Cookie Policy Template
A ready-to-use cookie policy template covering cookie categories, third-party cookies, consent management, and user opt-out instructions. GDPR and ePrivacy Directive compliant.
What's included
- Cookie categories table (strictly necessary, functional, analytics, marketing)
- First-party and third-party cookie listing
- Consent mechanism description
- Opt-out and browser settings instructions
- GDPR and ePrivacy Directive alignment
- Version history section
How to use this template
- Run a cookie scan on the site the policy is for using /tools/cookie-scanner — the output gives you the categorised cookie list the policy needs to describe.
- Fill in the cookie categories table with the first-party and third-party cookies the scan found, their purpose and duration. Delete rows for categories you don't use.
- Link to each third-party vendor's privacy policy from the vendor column. GDPR, DPDP and CCPA all expect specific vendor identification, not vendor categories.
- Add your consent mechanism language — the policy template includes variants for an opt-in banner (EU/India/UK) and an opt-out mechanism (CCPA/US). Keep the one that matches your deployment.
- Publish the cookie policy at a stable URL and link it from both the main privacy policy and the banner itself.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Does the template include a reject-all mechanism?+
Yes. GDPR Article 7(3) and ePrivacy guidance require that withdrawing consent is as easy as giving it. The template describes both the acceptance and withdrawal flows and includes the preference-centre language.
Do I need separate cookie policies for the EU and India?+
A single, well-structured cookie policy is enough if the processing is identical. If you set different cookies in different regions (e.g. ad-tech in the US only), the template includes a regional annex pattern you can use to document the deltas.
What about GPC and 'Do Not Sell'?+
The CCPA/CPRA block describes the Global Privacy Control signal, how it's interpreted, and the user-facing Do Not Sell / Share link. If you don't operate in the US, delete the block.
How do I handle cookie categorisation disputes?+
The template includes a glossary tying each category to a legitimate processing purpose. If regulators or DPAs query a specific cookie's category, the glossary gives you the authority trail — PDPC advisory, EDPB guidelines or CPPA bulletins.
Do strictly necessary cookies need consent?+
No, under GDPR and ePrivacy, strictly necessary cookies (session, authentication, security) don't require consent — but they still need to be disclosed in the policy. The template keeps them clearly separated.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes