GDPR Cookies Policy: Requirements and How to Write One

If your website uses cookies and receives visitors from the European Union, you need a GDPR cookies policy that explains what you set, why, and for how long. A GDPR cookie policy is not just a legal formality: it is one of the documents regulators check first when they investigate a website, and it must match what your site actually does. This guide explains exactly what the policy must contain, which cookies need consent, and how to keep the document accurate over time. It is educational information rather than legal advice, so consult a qualified attorney for guidance specific to your situation.

What Is a GDPR Cookies Policy?

A GDPR cookies policy is a public document that discloses every cookie and similar tracking technology your website uses, the purpose of each one, its duration, and who receives the data it collects. It exists to satisfy two overlapping laws: the General Data Protection Regulation (GDPR) and the ePrivacy Directive (Directive 2002/58/EC).

The two laws divide the work between them:

• The ePrivacy Directive, Article 5(3) requires you to inform users and obtain consent before storing or accessing information on their device, which covers cookies, localStorage, and tracking pixels.
• The GDPR, Articles 12 and 13 require transparent, easily accessible information about any processing of personal data, which most cookies involve because they handle identifiers like cookie IDs and IP addresses.

Recital 30 of the GDPR explicitly names cookie identifiers as data that can make a person identifiable. That is why cookie data counts as personal data in almost all cases, and why your cookie disclosures fall under the GDPR's transparency rules rather than being a voluntary nicety.

Your cookie policy works together with your consent banner: the banner collects the consent, and the policy provides the detailed information that makes the consent informed. One without the other fails GDPR's standard of "freely given, specific, informed and unambiguous" consent under Article 4(11).

Who Needs a Cookie Policy Under GDPR

GDPR has extraterritorial scope under Article 3. You need a cookie policy GDPR regulators would accept if any of the following applies:

• Your organization is established in the EU or European Economic Area (EEA).
• You offer goods or services to people in the EU, even for free.
• You monitor the behavior of people in the EU, which is exactly what analytics and advertising cookies do.

That last point catches most websites. A SaaS company in Texas running Google Analytics on a site with EU traffic is monitoring the behavior of EU residents and falls within scope. The same applies to a Shopify store in Australia using the Meta Pixel, or a blog in Canada running AdSense.

The UK applies materially identical rules through UK GDPR and the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner's Office (ICO). If you comply with EU requirements, you are most of the way to UK compliance as well.

There is no small business exemption for cookie transparency. GDPR's limited derogations for organizations under 250 employees (Article 30(5)) concern record-keeping, not the duty to inform users about cookies.

Cookie Categories and Which Ones Require Consent

Not all cookies are treated equally under GDPR and the ePrivacy Directive. Your GDPR cookie policy should sort every cookie into one of four standard categories, because the consent rules differ.

Strictly Necessary Cookies

These are exempt from consent under Article 5(3) of the ePrivacy Directive because they are essential to deliver the service the user requested. Examples include:

• Session cookies that keep a user logged in
• Shopping cart cookies on an e-commerce store
• Load-balancing cookies
• Security cookies such as CSRF tokens
• Consent-state cookies that remember the user's cookie choices

You must still disclose these in your policy. Exempt from consent does not mean exempt from transparency.

Preference Cookies

These remember choices like language, region, or display settings. They improve the experience but are not strictly necessary, so they require opt-in consent for EU visitors.

Analytics Cookies

Cookies from tools like Google Analytics, Hotjar, or Mixpanel measure how visitors use your site. EU regulators, including CNIL in France and the Datenschutzkonferenz in Germany, treat these as consent-required. A small number of member states tolerate consent-free audience measurement only under strict conditions, such as CNIL's exemption for privacy-configured, first-party-only analytics. Unless you have verified you meet those conditions, require consent.

Marketing and Advertising Cookies

Cookies used for ad targeting, retargeting, and cross-site tracking always require prior consent. This includes the Meta Pixel, Google Ads remarketing tags, LinkedIn Insight Tag, and any cookies set by embedded content such as YouTube videos. These cookies also typically transfer data to third parties, which triggers additional disclosure duties under GDPR Article 13(1)(e) and, for transfers outside the EEA, Chapter V.

What a GDPR Cookie Policy Must Include

Regulators and courts have made the required content of a cookie policy GDPR-compliant sites publish reasonably clear. The European Data Protection Board's Guidelines 05/2020 on consent and the CJEU's Planet49 judgment (Case C-673/17, 2019) both stress specific, per-cookie information. Your policy needs:

1. What cookies are, in one or two plain-language sentences, for readers who do not know.
2. A complete list of cookies, grouped by category, with each cookie's name, provider, purpose, and expiry period.
3. The legal basis for each category: legitimate delivery of the requested service for strictly necessary cookies, consent under GDPR Article 6(1)(a) for everything else.
4. Third parties that receive data, named individually. "Trusted partners" is not a disclosure.
5. International transfers, if cookie data flows outside the EEA, including the safeguard relied on, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
6. How users can withdraw consent, which Article 7(3) requires to be as easy as giving it. Link to your banner's preference center.
7. How users can manage cookies in their browser, with brief instructions or links for major browsers.
8. The policy's last updated date and how you announce changes.
9. Your identity and contact details as the data controller, per Article 13(1)(a).

The Planet49 ruling is worth internalizing: the CJEU held that users must be told the duration of cookies and whether third parties have access to them. A policy that lists "we use analytics cookies" without naming the cookies, their lifespans, and their recipients does not meet the standard.

If you want a starting point that already follows this structure, a cookie policy generator can produce the document from a scan of your actual site, and a privacy policy generator can produce the companion document that covers your broader data processing.

How Consent Rules Shape Your Cookie Policy

Your GDPR cookies policy and your consent mechanism must tell the same story. The policy documents the practices; the banner enforces them. EU regulators have issued detailed guidance on what valid cookie consent looks like, and several requirements directly affect the policy text.

Consent must come first. Non-essential cookies cannot fire until the user opts in. Your policy should state this, and your site must actually behave this way. Regulators run technical checks: CNIL's 2020-2022 enforcement sweep fined dozens of companies whose sites set trackers before consent.

Rejecting must be as easy as accepting. CNIL fined Google 150 million EUR and Facebook 60 million EUR in January 2022 because rejecting cookies took more clicks than accepting them. Your policy should explain that users can refuse non-essential cookies without detriment.

No pre-ticked boxes and no cookie walls. Planet49 invalidated pre-ticked consent boxes, and the EDPB's Guidelines 05/2020 state that making site access conditional on accepting tracking generally invalidates consent.

Consent must be recorded. Article 7(1) puts the burden of demonstrating consent on you. Your policy should mention that you keep consent records, and your consent tooling needs to actually store them.

For implementation details on the banner side, see the guide to GDPR cookie consent requirements.

Writing the Policy: A Practical Process

You can produce a compliant GDPR cookie policy in an afternoon if you work in the right order.

1. Audit your cookies. Open your site in a fresh incognito session and inspect the cookies set before and after interacting with the page. Browser DevTools shows first-party cookies; a scanning tool catches third-party cookies, pixels, and localStorage entries that manual inspection misses. Test key pages, not just the homepage, because checkout and embedded-media pages often set different cookies.
2. Identify the source and purpose of each cookie. Map every cookie to the tool that sets it. Vendor documentation usually lists cookie names, purposes, and lifespans.
3. Categorize. Assign each cookie to strictly necessary, preferences, analytics, or marketing. When in doubt, do not classify a cookie as strictly necessary; regulators interpret that exemption narrowly.
4. Draft the policy. Use the nine-element checklist from the previous section. A table per category with columns for name, provider, purpose, and expiry is the clearest format.
5. Wire it to your banner. Link the policy from the consent banner and make the categories in the policy match the toggles in the banner exactly.
6. Publish it accessibly. Link the cookie policy in your site footer on every page, per Article 12(1)'s requirement that information be easily accessible.

The audit step is where most policies go wrong. Marketing teams add pixels, developers add error-tracking tools, and the policy quietly drifts out of sync with reality. This is the problem automated compliance platforms exist to solve: TermsBox, for example, scans your site on a schedule, detects new cookies and trackers, and flags when your published cookie policy no longer matches what your site sets.

Keeping Your GDPR Cookies Policy Accurate Over Time

A cookie policy is a living document because your cookie footprint changes every time you add a tool. Third-party scripts also change their own behavior: an embedded widget that set two cookies last year may set five today, including some from ad networks you have never heard of.

Build maintenance into your routine:

• Rescan after every new integration. Adding a chat widget, A/B testing tool, video embed, or ad pixel almost always changes your cookie list.
• Schedule periodic reviews. Quarterly rescans are a reasonable baseline; monthly is better for sites that ship frequently.
• Update the policy date and, where changes are significant, resurface the consent banner. If you start using a new category of cookies, existing consents do not cover it, and you need fresh consent under Article 6(1)(a).
• Keep versions. If a regulator asks what your policy said in March, you want an answer. Keep dated copies or use a hosting solution that versions the document.

Outdated cookie policies are low-hanging fruit for complaints. Privacy advocacy group noyb has filed hundreds of complaints against websites over cookie practices since 2021, and the gap between a site's disclosures and its actual cookies is easy for anyone to verify with free browser tools.

Common GDPR Cookie Policy Mistakes

These are the failures that appear repeatedly in enforcement decisions and complaint campaigns:

• Generic templates that list no actual cookies. A policy that says "we may use cookies for various purposes" fails Articles 12 and 13. Specificity is the entire point.
• Misclassifying analytics or marketing cookies as strictly necessary to avoid asking for consent. Regulators check, and the exemption covers only what is technically essential to the requested service.
• Firing cookies before consent while the policy claims otherwise. The policy then documents a violation rather than preventing one.
• Ignoring non-cookie tracking. Article 5(3) covers any storage or access on the device, so localStorage, sessionStorage, fingerprinting scripts, and tracking pixels belong in the policy too.
• No withdrawal path. If users cannot change their mind as easily as they consented, the consent is invalid under Article 7(3). Include a persistent link or button that reopens cookie settings.
• Forgetting embedded content. YouTube embeds, social share buttons, and map widgets set third-party cookies. Either disclose them and gate them behind consent, or use privacy-enhanced embed modes.

The financial stakes are real. Beyond the headline CNIL fines against Google and Facebook, the Spanish AEPD, Italian Garante, and Belgian APD have all fined smaller businesses for cookie failures, and ePrivacy penalties apply in addition to GDPR's Article 83 maximums of 20 million EUR or 4% of global annual turnover.

Frequently Asked Questions

Is a cookie policy required under GDPR?

Yes, in practice. GDPR Articles 12 and 13 require transparent information about data processing, and the ePrivacy Directive Article 5(3) requires informing users before setting non-essential cookies. A cookie policy is the standard way to meet both obligations.

Can my cookie policy be part of my privacy policy?

Yes, you can include cookie information as a section of your privacy policy, and many small websites do. However, a separate cookie policy is easier to maintain, easier to link from your consent banner, and clearer for users when you use more than a handful of cookies.

Do I need consent for all cookies under GDPR?

No. Strictly necessary cookies, such as session, security, and load-balancing cookies, are exempt from consent under ePrivacy Directive Article 5(3). All other cookies, including analytics, preference, and marketing cookies, require prior opt-in consent from EU visitors.

How often should I update my GDPR cookie policy?

Review it whenever you add or remove tools that set cookies, such as analytics, chat widgets, or ad pixels, and at least every six months. Regulators like CNIL expect cookie disclosures to match what your site actually sets, so outdated policies create real compliance risk.

What are the penalties for cookie violations under GDPR?

GDPR fines reach up to 20 million EUR or 4% of global annual turnover under Article 83. Cookie-specific fines under national ePrivacy laws vary by member state; CNIL has fined Google 150 million EUR and Facebook 60 million EUR for cookie consent failures.

Does GDPR cookie law apply to businesses outside the EU?

Yes. GDPR Article 3 applies to any organization offering goods or services to people in the EU or monitoring their behavior, regardless of where the business is based. If EU visitors use your site and you set tracking cookies, the rules apply to you.