they gave it.
  • Hidden in the terms and conditions. Put the cookie policy on its own page that is easy to find.

The template

Below is a template you can copy. Fill in everything between [brackets] for your own website, and check with a cookie scanner which cookies your site really sets. Not sure whether the text fits your situation? Have it reviewed by a lawyer.

Rather not maintain it yourself? Cookie Confirm generates your cookie policy automatically from what its scanner finds on your website, and updates it when cookies change.

Sources

Cookie policy template

Cookie policy of [Company name]

Last updated: [date]

What are cookies?
Cookies are small text files that a website stores on your computer, tablet or phone. [Company name] uses cookies and similar technologies, such as pixels and local storage, on [website address]. This policy explains which ones we use, why, and how you can change your choice.

Strictly necessary cookies
These cookies are needed for the website to work, for example to keep your shopping cart, keep you logged in or remember your cookie choice. We do not ask for consent for these cookies.

Preference cookies
These cookies remember choices you make, such as your language. [Choose: We only use them when you make such a choice. / We only use them with your consent. / For visitors in the UK: you can object to them at any time via [link].]

Analytics cookies
These cookies help us understand how visitors use the website, so we can improve it. [Choose: We only use them with your consent. / We have set them up to collect aggregate statistics only, and you can object at any time via [link].]

Marketing cookies
These cookies let us and our partners show you ads that match your interests, also on other websites, and measure how well our ads work. We only use them if you consent.

Overview of the cookies
[For each cookie: name, provider, purpose, duration. For example:
_ga – Google – analytics – 2 years
_fbp – Meta – advertising – 3 months]

Third parties
Some cookies are set by other companies, such as [Google, Meta]. They may receive information about your visit. [If applicable: Some of these companies are located outside the European Economic Area or the UK. We explain how we protect your data in that case in our privacy notice.]

Changing or withdrawing your choice
You can change your choice at any time via [the "Cookie settings" link at the bottom of every page]. Withdrawing consent is as easy as giving it. You can also delete cookies in your browser settings.

Personal data
Some cookies process personal data, such as an online identifier or your IP address. How we handle personal data and what your rights are is explained in our privacy notice: [link to privacy notice].

Contact
Questions about this cookie policy? Contact [Company name], [address], [email address].

Rather not fill it in yourself?Cookie Confirm writes your cookie declaration from what the scanner finds on your site, and keeps it up to date when cookies change.

Frequently asked questions

What is the difference between a cookie policy and a privacy notice?

A cookie policy is only about the cookies and similar technologies on your website. A privacy notice covers all the personal data you process, also outside the website, for example of customers and job applicants. You may combine them, but many websites keep them separate and link to each other.

Is a cookie policy mandatory?

The law requires you to give visitors clear and comprehensive information about the cookies you use, also the ones that need no consent. It doesn't prescribe a separate page, but a cookie policy is the usual and clearest way to do it.

Where should I put the cookie policy?

On its own page, linked from your cookie banner and from the footer of every page, so visitors can always find it.

How often should I update the cookie policy?

Whenever cookies are added or removed, for example when you install a new plugin or marketing tag. A cookie scanner shows you the changes. Cookie Confirm scans your site every month and updates your cookie policy automatically.

This guide is general information, not legal advice. We check it regularly, but laws and guidance change. Not sure about your situation? Ask a lawyer.

Keep reading

More guides

All guides →

Enjoy the first 7 days completely free

Create a free account and see if Cookie Confirm is the right fit for you. Live in 5 minutes.

  • No credit card required
  • €7.95 per month after
  • Plug & play installation
Start my free trial

4.9/5 5,000+ websites