Overview
A verified cookies policy tells website visitors which cookies you use, why, which need consent and how to change their choices. Drafted for the privacy law that applies to your site.
Full Details
Cookies Policy: Create a Verified Cookie Policy for Your Website
A verified cookies policy explains to visitors which cookies and similar technologies your website or app uses, what they do, which ones need consent and how visitors can accept, refuse or change their choices. Robot Lawyer drafts the policy from your answers, in plain English and under the privacy law that applies to your site. On the Verified plan, a legal professional checks it before you publish it.
CONTENTS
Cookies are small files stored on a visitor's device when they use a website. Similar technologies include pixels, tags, local storage and device fingerprinting. A cookies policy is a public notice, usually linked from your website footer and cookie banner, that explains how you use them.
It works alongside your Privacy Policy, which covers your wider use of personal data, and your cookie banner, which collects visitors' choices.
Do You Need a Cookies Policy?
If your website uses any cookies or similar technologies, you almost certainly need to tell visitors about them.
- Transparency
Most privacy laws expect you to tell visitors clearly what you collect and why, and cookies are no exception. - Consent or opt-out
Many countries require consent before non-essential cookies are set, while others give visitors the right to opt out of certain tracking. - Personal data
Where cookies collect personal data, such as identifiers used for advertising, wider data protection law applies too.
The rules depend on where your business and your visitors are, so your policy is drafted for the law that applies to your site. A clear cookies policy is good practice wherever you operate.
What's Included in Your Cookies Policy?
- Who you are
The website owner or operator, their address and a link to your privacy policy. - What cookies are
A plain explanation of cookies and similar technologies, and the types you use, such as session, persistent, first-party and third-party cookies. - How you use cookies
Each category you use and whether it needs consent: strictly necessary, functionality, analytics and advertising. - Consent
How visitors give consent, and that rejecting is as easy as accepting. - Managing choices
How visitors can change their preferences or withdraw consent, including through browser settings. - Third parties
The providers who receive cookie data and why. - International transfers
Whether cookie data leaves the country and the safeguards in place. - Data protection, updates and contact
The lawful basis, how long cookies last, how you will tell visitors about changes and who to contact.
Where consent is required, strictly necessary cookies, such as those for sign-in, security or a shopping basket, can usually be set without it, while advertising and tracking cookies need it first. Valid consent is a clear positive action: continued browsing and pre-ticked boxes don't count. The main rules vary:
- UK
The Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR require clear information and, for most non-essential cookies, consent. Since the Data (Use and Access) Act 2025, some low-risk cookies, such as certain analytics used only to improve your own site, can be set without consent if visitors get clear information and a simple way to object. - EU and EEA
The ePrivacy Directive and the GDPR require consent for non-essential cookies, and visitors must be able to withdraw it as easily as they gave it. - United States
There is no general federal cookie consent law, but some state privacy laws, such as California's, require notice and a right to opt out of the sale or sharing of personal information, which can include advertising cookies. - Canada
Federal privacy law requires meaningful consent, and Québec requires technologies that can identify, locate or profile a person to be switched off by default. - Australia
There is no specific cookie consent law, but the Privacy Act 1988 applies to many businesses where cookies collect personal information.
Your policy describes each category in line with the answers you give, so it matches what your site actually does. These notes are general, so check the current rules where you operate.
How It Works on Robot Lawyer
- Answer the questions
Tell us about your business, the cookies your site uses, how you collect consent, any third parties and how visitors can contact you. - Generate your policy
We draft a clear, structured policy under the law that applies to your site. - Get it verified
On the Verified plan, a qualified legal professional checks your policy within 24 hours and makes amendments where needed. See how our documents are verified. - Publish it
Add it to your website, link it from your footer and cookie banner, and keep it up to date.
How Much Does It Cost?
Robot Lawyer is a subscription. The Essentials plan is £13.99 a month, and the Verified plan, which includes verification of your finished policy by a legal professional, is £24.99 a month. Both start with a 7-day free trial. See our pricing.
Cookies Policy FAQs
Is there a cookie policy template for UK websites?
Yes. Robot Lawyer drafts a cookies policy for UK websites under PECR and the UK GDPR, based on the cookies your site actually uses, rather than a one-size-fits-all template.
What's the difference between a cookies policy and a privacy policy?
A privacy policy explains how you collect and use personal data generally. A cookies policy focuses on cookies and similar technologies. Many businesses keep them separate and link the two.
Do I need a cookie banner as well as a cookies policy?
If you use cookies that need consent, yes. The banner collects consent before those cookies are set, and the policy gives the full details.
Do I need consent for Google Analytics?
It depends on the law that applies. In the EU and the UK, third-party analytics tools generally need consent, although the UK now exempts some analytics used only to improve your own site under strict conditions. In many other countries, clear notice and an opt-out may be enough, so check how your provider uses the data.
How often should I update my cookies policy?
Whenever you add, remove or change cookies or providers, and at least once a year. An out-of-date policy can mislead visitors.
Does my website need a cookies policy if I only use essential cookies?
Even if you don't need consent, you should still tell visitors what the cookies are and why you use them. A short cookies policy is the simplest way to do this.
Create a Verified Cookies Policy
Be clear and compliant about the cookies your site uses. Related documents: Privacy Policy, Terms of Service, Data Breach Policy and Website Development Agreement.
Solution
Cookies Policy
Similar Services