guide · privacy

What Must a Cookie Policy Include?

Updated October 1, 2026 · 6 min read

direct answer

Six fields per cookie: name, provider, purpose, duration, type and legal basis. The policy must also state that no non-essential cookies fire before consent, and that withdrawing consent is as easy as giving it — reject as prominent as accept. Paste your cookie table into the free Privacy Policy & Cookie Analyzer to audit all eight checks at once.

Every cookie policy on the internet omits at least two of the six fields — usually duration and legal basis. Here is the checklist, the pre-consent rule, and the three banner mistakes that draw fines.

The six required fields per cookie

A cookie table is judged column by column. Grouped labels — "analytics cookies", "marketing cookies" — do not satisfy the requirement: every cookie must appear as its own row.

Column	Example row	Why it is required
Name	`_ga`	Without individual names, a visitor cannot find or delete the cookie — and neither can an auditor
Provider	google-analytics.com	Distinguishes first-party cookies from third-party sharing
Purpose	Distinguishes visitors for analytics	Maps the cookie to a lawful basis; "improves experience" is not a purpose
Duration	2 years	Session vs persistent is a disclosure requirement — a cookie that lives 13 months must say so
Type	Performance	Tells the visitor which cookies consent can actually refuse
Legal basis	Consent	Only strictly necessary cookies may run without consent (Art. 6(1)(f) or ePrivacy exemption)

Cookie policy vs privacy policy

The privacy policy covers all personal-data processing: what you collect, why, on what legal basis, who receives it, for how long. The cookie policy is the subset covering cookies and similar technologies — local storage, pixels, device fingerprinting — and it carries the one rule the privacy policy does not: each cookie must be named individually with its six fields. Both can live in one document; what matters is that the cookie table exists, is linked from every page, and is kept current when your tag manager changes.

The pre-consent rule (ePrivacy Article 5(3))

Article 5(3) of the ePrivacy Directive is the rule that outnumbers all others in enforcement actions: no cookie that is not strictly necessary may be stored or accessed before the visitor consents. Session cookies keeping a shopping cart alive and a load balancer session are exempt. Analytics, advertising, embedded YouTube players and heatmaps are not.

The practical consequence is a sequencing problem: if Google Tag Manager fires your analytics pixels the moment the page loads, and the consent banner appears 800 ms later, you have already set cookies before consent — whatever your policy says. Consent must be upstream of the tag, not downstream of it.

Accept and Reject must be equal

Consent under GDPR must be freely given, specific and unambiguous. Three banner mistakes account for most enforcement:

Reject buried. A bright "Accept all" button and a grey "Manage preferences" link two screens deep fails reject parity. Reject must be one click, as prominent as accept.
Pre-ticked boxes. Opt-in defaults are not consent — the visitor must actively select what they allow.
No withdrawal path. Consent that cannot be revoked as easily as it was given was never valid. A permanent, visible "Cookie settings" link in the footer is the standard fix.

audit your cookie table

Paste your cookie policy and the checker verifies all six columns, the pre-consent rule and consent withdrawal in one pass — scored, severity-ranked, with suggested wording for each gap. Local analysis, zero upload.

Open the analyzer

What to do if you have no cookie policy

Inventory first. Open your site in a fresh browser with dev tools open, list every cookie set on load — before any interaction. That list is your starting table.
Fill the six columns. Name, provider, purpose, duration, type, legal basis. If you cannot say the purpose, the cookie probably should not exist.
Move consent upstream. Block non-essential tags until the banner records a choice, then publish the table linked from every page.

Frequently Asked Questions

The four questions that decide whether a cookie table passes.

What must be in a cookie policy?

For every cookie: its name, the provider or domain that sets it, its purpose, its duration (session or an expiry date), its type (strictly necessary, performance, functional or targeting) and the legal basis it runs on. The policy must also state that no non-essential cookies are set before consent, and that consent can be withdrawn as easily as it was given.

Do I need a separate cookie policy?

Not legally separate — the cookie disclosures can live inside your privacy policy. But the cookie table must exist somewhere linked from every page, and it must list cookies individually. A single sentence saying "we use cookies to improve your experience" does not satisfy the requirement anywhere in the EU or UK.

Can cookies run before the visitor accepts?

Only strictly necessary cookies may. Under Article 5(3) of the ePrivacy Directive, any cookie that is not strictly necessary — analytics, advertising, embedded media — requires consent before it is set. Firing analytics on first paint and asking for consent afterwards is itself a violation, regardless of what the policy says.

What is reject parity?

Reject must be as prominent as accept. A banner with a bright "Accept all" button and a grey, buried "Manage preferences" link fails the GDPR standard for freely given consent — and it is one of the three mistakes regulators cite most often in cookie-banner enforcement.