Introduction
A cookie policy is the dedicated document that explains how your website uses cookies and similar technologies—local storage, pixels, SDK identifiers, and sometimes iframe storage. It supports the transparency required by GDPR and ePrivacy and gives users detail beyond what fits in a banner.
Effective cookie policies combine narrative sections with a cookie table listing name, provider, purpose, type, duration, and category. The table should reflect cookies observed on a first visit and after consent, not a static list copied from a competitor.
Marketing teams change tags frequently; cookie policies drift out of date faster than privacy policies. Treat the cookie list as operational documentation maintained alongside your tag manager container.
What it means
Introductory sections explain what cookies are, how you use categories (necessary, analytics, marketing, preferences), and how users can change choices via your banner or settings link.
The cookie table is the centerpiece. Each row should identify the cookie or storage key, whether it is first or third party, the vendor, purpose in plain language, expiry, and legal category. Include Google _ga, Meta _fbp, Hotjar, HubSpot, and ad network IDs you actually set.
Similar technologies deserve mention: localStorage keys used for analytics, HTML5 storage, fingerprinting scripts, and embedded widgets that set their own cookies when users play videos or interact with maps.
Consent section describes when cookies are placed—only after opt-in for non-essential—and links to your banner. Withdrawal instructions must mirror GDPR's easy-as-giving requirement.
Third-party sections clarify that ad and analytics partners may update cookies over time and how you audit them—monthly scans, CMP auto-scan, or vendor privacy policies linked per row.
Updates: show last revised date and summarize changes when marketers add TikTok Pixel or switch from UA to GA4. Users and regulators notice stale tables listing tools you removed.
Why it matters
CNIL and ICO cookie guidance explicitly reference incomplete cookie lists as transparency failures. Scanners compare live cookies to published policies; mismatches appear in audit reports shared with leadership.
Accurate cookie policies support valid consent. Users cannot make informed choices if marketing cookies are omitted from the policy but enabled in the preference center.
Vendor due diligence requests often ask for cookie policy URLs. Enterprise customers expect tables to include subprocessors and retention, not blanket statements.
Common mistakes
- Listing only a handful of cookies while dozens appear in browser devtools.
- Marking advertising cookies as necessary to simplify the banner.
- No expiry or vague session without clarifying session length.
- Cookie policy hosted as PDF with no version date.
- Separating cookie policy from banner categories with different names.
- Ignoring pre-consent cookies set before Accept—policy should not claim prior consent.
- Not updating after GTM publishes new tags on Friday afternoon.
Practical checklist
- Run a fresh-session cookie audit and export names and domains.
- Map each cookie to a banner category and lawful basis.
- Build a table with provider links to vendor privacy docs.
- Describe how to reopen consent settings and withdraw.
- Link cookie policy from banner and site footer.
- Align policy categories with CMP toggle labels.
- Schedule monthly rescans after marketing releases.
- Version the policy with visible last updated date.
How GDPRChecker helps
GDPRChecker scans detect cookies and tracking requests on your public homepage, helping you compare live behavior against what your cookie policy claims before external auditors do.
Consent category labels configured in the dashboard should match your policy sections—analytics, marketing, necessary—so users see consistent language from banner to table.
Compliance reports highlight cookie blocking and consent UI status together, making it easier to spot when policy promises blocking but tags still leak pre-consent.