Cookie policy template: what to say, section by section

A cookie policy template is a skeleton for one page: every cookie and similar tool your site uses, with the purpose, the lifetime, who sets it and how a visitor can switch it off. The wording is the easy part. The list is the hard part.

Most templates you can download give you the wording and leave the list to you. This post goes the other way. It covers what the UK and EU rules ask you to tell people, how a cookie policy differs from a privacy policy, and a plain skeleton with one sentence under each heading that you fill in from your own site.

What a cookie policy is for

The rule behind it is older than the GDPR. Article 5(3) of the ePrivacy Directive says storing information on someone’s device, or reading what’s already there, is allowed only once the person has agreed, having been provided with clear and comprehensive information, including about the purposes. The UK version is in PECR. Regulation 6, as made in 2003, used the same phrase: clear and comprehensive information about the purposes of the storage or access. Since 5 February 2026 the conditions sit in a new Schedule A1, and the consent condition keeps that wording.

In the Planet49 case in 2019, the Court of Justice said what “comprehensive” covers. The information a site owes a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies. Purpose, lifetime, third parties.

The ICO’s 2026 guidance on storage and access technologies asks for the same three. The information covers the technologies and the purpose of each, any third party that stores or reads information on the device, and the duration for which any information will be stored. It adds that you should avoid vague references to “partners” or “third parties”. A cookie policy is where that information usually lives.

Cookie policy vs privacy policy

Neither PECR nor the GDPR uses the words “cookie policy”. The rules ask for information and leave the format open. The ICO’s guide to PECR says there’s no set format, the information should be easy to find, and a privacy policy on its own won’t do if it’s hard to find or rarely read.

So the two pages do different jobs:

• Privacy policy: the Article 13 list. Who you are, why you process data and on what basis, who receives it, how long you keep it, the person’s rights, how to withdraw consent and how to complain.
• Cookie policy: the device-level detail. Each cookie or tool, what it does, how long it lasts, who sets it and how to turn it off.

They overlap on two items. A company that runs your analytics or your ad tag is a recipient in the privacy policy and a third party in the cookie policy. Keep the two lists consistent. In June 2025 the Italian regulator inspected a car dealer’s website and found, among other things, a privacy policy that lacked detail on the tracking tools the site used. The outcome was a formal warning and an order to fix it, with no fine.

You can put both in one page, and many small sites do. The test is whether a visitor can reach the cookie list from the banner in one tap.

The five things to say about each cookie

Put the sources above together and each cookie or tool gets five entries:

• Name: the cookie’s name as a browser shows it, or the tool’s name for things that aren’t cookies, like local storage or a pixel.
• Purpose: what it does for the visitor, in plain words. “Remembers your basket”, not “enhances your experience”.
• Duration: the session, or a period. The ICO says to check the default the tool sets, consider whether it’s proportionate to the purpose, and see whether you can change it.
• Provider: you, or the named company that sets or reads it. Not “our partners”.
• How to switch it off: the place inside your site where the visitor can change their choice.

Each cookie also belongs to a group, and the group decides whether you ask first.

Which cookies need consent, and which don’t

Since February 2026 the UK has four groups. The ICO’s page on the exceptions sets them out:

• Strictly necessary: essential for the service the visitor asked for, judged from the user’s point of view. A basket cookie and a logged-in session are the ICO’s examples. Its words on advertising: There are no advertising purposes that meet the strictly necessary exception.
• Statistics: aggregate counts of how the service is used, with a view to improving it. Page visit totals, scroll depth and device types qualify. Tracking individuals or anything to do with advertising doesn’t.
• Appearance: remembering a language or a layout preference. Personalising content based on inferred interests doesn’t count.
• Everything else: consent first.

The statistics and appearance groups still need clear information about the purpose and a simple means of objecting, free of charge. The ICO suggests a default-on toggle the visitor can turn off, and says you can’t rely on browser settings alone as a sign that someone doesn’t object.

In the EU, the Directive exempts only two things: technical storage for carrying a communication, and what is strictly necessary for a service the user explicitly requested. Statistics cookies need consent there. The EDPB’s cookie banner taskforce also noted a pattern of sites labelling as “essential” things that serve purposes which would not be considered strictly necessary, and discussed the site owner’s job of keeping a list of its cookies and showing a regulator which ones are essential.

A cookie policy template you can fill in

Here’s the skeleton: seven headings, one sentence under each. Replace the brackets with your own facts. If you skipped straight to this part, “table” means the five columns from two sections up.

1. What this page covers

“This page lists the cookies and similar tools [site name] uses, what each does, how long it stays on your device and how to change your choice.”

2. Who we are

“[Legal name], [address]. Questions about this page go to [email address].” Use the same details as your privacy policy, and link to it here.

3. Tools we use without asking

“These are needed for the site to work: [table]. You can’t switch them off on this page, but you can clear them in your browser.” Keep this table short. If it’s long, something in it probably belongs further down.

4. Tools we use with your consent

“We set these only after you choose Accept on the banner: [table].” Analytics, embedded video, chat widgets, maps and ad tags usually go here. In the EU, this is also where statistics cookies sit.

5. Site statistics and appearance

UK sites only. “These count visits in aggregate or remember your settings. You can object here: [link to the toggle].” Say what each one collects and that nothing in it is used for advertising.

6. How to change your mind

“Open [name of the link or icon] at the bottom of any page and switch any group off. Your choice applies from then on.” The ICO says the law asks you to let people withdraw consent at any time, as easily as they gave it, and to treat a withdrawal as a request to delete what was gathered under it. The EDPB taskforce’s suggestion is a small, always visible icon or a link in a standard place.

7. Last updated

“[Date]. We review this list when we add or remove a tool.” Then do.

Check your own list on your phone

No tool needed. A private window on your phone shows what a first-time visitor sees.

1. Open your site in a private window and leave the banner alone. Does the banner link to the cookie list?
2. Tap that link. Does it open a list, or a wall of text with no names in it?
3. Count the tools you know you use: analytics, a chat widget, embedded video, a map, an ad tag, fonts loaded from another company. Then count the lines on the page. Anything in the first count and not the second goes on the list.
4. Pick one line and read it as a stranger. Does it name the provider, the purpose and a duration? “Partners” and “various” are gaps.
5. Find the way back. From any page, can you reach your cookie settings again in one tap, without clearing the browser?
6. Open your privacy policy. Every company named on the cookie page should be in its recipients section too.

In May 2024 the Romanian regulator fined a property company after a complaint: its website set cookies that weren’t technically necessary before consent and didn’t show who ran the site. The fine was 10,000 lei, with an order to correct the privacy policy and the cookie setup.

For the groups and what each kind of cookie does, start with types of website cookies. To see what your pages actually set, check website cookies walks through the browser method. For the banner itself, see cookie banner examples, and for the other document, privacy policy example.

Peeky reads the public pages of your site. For the companies your pages contact and whether your policy names them, the checks are EU-04 and UK-06 in the Handbook, and EU-08 for the items a privacy notice has to carry.

Questions people ask

What is a cookie policy?

It's the page that lists the cookies and similar tools a website uses, with the purpose of each, how long it lasts, who sets it and how a visitor can switch it off. The rule behind it is Article 5(3) of the ePrivacy Directive, which asks for clear and comprehensive information before anything is stored on a device. The UK copy of that rule is in PECR.

Do you need a separate cookie policy?

The rules don't name a document. They ask for the information and leave the format open. The ICO says a privacy policy alone isn't enough if it's hard to find or rarely read. A section inside your privacy policy works if the banner links straight to it.

What should a cookie policy include?

For each cookie or tool: its name, what it does, how long it lasts, who sets it and where to turn it off. The Court of Justice said in Planet49 that the information owed to a user includes the duration of the cookies and whether third parties may access them. The ICO's 2026 guidance lists the same three things and says to avoid vague words like 'partners'.

How can I create a free cookie policy?

Open your own site in a private window, write down every cookie and tool it sets, then use the seven headings in this post. A generator can give you the wording, but it can't see which tools your plugins added. The list has to come from your pages.

Is a cookie policy the same as a privacy policy?

No, though they overlap. The privacy policy carries the Article 13 list: who you are, your purposes, the legal basis, who receives the data, how long you keep it and the person's rights. The cookie policy is the device-level detail. A company named in one should appear in the other.