Generate a cookie policy that tells visitors what cookies are, which categories you use, how long they last and how to refuse them — with the consent sections the GDPR, UK GDPR and CCPA expect.
In the EU, Article 5(3) of the ePrivacy Directive says you may store or read information on a visitor's device only if they have been given clear and comprehensive information and have consented — unless the cookie is strictly necessary for a service they asked for. The UK applies the same rule through regulation 6 of PECR. The cookie policy is where that clear and comprehensive information lives.
Consent itself has to meet the GDPR standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. The EU's highest court confirmed in the Planet49 case in 2019 that a pre-ticked box is not consent. Your policy should say what each category of cookie does so that a visitor's choice actually means something.
In California the emphasis is different. The CCPA lets consumers opt out of the sale or sharing of their personal information, which includes many advertising cookies, and requires businesses to treat a Global Privacy Control signal as a valid opt-out. A cookie policy for a US audience explains that right and how to use it.
A clear structure a visitor can actually read, with the jurisdiction-specific sections added when you select those regimes.
A plain explanation of cookies and similar technologies, written for visitors rather than engineers.
Necessary, preferences, analytics and marketing — what each is for, and which ones need consent.
How long cookies last, and how cookies set by third-party services differ from your own.
How visitors can change their choice at any time and control cookies in their browser.
Consent for non-essential cookies and the exemption for necessary ones under the GDPR and UK GDPR; the right to opt out of sale or sharing under the CCPA.
How you will announce updates to the policy and how visitors can ask you about it.
The cookie policy uses the same four consent categories as the MostlyPrivacy banner — necessary, preferences, analytics and marketing — so what the policy describes and what the banner asks for line up. Like every MostlyPrivacy document, each language version is generated from one set of answers, in up to ten of 36 languages.
Run the free cookie scanner first. It lists the cookies your server sets and the third-party services your pages load, classified into the same categories, so you know what the policy needs to cover before you publish it.
The generated policy explains categories and your visitors' choices; it does not yet embed a table of the specific cookies found on your site. Keep the scanner's inventory alongside it, and update the policy when you add a new tool. Published documents do not change by themselves — regenerate when something changes.
The templates are cited to the law but not lawyer-reviewed, and translations are machine-generated. A cookie policy is also only half of the job: you still need a banner that actually holds back non-essential scripts until consent. We recommend a lawyer's review if your site relies heavily on advertising technology.
A privacy policy covers all the personal data you handle. A cookie policy focuses on cookies and similar technologies on your site — what they do, how long they last and how visitors can refuse them. Many sites publish both and link them together.
Yes. The free plan includes one generated document, which can be your cookie policy, published at a hosted URL. Paid plans from $15 a month include every generator without a document limit.
Strictly necessary cookies do not need consent under the ePrivacy rules, but you are still expected to tell visitors what you store on their device. A short cookie policy is the usual way to do that.
Not yet. The policy explains each category and your visitors' rights. Use the free cookie scanner to see which cookies and third-party services your pages load, and keep that inventory with the policy.
It always covers the general information visitors need. When you select them, it adds sections for consent and exempt cookies under the GDPR and UK GDPR, and for the right to opt out of sale or sharing under the CCPA.
They must be able to. The policy explains how, and the MostlyPrivacy banner's JavaScript API lets you add a cookie-settings link that reopens it, so visitors can withdraw consent at any time.
No. The policy explains your cookies; you also need a consent banner that blocks non-essential scripts until a visitor agrees, and a record of the choices they make. MostlyPrivacy provides all three.
In 36 languages, up to ten per document. All versions come from the same answers; translations are machine-generated.
Weighing up other tools? Read our honest comparison: MostlyPrivacy vs iubenda
One site, the consent banner and one generated document — free, with no card. Upgrade when you need more sites or documents.