Your files never leave your device. All processing happens locally in your browser.
How do I write a cookie policy for my website?
Enter your website name and URL, legal entity and contact email, an effective date, and the jurisdictions that apply (EU GDPR / ePrivacy, UK GDPR / PECR, US CCPA / CPRA). Choose which of the four consent categories your site uses — Strictly Necessary, Preferences/Functional, Analytics/Performance, Marketing/Advertising — and tap the third-party services you load (Google Analytics, Meta Pixel, Hotjar, Stripe, YouTube, and more) to auto-add their documented cookies. The tool renders a complete policy live and exports it as HTML, Markdown or plain text. Everything runs in your browser; nothing is uploaded.
Four standard consent categories with editable cookie name, provider, purpose, retention and first/third-party type
One-tap third-party picker for 13 common services that auto-adds their known cookies and privacy / opt-out links
Jurisdiction-aware consent & legal-basis wording for GDPR, UK GDPR / PECR and CCPA / CPRA
Live sandboxed preview plus HTML, Markdown and plain-text export from one document model
A starting template, not legal advice — pair it with a consent banner / CMP and a lawyer review
What is
Cookie Policy
A cookie policy is a public document that tells visitors which cookies and similar technologies (pixels, local storage, SDKs) a website uses, who sets them (first- or third-party), why, and how long they last, and explains how visitors can control or refuse them. Under the EU ePrivacy Directive and the GDPR (and UK PECR / UK GDPR), non-essential cookies may only be set after the visitor gives prior, informed consent, so a cookie policy normally accompanies a consent banner. It is distinct from a privacy policy, which covers all personal-data processing; the cookie policy focuses specifically on cookie-based tracking and the choices around it.
Security & Privacy
Related terms
GDPRePrivacy DirectiveUK PECRCCPA / CPRAconsent bannerconsent management platform (CMP)first-party cookiethird-party cookiecookie scannerGlobal Privacy Control (GPC)strictly necessary cookiesretention period
Frequently Asked Questions
Yes. It is completely free and 100% client-side — your inputs are turned into a policy in your browser and never uploaded.
The generator is free with no sign-up. It is pure templating that runs entirely on your device: your site name, URL, company details, jurisdictions and cookie choices are just strings assembled into a policy locally. There is no network request, no upload, no logging, no server and no CDN in the generation path, and the live preview renders in a sandboxed frame with no scripts and no network access. Nothing is persisted; close the tab and your work is gone. The only optional network use anywhere on the site is consent-gated ads, which never see your inputs.
No. It produces a strong starting template, but compliance also needs a real consent banner, an accurate cookie audit and legal review.
A cookie policy document is necessary but not sufficient. To comply with GDPR, UK GDPR / PECR, ePrivacy or CCPA / CPRA you must also: audit the cookies your site actually sets (a policy that lists the wrong cookies is worse than none); deploy a consent banner or consent management platform (CMP) that genuinely blocks non-essential cookies until the visitor consents — a banner that fires trackers before consent does not comply; offer granular accept / reject / by-category choices and an easy way to withdraw consent; keep the policy current as your cookies change; and, for CCPA, honour opt-out signals such as the Global Privacy Control. Have a qualified lawyer review the result for your jurisdictions.
Your website name and URL, legal entity, contact email, an effective date, the applicable jurisdictions, and the cookie categories and third-party services you use.
The form collects your website name and URL, the company / legal entity responsible, a contact email and an effective date. You then pick the jurisdictions that apply (EU GDPR / ePrivacy, UK GDPR / PECR, US CCPA / CPRA), which tunes the consent and legal-basis wording, and switch on the cookie categories your site uses. Each category holds an editable table of cookie name, provider, purpose, retention and first/third-party type. Finally you tap the third-party services you load — each one auto-adds its documented cookies to the right category and a linked privacy / opt-out entry — and the policy updates live.
The policy is the document that describes your cookies; the banner is the interface that collects and enforces consent. You need both.
A cookie policy is the reference page that lists your cookies, their purposes, retentions and the choices visitors have. A cookie banner (part of a consent management platform, or CMP) is the pop-up a visitor interacts with to accept, reject or customise cookies, and — crucially — a proper CMP also blocks non-essential cookies from firing until consent is given and records that consent. Regulators care most about that enforcement: many banners collect a preference but still let trackers load beforehand, which is non-compliant. This tool generates the policy document; you still need a real banner / CMP wired to actually gate the cookies.
Detailed Explanation
📖How It Works
What the Cookie Policy Generator Does
The Cookie Policy Generator is a 100% client-side tool that turns a structured form — website name and URL, legal entity, contact email, effective date, applicable jurisdictions, the cookie categories the site uses and a set of known third-party services — into a complete, well-structured cookie policy. It renders the policy live in a sandboxed preview and exports it as HTML, Markdown or plain text. It is pure templating: nothing is uploaded, and the whole document is assembled in the browser.
Four standard consent categories with editable cookie name / provider / purpose / retention / party
One-tap picker for 13 common third-party services that auto-adds their documented cookies
Jurisdiction-aware wording for EU GDPR / ePrivacy, UK GDPR / PECR and US CCPA / CPRA
Exports HTML, Markdown and plain text from a single document model so formats never drift
A starting template, not legal advice; runs entirely in the browser with nothing uploaded
⚙️Methodology
How the Policy Is Assembled
A pure engine (cookiePolicyEngine.ts) builds an intermediate document model — headings, paragraphs, lists and tables with inline links — from the input, then renders that one model to HTML, Markdown and plain text so the three exports stay in sync. Selected third-party services contribute their catalogued cookies into the matching category table (marked third-party) and a linked entry in a dedicated third-parties section. The consent-and-legal-basis section is composed conditionally: EU/UK jurisdictions add prior-consent and withdrawal language, while CCPA adds an opt-out-of-sale/share paragraph that references the Global Privacy Control. Dates are formatted locally and all text is HTML-escaped for the HTML output.
Single document model → HTML / Markdown / plain-text renderers (no drift)
Third-party cookies are merged into category tables and a linked services list
Consent wording is assembled conditionally from the chosen jurisdictions
HTML output is fully escaped and ships its own light/dark stylesheet
Built-in catalogue: real cookie names, typical purposes and retentions (2026 defaults)
📋Use Cases
Who It Is For and How to Use It
It suits site owners, developers and agencies who need a solid first draft of a cookie policy fast — for a marketing site, blog, SaaS app or store — without pasting their configuration into a remote service. Fill in the company details, tick the jurisdictions that match your visitors, enable the categories your site uses, then tap the services you load (for example Google Analytics for analytics, Meta Pixel and Google Ads for marketing, Stripe and Cloudflare as strictly necessary). Edit the auto-filled cookie rows to match your real setup, preview the result, and export HTML to publish, Markdown for a docs site, or plain text for a contract annex.
A fast first draft for marketing sites, blogs, SaaS and stores
Services map to the right category: Stripe/Cloudflare = necessary, GA/Clarity = analytics, Ads/Meta/TikTok = marketing
Editable rows let you match the exact cookies your site sets
HTML to publish, Markdown for docs, plain text for annexes
No account and no upload — paste nothing into a remote tool
⚠️Limitations
Honest Limitations
This produces a template, not compliance. A cookie policy is necessary but not sufficient under GDPR, UK PECR / UK GDPR, ePrivacy or CCPA / CPRA. You must audit the cookies your site actually sets with a scanner and list every one — a policy that describes the wrong cookies can be worse than none. You must pair it with a real consent banner or consent management platform (CMP) that genuinely blocks non-essential cookies until the visitor consents; a banner that fires trackers before consent is non-compliant regardless of what the policy says. Offer granular accept / reject / by-category choices and easy withdrawal, honour opt-out signals such as GPC for CCPA, keep the policy current, and have a qualified lawyer review it. The catalogue cookie facts are common 2026 defaults and will not exactly match your site.
A policy document alone does not stop a single tracker from firing
Audit real cookies with a scanner; the built-in facts are generic defaults
A compliant setup needs a CMP that blocks cookies until consent
CCPA requires honouring opt-out signals like the Global Privacy Control
Not legal advice — have a lawyer review it for your jurisdictions
🔒Privacy & Security
Private by Design
Everything happens on your device. Your site name, URL, company details, jurisdictions and cookie choices are just strings that are assembled into a policy by local JavaScript — there is no network request, no upload, no logging, no server and no CDN in the generation path. The live preview renders in a sandboxed iframe with no scripts and no network access. Nothing is persisted; reload the page and your work is gone. The tool works offline once cached, supports dark mode and a mobile-first layout, and the only optional network use anywhere on the site is consent-gated ads, which never see your inputs.
Pure local templating — nothing uploaded, no server, no CDN
Sandboxed preview frame: no scripts, no network
Nothing persisted; work vanishes on reload
Works offline once cached; dark-mode and mobile-first
Keeps your site configuration entirely on your machine
The four cookie categories and how consent applies
Google Analytics 4, Microsoft Clarity, Hotjar, HubSpot
Marketing / Advertising
Yes
Google Ads, Meta Pixel, LinkedIn, TikTok, YouTube embeds
Under GDPR/ePrivacy only strictly necessary cookies are exempt from prior consent; all others require opt-in. Generated locally in your browser; nothing is uploaded. A template, not legal advice. As of July 2026.
