Cookie Policy Generator

The tool fills in your company name, website, contact email and effective date. It produces five sections: what cookies are, the cookies used, managing cookies, consent and changes. The governing law field in the form isn't used in this text.

The "cookies we use" section names three types: essential cookies, with remembering dark mode as the example, analytics cookies, and advertising cookies set by partners "such as Google", including personalised ads where permitted. The managing section points to browser settings and to Google's ad settings page. The consent section says you ask for consent before non-essential cookies where the law requires it, for example in the EEA and UK.

Edit it to match your site. If you don't run Google ads, remove both Google references. If you run other ad networks or embeds, name them. And make the consent sentence true by actually having a consent tool, because the policy can't collect consent on its own.

1. Open your site in a private window, so no earlier choices are stored.
2. Open the browser's developer tools and find the storage panel (Application in Chrome and Edge, Storage in Firefox). Look at cookies and local storage.
3. Note what is set before you click anything on the consent banner. Anything non-essential appearing at this point is a problem to fix, not just to document.
4. Accept all, browse a few pages including any with videos, maps or chat, and note what appears.
5. For each item, record the name, who sets it (your domain or a third party), its purpose and how long it lasts.

Repeat this whenever you add a plugin, an embed, an ad network or a new analytics setup. The list in the policy goes out of date faster than any other page on most sites.

EU. Under the ePrivacy Directive, storing or reading information on a user's device needs consent, given after clear information. The only exemptions are what is needed to transmit a communication and what is strictly necessary for a service the user asked for. In practice, analytics and advertising cookies need consent before they are set.

UK. PECR also requires consent for non-essential cookies, and they must not be set before consent. The strictly-necessary exemption is narrow, so check whether a preference cookie like the template's dark-mode example really qualifies. The Data (Use and Access) Act 2025 is reported to add exceptions, including one for analytics used only to improve your service, provided users get clear information and an easy way to opt out. Check the ICO's current guidance on whether and from when this applies to you. Advertising cookies still need consent.

The generated policy is a template, not legal advice. If you rely on advertising or serve EU and UK visitors at scale, have a qualified lawyer review your cookie setup.

A version that lists each cookie, which the template doesn't do. Fill the table from your audit and replace everything in [BRACKETS].