PRACTICAL UK GUIDE · REVIEWED 1 OCTOBER 2026
How to prepare a cookie policy for a UK website
A useful cookie policy describes what your website actually uses. Start with a verified inventory, explain the purposes clearly, and check that visitors can find and use their choice controls.
By John Cookie. Practical website guidance, not legal advice or compliance certification.
What information should you gather?
The ICO’s current guidance generally calls for clear information about the technologies you use, their purposes, relevant third parties and duration. Personal-data transparency requirements can still apply when a PECR exception is used. The detail depends on the website and its uses.
Record relevant cookies and other storage or access technologies. Depending on your implementation, this may include local storage, session storage, tracking pixels, embedded services and scripts or tags that store or access information on a visitor’s device.
| Detail | What to confirm |
|---|---|
| Name and type | The actual cookie identifier, storage item or technology in your setup. |
| Provider and scope | Who provides it and the domain, origin or storage scope involved. |
| Specific purpose | What it does on your website, rather than a generic description of the vendor. |
| Duration | The configured duration or retention behaviour. Check it rather than guessing a default. |
| Consent or exception approach | Which uses require consent, or the assessed basis and conditions for any exception. |
| Visitor-choice route | How people accept, reject, change choices or use a relevant objection route. |
How to build the inventory
- List the tools you have enabled. Review your platform, plugins, apps, consent platform, tag manager and embeds with the people responsible for them.
- Test representative journeys. Look beyond the homepage. Include relevant checkout, forms, embedded video and other pages where technologies may differ.
- Record the consent states. Compare storage and network activity before a choice, after rejection and after acceptance. Check withdrawal or preference changes too.
- Confirm the details. Use configuration settings, browser evidence and provider information to resolve names, purposes and duration.
- Keep a dated record. Note the pages, tools, settings, consent states and observation date used for the review.
Cookie policy, banner and privacy policy: different jobs
The cookie policy explains the technologies and their use. The banner or preference controls let visitors make the relevant choices. The privacy policy explains applicable personal-data processing. Check that the information and controls are consistent; publishing a policy does not configure consent or block scripts.
Using the policy generator
Our free UK cookie policy generator turns your confirmed details into an editable draft and declaration. It does not inspect your website or decide whether an exception applies. Enter the facts, choose the actual consent approach and review the output before using it.
You can copy the policy text, download an HTML draft or export the declaration as CSV. The generator processes its form answers in your browser and does not require an account. Keep your own copy of the inventory and review evidence.
Check these points before publishing
- The listed technologies and purposes match the current website.
- Providers and duration are specific and verified.
- Any claimed exception has been assessed against its conditions; a category label alone does not decide this.
- The choice route works and matches the policy wording.
- The policy is easy to find from relevant consent controls and website navigation.
- The wording is clear on mobile and does not contain unused template text.
- The review date and contact route are accurate.
When should you review the policy?
Review it when the website, purposes or technologies change. Common triggers include adding advertising pixels, changing analytics settings, replacing a consent platform, introducing embeds or changing checkout apps. Schedule a review appropriate to how often your website changes.
Does your policy still match your website?
A practical review can identify unclear information, outdated references and questions for your developer, marketing team or privacy adviser.
Common questions
Can I copy another website’s cookie policy?
Another website’s tools, settings and purposes may be different. Use your own verified inventory and visitor-choice route instead of assuming copied wording reflects your setup.
Does a policy make my website compliant?
No. Information is one part of the picture. You also need to assess the relevant rules and verify the actual storage, access and choice behaviour. A policy does not substitute for that work.
Does “analytics” always mean the same consent approach?
No. Assess the purpose, configuration, data use and applicable conditions. Do not infer that a technology requires consent or qualifies for an exception solely from its product name or category.
Sources: ICO: How to comply with the PECR rules; ICO: Storage and access technologies. For related checks, see the free checklist and guides hub.