What every website's cookie policy should cover
A cookie policy (sometimes called a cookie consent policy) is a standalone document or section of your privacy policy that explains how your website uses cookies and similar tracking technologies. Here is what a complete, compliant cookie policy should address.
**What are cookies?** A brief, plain-English explanation of what cookies are — small text files stored in a user's browser that allow websites to remember information about their visit — helps users who are not technically sophisticated understand why the policy exists.
**Types of cookies.** Cookies are typically categorized into four types: (1) Essential/strictly necessary cookies, which are required for the website to function (login sessions, shopping cart, security). These cannot be opted out of without breaking the site. (2) Analytics/performance cookies, which collect aggregate data about how visitors use the site (Google Analytics, Mixpanel, Plausible). (3) Marketing/advertising cookies, which track users across websites for ad targeting (Facebook Pixel, Google Ads, LinkedIn Insight Tag). (4) Preference/functional cookies, which remember user settings like language, currency, or theme.
**Third-party cookies.** List the specific third-party services that set cookies on your site, what data they collect, and link to their own privacy policies. Common third parties include Google Analytics, Google Ads, Facebook Pixel, HubSpot, Intercom, Stripe, and Hotjar.
**Cookie duration.** Specify whether each cookie category is a session cookie (deleted when the browser is closed) or a persistent cookie (remains for a defined period, e.g., 30 days, 1 year, 2 years).
**Legal basis and consent.** Under GDPR, you need a legal basis for each category of cookie. Essential cookies are covered by legitimate interest. Analytics and marketing cookies typically require the user's consent. Your policy should explain this and describe how consent is obtained (e.g., via a cookie consent banner).
**How users can manage or opt out.** Explain how users can withdraw consent — through your cookie banner, browser settings, or opt-out tools like the Google Analytics opt-out browser add-on. For CCPA compliance, include information about how California residents can opt out of the sale of personal data.
**Updates to the policy.** State that the cookie policy may be updated as the site adds new cookies or services, and that you will notify users of material changes.
**GDPR specifics.** Under GDPR, websites serving EU visitors must: obtain prior consent for non-essential cookies, make it as easy to withdraw consent as to give it, not use pre-ticked consent boxes, and keep records of consent. A cookie banner that only has an 'Accept All' button without an equally prominent 'Reject Non-Essential' option is not GDPR-compliant.
**CCPA specifics.** Under the California Consumer Privacy Act, businesses must disclose what personal information is collected through cookies and give California residents the right to opt out of the 'sale' of their personal information (which can include sharing data with ad networks).
**Common mistakes.** Listing cookies that are no longer on your site. Failing to update the policy when you add a new analytics or marketing tool. Using vague descriptions that do not actually explain what each cookie does. Not linking the cookie policy from the consent banner. Treating the cookie policy as the same document as the privacy policy (they can be combined, but cookie-specific disclosures must be present).
**When to involve a lawyer.** For enterprise websites, websites in highly regulated industries (healthcare, finance), or websites with users in multiple jurisdictions with different privacy laws, have a licensed privacy attorney review your cookie policy. FreeContract generates an editable template — it is not a substitute for legal advice on privacy compliance.