Cookie Policy Generator

What a cookie policy has to contain

A cookie policy is the page your banner links to. Regulators expect it to be specific rather than generic: for each cookie you set, a visitor should be able to see its name, who sets it, what it does, how long it lasts, and which category it falls into. A page that says "we use cookies to improve your experience" and stops there does not meet the transparency requirements of GDPR Articles 13 and 14.

This generator produces a structured policy with a real cookie table rather than prose. You enter the cookies your site actually sets, grouped by category, and the tool renders a formatted table plus the surrounding sections regulators look for: what cookies are, the legal basis you rely on for each category, how to withdraw consent, how to control cookies at the browser level, and how to contact you about it.

Find out what you actually set first

The single most common failure is a policy that describes cookies the site does not use, or omits ones it does. Before generating, open your browser's developer tools, go to the Application or Storage panel, clear all cookies for your domain, then load your site and accept everything. What appears is your real cookie inventory. Third-party embeds are the usual surprise: an embedded video, a map, a chat widget or a font provider can each set cookies you never chose.

Legal basis per category

Strictly necessary cookies do not require consent, because they are exempt under the ePrivacy Directive's Article 5(3) carve-out for cookies strictly necessary to deliver a service the user requested. Everything else, including analytics, does require prior consent in the EU and UK. The generated policy states the basis per category rather than applying one blanket claim, which is what makes it defensible.

Keep it current

A cookie policy is a living document. Every new marketing tag, embed or A/B testing tool changes the inventory. The generated page includes a visible last-updated date, and it is worth re-auditing whenever you add a third-party script. An out-of-date policy is worse than a thin one, because it demonstrates you had a process and stopped following it.