Cookie Policy Template (GDPR & CCPA Compliant) – Free Copy & Guide

A cookie policy template is a structured legal document that explains what cookies a website uses, how those cookies function, what data those cookies collect, why that data is collected, how long cookies remain active, and how users can control or withdraw consent.

If your website uses cookies or other similar tracking technologies to collect and store any information about users, it is important for you to include a cookie policy on your website. As per laws like the General Data Protection Regulation (GDPR) in the EU, California Consumer Protection Act (CCPA) in the US, websites are required to inform users about their use of cookies and this can be achieved through a cookie policy.

A cookie policy template is a structured format you can use to write a cookie policy for your website. A cookie policy explains what cookies your website uses, why those cookies are used, and how users can manage cookie preferences.

A cookie policy template is useful because it ensures your cookie disclosures follow a consistent structure. However, a cookie policy template still needs to be customised based on your website’s actual cookies and tracking technologies.

A cookie policy template must contain clear and structured disclosures about how your website uses cookies and similar tracking technologies. The purpose of a cookie policy is transparency. Users should be able to understand what data is collected, why it is collected, and how long tracking persists.

A cookie policy should be written in plain language. Legal terminology should be avoided unless it is clearly explained. Each section should describe one concept at a time.

Below is a breakdown of the essential elements of a compliant cookie policy.

The cookie policy template below follows this structure.

A cookie policy template is a starting point. However, cookie policies often become inaccurate because cookies change frequently.

A cookie policy can become outdated when you:

• Add or remove analytics tools
• Install marketing tags
• Embed videos
• Add chat widgets
• Add payment tools
• Run A/B tests

This is why a cookie audit is recommended before publishing a cookie policy. A cookie audit identifies:

• Cookie names
• Providers
• Purposes
• Categories
• Expiry durations

A practical way to reduce these risks is to run periodic cookie audits. Many CMPs, including CookieYes, support scheduled cookie scanning so cookie lists can be reviewed and updated more consistently.

A cookie policy is only accurate when it reflects the cookies actually running on your website.

Before writing or publishing a cookie policy, follow these steps.

The first step is not writing.

The first step is discovery.

You need to identify:

• Which cookies are active
• Whether they are first-party or third-party
• What purpose they serve
• How long they remain active

Cookies are often set by:

• Analytics tools (e.g., Google Analytics)
• Advertising platforms (e.g., Meta Pixel)
• Embedded content (e.g., YouTube, Vimeo)
• Chat widgets
• Payment providers
• A/B testing tools

Even small websites can load multiple third-party cookies automatically.

A cookie audit ensures your cookie policy reflects reality, not assumptions.

Many consent management platforms (CMPs), including CookieYes, include a built-in cookie scanner that detects cookies automatically. Here's how to get started .

The scan result typically includes:

• Cookie name
• Duration
• Description
• Category

This forms the foundation of your cookie policy.

Once cookies are identified, they should be categorised into standard groups.

Common cookie categories include:

• Necessary (strictly necessary cookies)
• Functional
• Analytics
• Advertisement (marketing cookies)

Categorisation matters because consent requirements depend on cookie type. Under the GDPR, non-essential cookies require prior consent.

A structured cookie list also makes your policy easier to understand.

In the CookieYes example above, detected cookies are automatically grouped into categories after scanning.

This ensures the cookie categories in your policy match the categories shown in your cookie banner.

After listing cookies, your policy should explain:

• Why cookies are used
• What data may be collected
• Whether third-party providers are involved

This explanation should be clear and specific.

For example:

Instead of writing:

“Cookies improve user experience.”

Write:

“We use analytics cookies to measure website traffic and understand which pages are most visited.”

CookieYes includes editable sections such as:

• About cookies
• Use of cookies

These sections are pre-filled with structured content, but can be customised to reflect your implementation.

The key requirement is clarity.

A compliant cookie policy should include a cookie declaration table.

Each row should stand alone and clearly describe:

• Cookie name
• Provider
• Purpose
• Category
• Expiry duration

Example structure:

The cookie list must reflect your latest audit.

The CookieYes generator builds this table automatically based on scan data.

Without scanning, this table must be updated manually whenever scripts change.

Under the GDPR, consent must be as easy to withdraw as it is to give.

Your cookie policy should include:

• Instructions for changing preferences
• A link to reopen the cookie banner
• Browser-level cookie management guidance
  

This aligns your cookie policy with your consent mechanism.

After auditing, categorising, and documenting your cookies, publish the policy on a dedicated page.

Link it from:

• Your website footer
• Your cookie banner
• Your cookie preference centre

Because cookies can change over time, periodic audits are recommended.

Cookie scanners can automate this process by re-scanning and updating the cookie list when changes are detected.

A website cookie policy template should be accessible from every page of your website. Users should not need to create an account or navigate multiple steps to find it.

The most common placement is in the website footer. The footer typically includes links to:

• Privacy policy
• Terms of use
• Legal notice

Cookie policy

The cookie policy should also be linked from your cookie banner or cookie preference centre. Linking the cookie policy from the banner allows users to review full cookie disclosures before providing consent.

If your website operates in the EU or UK, ensuring easy access to the cookie policy supports GDPR transparency obligations.

On the mobile app, you should display your cookies policy in the menu, under the ‘About’ or ‘Legal’ sections. You can also link your website’s cookie policy on your cookie banner so users can be easily directed to the cookie policy page.

The GDPR is a European privacy law that regulates personal data processing.

The GDPR treats cookies and online identifiers as personal data when they can identify individuals directly or indirectly.

• Recital 30 notes that online identifiers such as cookies may be used to create profiles.
• Recital 26 states that information capable of identifying individuals directly or indirectly qualifies as personal data.
• Articles 13 and 14 require transparent disclosures about personal data processing in clear language.

Because cookies can qualify as personal data, websites must disclose cookie usage and explain how users can exercise their choices.

A cookie policy template does not replace a consent mechanism.

Under GDPR and the ePrivacy Directive:

• Consent must be obtained before placing non-essential cookies.
• Consent must be freely given, specific, informed, and unambiguous.
• Users must be able to withdraw consent as easily as they gave it.

This is why many websites use a GDPR cookie consent banner and a cookie preference centre.

A GDPR cookie policy should clearly explain:

• Which cookie categories your website uses
• Why each cookie category is used
• Which third-party providers place cookies
• How long cookies remain active (expiry duration)
• How users can withdraw consent

Many CMPs, including CookieYes, help websites maintain these disclosures by generating cookie tables from cookie scan results and keeping categories aligned between the banner and cookie policy.

The CCPA defines personal information as data that identifies, relates to, describes, or can be linked to a consumer or household.

Personal information includes:

• IP address
• Cookies
• Beacons
• Pixel tags
• Mobile advertising identifiers

The CCPA does not generally require opt-in consent for cookies. Instead, it focuses on notice and consumer rights, including the right to opt out of the sale of personal information where applicable.

The California Privacy Rights Act (CPRA) expanded CCPA requirements. CPRA introduced the concept of “sharing” personal information for cross-context behavioural advertising.

If your business sells or shares personal information, you may need to provide a “Do Not Sell or Share My Personal Information ” link and honour opt-out requests.

A CCPA-aligned cookie policy should:

• Disclose cookie usage and tracking technologies
• Explain what categories of information may be collected
• Explain how users can exercise their opt-out rights
• Link to any required “Do Not Sell or Share” mechanism

A cookie policy explains cookies and tracking technologies.

A privacy policy explains all personal data processing activities.

If your website uses cookies, you should:

• Disclose cookie usage in your privacy policy
• Maintain a standalone cookie policy for clarity

A standalone cookie policy is particularly useful for websites with users across multiple jurisdictions.

A cookie policy, a cookie banner (cookie notice), and a privacy policy are related but distinct documents.

Each serves a different compliance function.

A cookie policy supports transparency.
A cookie banner supports consent and user control.
A privacy policy provides broader personal data processing disclosures.

Many cookie policies fail because the disclosures are incomplete or outdated.

Common cookie policy mistakes include:

• Copying a cookie policy template without auditing your website
• Failing to disclose third-party cookies from embedded tools
• Listing cookie purposes in vague terms
• Missing expiry information
• Publishing a cookie policy without linking it from the cookie banner
• Not updating the cookie list after adding new scripts

A practical way to reduce these risks is to schedule periodic cookie audits. Many CMPs, including CookieYes, support scheduled cookie scanning.

In the US, the Federal Trade Commission (FTC) Act requires that businesses have a privacy policy. Websites are required to inform users on how they collect, use, share, and protect their personal information. Cookies fall under the scope of privacy disclosures and should be included in the privacy policy.

Let’s take a look at how websites implement cookie policies. McKinsey avoids legalese and describes their use of cookies and the explanation of what cookies are in the first section.

Accenture details the categories of cookies they use and how and why they are used in this section.

Meanwhile, Mailchimp uses a tabular format to describe the different categories of cookies being used, and for what.

ViacomCBS details the different types of tracking technologies they use including cookies.

Vox Media details the choices users have regarding cookies and how users can manage or opt-out of the use of cookies.