Guide
Explaining your cookies: a policy page and the banner words that go with it
Cookies are small files that a website stores in a visitor’s browser, and local storage and tracking pixels do a similar job. Laws in several regions require sites to tell visitors what they use and, for non-essential kinds, to ask first. A cookie policy is the page that does the telling; it is longer and more detailed than the banner that appears on arrival. This tool writes the page and the banner words from your answers.
The five categories
You switch on only the categories your site actually uses. Strictly necessary cookies keep the site working and secure and remember the visitor’s cookie choice. Preference cookies remember settings such as language or display mode. Analytics cookies count visits and show which pages are used, with a provider name such as Google Analytics. Advertising cookies show and measure ads and limit how often an ad appears, with partner names such as Google AdSense. Embedded media and social media cookies come from videos or social posts you embed, with the platform names.
Each category becomes a row in a table with four columns: the category, what it is for, examples and how long the cookies last. Necessary cookies are described as impossible to switch off, and the others as set only with agreement where that is required.
The consent rules choice
Three options change the managing-your-choices section. Opt-in first, used in the EU, EEA and UK, says that apart from strictly necessary cookies you set cookies only after the visitor agrees. Notice and opt-out, which suits most US states, says that cookies are set after notice and that visitors can opt out through the settings link. Opt-in everywhere applies the strictest rule worldwide, which is the simplest choice if you cannot tell where visitors are. All three tell visitors how to withdraw consent from the footer link and how to block or delete cookies in their browser.
A worked example
The first sample is an ad-supported blog under EU rules: Maple Notes with Google Analytics and Google AdSense. The result has four rows, namely strictly necessary (session to 12 months), preferences (up to 12 months), analytics (up to 24 months, depending on the provider) and advertising (set by each partner). The sample’s text says cookies other than strictly necessary are set only after agreement. The last block, “Consent banner text”, gives a short line for the banner that links to the full policy. The second sample, a US shop with social embeds, uses the opt-out wording and lists the social platforms in the embedded media row.
Keep the policy honest
The table has to match reality, so scan the site again after adding a plug-in, a chat widget or a new ad partner. Durations in the table are typical values, not promises about every provider, which is why the advertising row points to each partner’s own policy. If you add a consent tool, make sure it really blocks the cookies it says it blocks until the visitor agrees.
Limits
The page is a statement, not a mechanism. It does not set, block or scan cookies, and publishing it does not replace a consent banner where the law requires prior consent. It is a general template rather than legal advice, and rules differ between countries and keep changing, so have it checked against the regions where your visitors live.
Related tools
- Privacy Policy Generator describes the personal data behind the cookies and links back to this page.
- Terms and Conditions Generator holds the usage rules that cookies are not part of.
- Disclaimer Generator is where affiliate and advertising notices can be stated.
- Refund Policy Generator finishes the legal pages of a small shop.
Checked against the current version of the Cookie Policy Generator on .