Cookie policy generator (draft template)

Cookie policy generator

Pick the kinds of cookies and tools your site uses. Get a cookie policy draft with a cookie table you can edit, in Markdown.

Not legal advice. This builds a template draft for a lawyer to review. It can’t make you compliant with any law.

Your business

Company legal name

Product name (optional)

Website

Contact email

Effective date

Postal address (optional)

Cookies you use

Kinds of cookies

Strictly necessaryPreferencesAnalyticsMarketing

Cookie table

Suggested rows use the names and durations Google and Cloudflare publish (blank where they don’t state one). Replace <container-id> with your GA4 ID and check your site’s real cookies in your browser’s developer tools.

Consent

How you ask for consent (optional)

Not legal advice

This is a template draft, not legal advice. We don’t know your business or the laws that apply to it, and a template can’t make you compliant with any law. Fill in every placeholder in [square brackets], check that each sentence is true for your product, and have a qualified lawyer review it before you publish.

Cookie policy draft (Markdown)

# Cookie policy

> **Template draft — not legal advice.** This is a template draft generated from a short form. It may not fit your business or the laws that apply to you. Have it reviewed by a qualified lawyer before you publish it, fill in every placeholder in square brackets, and delete this note once it has been reviewed.

**Effective date:** [effective date]

This policy explains how [company legal name] ("we", "us" or "our") uses cookies and similar technologies on [website URL], and how you can control them.

## What cookies are

Cookies are small text files that a website stores in your browser. They let the site remember things about your visit, such as whether you're logged in. Similar technologies, such as local storage and pixels, work in comparable ways. In this policy, we call all of them cookies.

Cookies set by the site you're visiting are first-party cookies. Cookies set by another company's service used on the site are third-party cookies.

## The cookies we use

We use these kinds of cookies:

- **Strictly necessary.** These cookies are needed for the site to work, for example to keep you logged in, keep the site secure and remember your cookie choices. The site can't work properly without them, so [they can't be switched off in our cookie settings — edit if this isn't true].
- **Analytics.** These cookies help us understand how people use the site, such as which pages they visit and how they got there, so we can improve it.

## Cookie list

[List each cookie your site sets: its name, who sets it, what it's for, how long it lasts and its category. Your browser's developer tools show the cookies a page sets.]

## Your consent

[Describe how you ask for consent, for example: "When you first visit, a banner asks you to accept or reject non-essential cookies. We don't set them unless you accept. You can change your choice at any time with the Cookie settings link at the bottom of every page."]

## Managing cookies in your browser

Most browsers let you see, block and delete cookies. Blocking all cookies may stop parts of the site from working. Your browser's help pages explain how:

- Google Chrome: <https://support.google.com/chrome/answer/95647>
- Mozilla Firefox: <https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox>
- Safari on Mac: <https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac>
- Microsoft Edge: <https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09>

## Changes to this policy

We'll update this policy when we change the cookies we use. The effective date at the top shows when it last changed.

## Contact us

If you have questions about this document, contact [company legal name] at [contact email].

Postal address: [postal address]

9 [bracketed] placeholders left to fill in or delete.

Your answers are saved in this browser only. Nothing is uploaded.

What a cookie policy covers

A cookie policy tells visitors which cookies and similar technologies (local storage, pixels) your site uses, what each one is for, who sets it, how long it lasts, and how to accept, refuse or delete them. The ICO’s cookie guidance sums up the UK rules: tell people the cookies are there, explain what they do and why, and get consent. Cookies that are strictly necessary for a service the user asked for, like keeping them logged in or a shopping basket, don’t need consent.

How to use this generator

Tick the kinds of cookies you use: strictly necessary, preferences, analytics and marketing.
Build the cookie table. One click adds suggested rows for Google Analytics 4 (from Google’s cookie documentation) or Cloudflare bot protection (from Cloudflare’s cookie list). Edit every row to match your setup; replace <container-id> with your own ID.
Describe your consent banner in your own words. The consent section only appears if you use cookies beyond strictly necessary ones.
The draft links to the cookie help pages for Chrome, Firefox, Safari and Edge, and to Google’s Analytics opt-out add-on when your table includes Google Analytics.

A template is a starting point

A cookie policy is only as accurate as its table. Check your site’s real cookies after every new script or tool, update the effective date, and have a qualified lawyer review the policy and your banner together, since the rules differ between countries. See our own privacy policy and terms for plain-English examples.

Also draft a privacy policy and terms of service, and tag campaign links with the UTM builder so your analytics data is worth the cookies.

Questions

Does a cookie policy mean I don't need a cookie banner?

No. The policy explains your cookies; consent is a separate step. The UK regulator, the ICO, says you must tell people about cookies, explain what they do, and get consent before setting ones that aren't strictly necessary, and that continuing to browse doesn't count as consent. Rules elsewhere differ, so check with your lawyer.

How do I find out which cookies my site sets?

Open your site in a private window, open the browser's developer tools and look at the cookies and storage for your domain, before and after you accept your banner. Then check the documentation for each tool you use (analytics, chat, payments, ads) for the cookies it sets and how long they last.

Where do the suggested Google Analytics and Cloudflare rows come from?

From the vendors' own docs. Google lists _ga (distinguishes users) and _ga_<container-id> (persists session state), both with a default expiry of 2 years. Cloudflare lists __cf_bm for bot protection, lasting 30 minutes of continuous inactivity, and cf_clearance for passed challenges without a stated duration, so we leave that blank.

Should the cookie policy be separate from my privacy policy?

Either works. A separate page is easier to keep up to date when you add a tool, and your banner can link straight to it. If you keep it inside your privacy policy, make sure the cookie table is easy to find.