A cookie policy can look deceptively simple. You explain what cookies your website uses and give visitors the information they need. But the wording is only useful if it reflects what’s happening on your website. So copying a policy from somewhere else can leave you describing cookies and trackers your site doesn’t use, while missing the ones it does.

You can use the free cookie policy template below as a starting point for your website. We’ll explain what you need to customize, how to find the information your policy needs, and how to keep it accurate as the cookies and trackers on your site change.

What Is a Cookie Policy?

A cookie policy is a document that explains how a website uses cookies and similar tracking technologies, including tracking cookies. It tells visitors which technologies may be used when they visit the site, what they are used for, and how they can manage their choices.

Providing this information is an important part of privacy compliance under privacy laws such as the General Data Protection Regulation (GDPR), the California Privacy Rights Act (CPRA), and other data privacy laws.

While requirements vary between jurisdictions, these laws can require businesses to be transparent about online tracking and, in certain cases, give users control over how their data is collected or used. A cookie policy is where much of that information can be clearly documented.

Cookie Policy vs. Cookie Declaration

A cookie policy and a cookie declaration are often discussed together, but they are not the same thing. Each covers a different part of how your website communicates its use of cookies and similar technologies.

• A cookie policy explains how and why your website uses cookies and similar technologies, including the choices visitors have and how they can manage them.
• A cookie declaration is the site-specific list of cookies and trackers your website uses, including details such as their purpose, provider, category, and duration.

While parts of a cookie policy can be based on standard wording, a cookie declaration should reflect the technologies actually used on your website.

What Should a Cookie Policy Include?

Cookie policies generally cover the same basic information, but the details need to reflect your website and the privacy requirements that apply to your business. At its core, your policy should explain what cookies are, how your website uses them, and what choices visitors have.

It should also be written in clear, plain language. Avoid legal or technical terminology where simpler wording will do, and explain unfamiliar terms when you need to use them.

Here’s what to include.

Information About Your Website and Business

Start by identifying the business or organization responsible for the website. Include your business name and website address so visitors know who the policy applies to.

If the policy covers multiple websites or domains, say so clearly. You should also explain if different websites, services, or parts of your business use cookies in different ways. Visitors should be able to understand the scope of the policy without having to figure it out themselves.

An Explanation of Cookies and How You Use Them

Explaining what cookies are is an essential step in your cookie policy. If your website uses similar technologies, such as pixels or local storage, explain those too.

You should then describe how cookies and similar technologies are used on your website. Depending on your setup and the requirements that apply, this can include:

• The types of cookies you use: Explain the categories of cookies used on your website and what each category means. These might include cookies for essential functionality, preferences, analytics, or advertising.
• Why you use them: Describe what cookies help you do. Rather than simply labeling a cookie as “analytics,” for example, explain that it helps you understand how visitors use your website or which pages they visit.
• The cookies and trackers in use: Identify the individual cookies and similar technologies used on your website. Details can include their names, providers, purposes, and duration.
• How long cookies last: Explain whether cookies expire when a browsing session ends or remain on a visitor’s device for a set period.
• Third-party cookies and services: Identify third parties that set cookies or similar technologies through your website and explain their role. Depending on the requirements that apply, you may also need to explain what information they receive or provide more information about how they use it.
• The information collected: Explain what information cookies and similar technologies collect when visitors use your website, where applicable.

Visitors may find this information easier to understand when you present details about individual cookies in a table or structured list. Most importantly, make sure the information reflects the technologies currently used on your website rather than relying on a generic list.

How Visitors Can Manage Their Cookie Choices

Explain what choices visitors have and how they can manage them. Make sure your instructions match the controls your website actually provides.

If you use a cookie banner or preference center, explain how visitors can use it to make their choices and update them later. If you tell visitors how to manage cookies through their browser settings, explain what changing those settings will do.

Do not describe controls or options that your website does not offer. A visitor should be able to read your policy, follow the instructions, and find the corresponding controls on your site.

Updates and Contact Information

Include a “last updated” date so visitors can see when you most recently reviewed the policy. When you change how your website uses cookies, review the policy to make sure it still accurately describes your practices.

For example, adding an analytics tool, advertising service, plugin, or embedded feature may introduce new cookies or tracking technologies. Removing a service may also leave information in your policy that no longer applies.

Finally, tell visitors how they can contact you with questions about the policy or your use of cookies. Provide a contact method you actively monitor, such as an email address or contact form.

Free Cookie Policy Template

Below is a free cookie policy template you can copy and paste into a dedicated cookie policy page on your website, then customize for your business.

Before using the template, read through the full policy and replace all text in [brackets] with information from your website. Remove anything that doesn’t apply to your business, and adjust the wording where needed, so it accurately reflects how your website uses cookies and similar technologies.

How to Customize Your Cookie Policy Template

Customizing your cookie policy means replacing the generic parts of the template with information that reflects your website. Some fields are straightforward, such as your business name and contact details. Others require you to look at how your website uses cookies, which third-party services are involved, and what choices you give visitors.

The table below shows what you’ll need to add and where to find it.

Don't add information simply because it appears as an option in the template. If your website doesn't use advertising cookies, for example, remove language about advertising cookies rather than leaving it in as generic wording.

How to Keep Your Cookie Policy Accurate as Your Website Changes

A cookie policy is only useful if it reflects what your website is actually doing. But your website’s use of cookies and trackers isn’t necessarily static. It can change over time as the tools, services, and features behind your site evolve.

That means keeping your cookie policy accurate is an ongoing process rather than a one-time task. Regularly checking what your website uses, and reviewing it again when you make relevant changes, can help you spot when your policy needs to be updated.

A consistent review process can help you catch these changes and keep your policy aligned with your website.

Identify the Cookies and Trackers on Your Website

Start with an inventory of the cookies and trackers currently active on your website. You can inspect these manually using your browser’s developer tools or use a website scanner to identify them.

A best practice is to check more than your homepage. A cookie may only appear on a particular page, after an embedded video loads, or when a visitor interacts with a specific feature.

For each cookie or tracker you find, record the information you need for your policy. This can include its name, provider, purpose, and lifespan, along with whether it comes from your website or a third party.

Check That Your Cookie Information Is Current

Use the scan results to check whether the cookie information you're providing to visitors still reflects your website.

Look for newly detected cookies and trackers that aren't covered, as well as technologies listed in your policy that are no longer present. Details can change too, so check whether existing information about purposes, providers, or lifespans still holds.

You can carry out these checks manually, or use a consent management platform (CMP) to run periodic scans and help identify changes in the cookies and trackers your website uses.

Update Your Cookie Policy as Needed

If your review reveals a discrepancy, update your cookie policy accordingly. Add newly detected technologies, remove entries that no longer apply, and correct any details that are out of date.

Consider whether the change affects the wider policy too. For example, adding a third-party advertising service could change your explanation of why cookies are used, not just the information you provide about individual cookies.

Once you’ve made the necessary updates, change the “last updated” date and review the published policy to make sure everything is accurate. The information visitors read should reflect the cookies and trackers they can actually encounter on your website.

Automate Your Cookie Declaration and Maintenance With Cookiebot by Usercentrics

A cookie policy template gives you a starting point. But the information it contains still needs to reflect the cookies and trackers on your website, and that picture can change as your site evolves.

Cookiebot by Usercentrics is a consent management platform (CMP) that helps businesses manage cookie consent and website tracking. It scans your website for cookies and trackers, including technologies introduced as your site changes, giving you ongoing visibility into what is being used.

Based on those scan results, Cookiebot CMP generates a cookie declaration that provides visitors with information about the cookies and trackers detected on your website. It also applies visitors’ consent choices and keeps records of those choices, bringing your cookie declaration and consent management into the same process.

A cookie policy should not become outdated the moment your website moves forward. With Cookiebot CMP, your declaration can keep pace with what is happening on your site, while your visitors’ consent choices are carried through.