How to use this template
- Copy the template below, or download it as a Word or PDF file.
- Delete the sections that don't apply to you. Each one has a note further down saying when you need it.
- Replace every highlighted [bracket] with your own details. Search the finished text for "[" to check you got them all.
- Publish it as its own page, link it from your site footer, and set the date at the bottom.
- If your business carries real legal risk, have a lawyer review it. A template is a starting point, not legal advice.
The full cookie policy template
10 sections. Placeholders are highlighted.
Cookie Policy
Template for [Your Company Name]
1. What Are Cookies
Cookies are small text files that are placed on your device (computer, tablet, or mobile) when you visit a website. They are widely used to make websites work more efficiently, provide a better user experience, and give website owners information about how their site is being used.
This Cookie Policy explains what cookies are, how [Your Company Name] ("we," "our," or "us") uses cookies and similar tracking technologies on [yourwebsite.com], and your choices regarding cookies.
2. Types of Cookies We Use
We use the following categories of cookies:
Strictly Necessary Cookies:
These cookies are essential for the website to function and cannot be switched off. They include session cookies, authentication cookies, and security cookies (e.g., CSRF tokens). They do not require consent.
Functional Cookies:
These cookies enable enhanced functionality and personalization, such as remembering your language preference, region, or display settings. If you do not allow these cookies, some features may not function properly.
Analytics Cookies:
These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We use [Google Analytics / Mixpanel / etc.] to analyze site usage.
- _ga: Google Analytics, expires after 2 years
- _gid: Google Analytics, expires after 24 hours
Marketing/Advertising Cookies:
These cookies are used to track visitors across websites and deliver targeted advertisements. They are set by our advertising partners.
- _fbp: Facebook Pixel, expires after 3 months
- [Other advertising cookies you use]
3. Third-Party Cookies
Some cookies are placed by third-party services that appear on our pages. We do not control these third-party cookies. The third parties that set cookies on our site include:
- Google Analytics: [analytics.google.com/policies]
- Facebook/Meta: [facebook.com/policies/cookies]
- [Other third-party services]
We recommend reviewing the privacy policies of these third parties for more information about their cookie practices.
4. Cookie Duration
Cookies can be either session cookies or persistent cookies:
- Session Cookies: These are temporary cookies that are deleted when you close your browser. They are used for things like maintaining your login state during a browsing session.
- Persistent Cookies: These cookies remain on your device for a set period or until you manually delete them. They are used for things like remembering your preferences between visits.
The specific duration for each cookie we use is listed in the cookie table in Section 2.
5. How to Manage Cookies
You can control and manage cookies in several ways:
Browser Settings:
Most web browsers allow you to manage your cookie preferences. You can set your browser to refuse cookies or to alert you when cookies are being sent. The following links show how to manage cookies in popular browsers:
- Chrome: chrome://settings/cookies
- Firefox: about:preferences#privacy
- Safari: Preferences > Privacy
- Edge: edge://settings/privacy
Cookie Consent Tool:
When you first visit our website, you will be presented with a cookie consent banner where you can accept or reject non-essential cookies. You can change your preferences at any time by [clicking the cookie settings link in our footer / visiting our cookie preference center].
Opt-Out of Analytics:
You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
Please note that disabling cookies may affect the functionality of our website and your user experience.
6. Do Not Track Signals
Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to be tracked. There is currently no universally accepted standard for how to respond to DNT signals. We [do/do not] currently respond to DNT signals. If a standard is adopted, we will update this policy accordingly.
7. Cookie Table
The table below lists the specific cookies used on our website, along with their provider, purpose, type, and duration. This list is reviewed and updated periodically.
Cookie Name: _ga
Provider: Google Analytics
Purpose: Distinguishes unique users by assigning a randomly generated number as a client identifier. Used to calculate visitor, session, and campaign data for site analytics reports.
Type: Analytics (Persistent)
Duration: 2 years
Cookie Name: _gid
Provider: Google Analytics
Purpose: Stores and updates a unique value for each page visited. Used to count and track pageviews for analytics reporting.
Type: Analytics (Persistent)
Duration: 24 hours
Cookie Name: _gat
Provider: Google Analytics
Purpose: Used to throttle the request rate to Google Analytics, limiting data collection on high-traffic sites.
Type: Analytics (Persistent)
Duration: 1 minute
Cookie Name: _fbp
Provider: Facebook / Meta
Purpose: Used by Facebook to deliver targeted advertisements and track ad performance across websites that use Facebook advertising services.
Type: Marketing (Persistent)
Duration: 3 months
Cookie Name: _gcl_au
Provider: Google Ads
Purpose: Used by Google AdSense for experimenting with advertisement efficiency across websites using their services. Stores a unique user identifier for conversion tracking.
Type: Marketing (Persistent)
Duration: 3 months
Cookie Name: JSESSIONID
Provider: [Your Company Name]
Purpose: Preserves users' session state across page requests. Essential for maintaining login status and shopping cart contents during a browsing session.
Type: Strictly Necessary (Session)
Duration: Session (deleted when browser closes)
Cookie Name: csrf_token
Provider: [Your Company Name]
Purpose: Prevents Cross-Site Request Forgery (CSRF) attacks by validating that form submissions originate from your website.
Type: Strictly Necessary (Session)
Duration: Session
Cookie Name: locale
Provider: [Your Company Name]
Purpose: Stores the user's language and regional preference so the website displays content in the correct language on return visits.
Type: Functional (Persistent)
Duration: 1 year
Cookie Name: cookie_consent
Provider: [Your Company Name]
Purpose: Records the user's cookie consent preferences (accepted categories) so the consent banner is not shown repeatedly.
Type: Strictly Necessary (Persistent)
Duration: 1 year
Cookie Name: _hjSessionUser
Provider: Hotjar
Purpose: Set when a user first lands on a page. Persists the Hotjar User ID which is unique to that site. Ensures data from subsequent visits is attributed to the same user for analytics.
Type: Analytics (Persistent)
Duration: 1 year
Please note: The cookies listed above are representative examples. Your specific cookie inventory may vary based on the services and integrations you use. We recommend auditing your site with a cookie scanning tool such as [Cookiebot / OneTrust / CookieYes] and updating this table accordingly.
8. Regional Requirements
Different jurisdictions have different requirements regarding the use of cookies and similar tracking technologies. Below is a summary of key regulations that may apply to your use of our website:
GDPR (European Union / EEA):
- Applies to all websites that process data of EU/EEA residents
- Requires informed, specific, and freely given consent before placing non-essential cookies
- Users must be able to withdraw consent as easily as they gave it
- Consent must be granular: users should be able to accept or reject cookies by category
- Pre-ticked boxes and implied consent (e.g., "by continuing to browse") are not valid forms of consent
- Cookie banners must clearly identify each cookie, its purpose, and duration
PECR (United Kingdom):
- The Privacy and Electronic Communications Regulations complement UK GDPR
- Requires clear and comprehensive information about cookies and their purpose
- Requires consent before setting non-essential cookies on a user's device
- Strictly necessary cookies are exempt from consent requirements
- The ICO recommends a granular consent mechanism similar to GDPR standards
CCPA / CPRA (California, USA):
- Does not require opt-in consent for cookies, but requires disclosure of data collection practices
- Users must be informed about the categories of personal information collected through cookies
- If cookies are used to "sell" or "share" personal information, a "Do Not Sell or Share My Personal Information" link must be provided
- Must honor Global Privacy Control (GPC) signals as a valid opt-out request
- Businesses must update their privacy policy annually to list categories of personal information collected
LGPD (Brazil):
- Brazil's General Data Protection Law requires a legal basis for processing personal data, including data collected via cookies
- Consent is one legal basis, and it must be free, informed, and unambiguous
- Users must have easy access to information about data processing activities
- A Data Protection Officer (DPO) must be appointed and their contact information must be publicly available
- Users have the right to request anonymization, blocking, or deletion of unnecessary or excessive data
We recommend consulting with a qualified legal professional to ensure your cookie practices comply with the specific requirements of each jurisdiction where your users are located.
9. Changes to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated policy on our website with a revised "Last Updated" date.
We encourage you to review this Cookie Policy periodically to stay informed about our use of cookies.
10. Contact Us
If you have any questions about our use of cookies or this Cookie Policy, please contact us:
[Your Company Name]
Email: [privacy@yourcompany.com]
Address: [Your Company Address]
Last Updated: [Date]
What each section does
- 1. What Are Cookies
- A plain explanation of cookies. It also covers similar technologies such as pixels and local storage, which EU and UK rules treat the same way.
- 2. Types of Cookies We Use
- The usual categories: strictly necessary, functional, analytics and advertising. In the EU and UK only strictly necessary cookies can be set without consent.
- 3. Third-Party Cookies
- Name each provider, such as Google Analytics or Meta, and link to their own policies.
- 4. Cookie Duration
- Session cookies end when the browser closes. Persistent cookies have an expiry date, which belongs in the cookie table.
- 5. How to Manage Cookies
- Explain your consent banner, how to change a choice later, and browser settings.
- 6. Do Not Track Signals
- How you respond to Do Not Track signals. California's CalOPPA requires this disclosure.
- 7. Cookie Table
- The most important part. List every cookie your site sets: name, provider, purpose, category and duration. Scan your site first, because tools often add cookies you do not know about.
- 8. Regional Requirements
- Notes for the EU and UK (consent before non-essential cookies), California (opting out of sale or sharing) and other regions. Keep the ones where you have visitors.
- 9. Changes to This Cookie Policy
- Explain how you will tell people about changes and update the date.
- 10. Contact Us
- Give a working email for cookie and privacy questions.
Template or generator?
This template is enough when
- Your site uses a few well known tools, such as one analytics tool
- You already know every cookie your site sets
- You already have a consent banner that blocks cookies until visitors agree
Use the cookie policy generator when
- You don't know which cookies your site sets. Run the free cookie scanner first
- You need a consent banner as well as the policy
- Your tools change often and the cookie table goes stale
- You want the policy hosted and kept in step with your cookies
Where to put your cookie policy
- On its own Cookie Policy page, linked from the footer of every page.
- Linked from your cookie consent banner.
- Referenced from the cookie section of your privacy policy.
Laws and guidance behind this template
These are the primary sources the notes on this page rely on. Rules differ by country and change over time, so check the ones that apply to you.
Cookie policy template FAQ
Is this cookie policy template really free?
Yes. Copy it or download the PDF or Word file and use it for your own website or app. You do not need an account or an email address.
Is a cookie policy required?
In the EU and UK you must give clear information about cookies and get consent before setting non-essential ones. That information can sit in your privacy policy, but a separate cookie policy with a cookie table is the clearest way to give it. The US has no cookie law as such, but California requires your privacy policy to disclose tracking.
Does this cookie policy template meet GDPR and UK ICO rules?
It has the sections EU regulators and the UK Information Commissioner's Office (ICO) expect. Compliance also depends on your banner: non-essential cookies must not load until the visitor agrees, and rejecting has to be as easy as accepting.
What is the difference between a cookie policy and a privacy policy?
A privacy policy covers all the personal data you handle. A cookie policy covers only cookies and similar trackers, in more detail, usually with a table of every cookie. Many sites link the two.
How do I find out which cookies my site uses?
Use a cookie scanner, or open your browser's developer tools and look under Application, then Cookies, on each page. Our free cookie scanner lists them for you.
Do I need a cookie consent banner too?
In the EU and UK, yes, if you use any non-essential cookies. The policy explains your cookies. The banner asks for consent before they load.
Want it in your inbox?
We will email you the Word file. Optional, the downloads above need no email.