Cookie Policy Generator
Tick the analytics, advertising, payment and video services your website uses and get a complete cookie policy with a cookie table listing each cookie's name, provider, purpose and lifetime. Add your own cookies, then copy it as formatted text, HTML, Markdown or just the table.
Last updated:
Cookie names and lifetimes are the providers' typical defaults and can change. Check what your pages really set (browser developer tools, Application > Cookies) before publishing. This is a template, not legal advice.
How to use the Cookie Policy Generator
- Enter your website details: name, URL, owner, contact email, effective date and a link to your privacy policy.
- Tick the tools and services your site uses, such as Google Analytics, Google AdSense, Stripe or YouTube embeds.
- Add your own cookies that are not in the list, with their provider, purpose, duration and category.
- Choose the extra sections you need: EU/UK consent, US state privacy rights, other tracking technologies and browser instructions.
- Copy or download the policy as HTML, Markdown or text, or copy only the cookie table, and link to the page from your site footer and cookie banner.
Cookie categories and when you need consent
Most cookie policies and consent banners sort cookies into the same four or five groups. The category decides whether, in the EU and UK, you may set the cookie before the visitor says yes.
| Category | Typical examples | Consent needed in EU/UK? | US state laws |
|---|---|---|---|
| Strictly necessary | Login session, shopping cart, Cloudflare bot protection, reCAPTCHA, the consent cookie itself | No, but they must still be listed | No opt-out needed |
| Preferences | Language, theme, live chat widget | Usually yes, unless the visitor explicitly asked for the feature | Normally no opt-out needed |
| Analytics | Google Analytics (_ga), Microsoft Clarity (_clck), Hotjar, Matomo | Yes (France's CNIL exempts some configured, privacy-friendly analytics) | Opt-out may be needed if the data is shared with third parties for their own use |
| Advertising | AdSense (__gads, IDE), Google Ads (_gcl_au), Meta Pixel (_fbp), LinkedIn, TikTok | Yes, before the cookie is set | Counts as sale or sharing for targeted ads: offer an opt-out and honor Global Privacy Control |
| Embedded content | YouTube (YSC, VISITOR_INFO1_LIVE), Vimeo (vuid) | Yes; use privacy-enhanced embeds or click-to-load placeholders | Depends on whether the provider uses the data for ads |
Tips for an accurate cookie policy
- Audit, then write. Load your site in a private window and check every cookie in the browser's developer tools before and after accepting the banner. Anything that appears before consent should be strictly necessary.
- Use the real names. Replace placeholders such as
[container-id]or[site-id]only if you want to; the bracket form is acceptable because the value differs per site. - Keep the banner and the policy in sync. The categories a visitor can switch off in the banner should match the headings in the cookie table.
- Include local storage and pixels. Consent rules cover any technology that stores or reads information on the device, not only cookies.
- Review it after every new plugin, embed or ad network, and update the effective date each time you change the list.
Frequently asked questions
What is a cookie policy?
A cookie policy is a public page that tells visitors which cookies and similar technologies a website uses, why it uses them, who sets them, how long they last and how visitors can control them. It is often a separate page linked from the cookie banner and the site footer, or a section inside the privacy policy.
Is a cookie policy required by law?
In the EU, EEA and UK, the ePrivacy rules (PECR in the UK) require websites to give clear information about cookies and get consent before setting non-essential ones, so a cookie policy is effectively mandatory for sites with visitors there. In the US there is no specific cookie law, but California's CalOPPA and state privacy laws such as the CCPA require you to disclose tracking and offer opt-outs, and Google AdSense and Analytics require cookie disclosures.
What is the difference between first-party and third-party cookies?
First-party cookies are set by the domain shown in the address bar, for example the _ga cookie from Google Analytics is stored on your own domain. Third-party cookies are set by a different domain, such as doubleclick.net for Google ads or youtube.com for embedded videos. Many browsers now block or limit third-party cookies by default.
Which cookies do not need consent?
Under EU and UK rules, cookies that are strictly necessary to provide a service the visitor asked for do not need consent, for example login sessions, shopping carts, load balancing, security and the cookie that stores the consent choice itself. Analytics, advertising and most embedded-content cookies need consent first.
How do I find out which cookies my website sets?
Open your site in a private browser window, open the developer tools (F12), go to Application (Chrome, Edge) or Storage (Firefox), and look under Cookies for each domain. Click around, accept the banner and visit key pages, then compare the list with your cookie table. Repeat whenever you add a new script or plugin.
Are the cookie durations in the table accurate?
They are the typical default lifetimes published by each provider at the time of writing, for example 2 years for the Google Analytics _ga cookie and 90 days for the Meta _fbp cookie. Providers change their cookies and some lifetimes can be configured, so check what your site really sets and edit or add rows where needed.
Do I need both a privacy policy and a cookie policy?
You need a privacy policy whenever you collect personal information. A separate cookie policy is optional if your privacy policy already lists your cookies in enough detail, but many sites publish both because the cookie list changes more often and is linked directly from the cookie banner.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.