Get started
FreeTOS›Cookie Policy Generator

Cookie Policy Generator + Banner Code

Generate a GDPR-compliant cookie policy AND a ready-to-paste JavaScript consent banner for your website. Covers GA4, Meta Pixel, Hotjar, and more.

Includes Banner JS Code
Includes Banner JS Code
Instant Download
GDPR ePrivacy Compliant

Why Use FreeTOS for Your Cookie Policy?

Just instant, professional legal documents.

Policy + Banner in One

Uniquely, we generate both the written cookie policy AND a working JavaScript consent banner you can paste into your site: no other free tool does this.

Covers All Major Tools

Select GA4, Meta Pixel, Google Ads, Hotjar, or any combination. Our AI lists each cookie by name, category, provider, purpose, and expiry duration.

ePrivacy Directive Ready

Compliant with GDPR Article 5(3) and the EU ePrivacy Directive. Includes prior consent language, granular opt-in/opt-out, and withdrawal mechanism.

Frequently Asked Questions

Everything you need to know about Cookie Policies

Yes: under GDPR and the ePrivacy Directive, any website that uses non-essential cookies (analytics, advertising, functional) must disclose this in a cookie policy and obtain prior informed consent from EU users before setting those cookies.
GDPR requires: prior informed consent before setting non-essential cookies, a clear breakdown of each cookie's purpose and duration, easy withdrawal of consent at any time, and a publicly accessible cookie policy that lists all cookies used on your site.
Our generator provides ready-to-paste JavaScript banner code in addition to the policy document. Simply copy the script and paste it before the closing body tag of your website. No external service or monthly fee needed.
Essential cookies are strictly necessary for the website to function (login sessions, shopping carts, security) and do not require consent. Tracking cookies (analytics, advertising) collect behavioral data and require explicit prior consent under GDPR.
The ePrivacy Directive (2002/58/EC), commonly called the "Cookie Law", requires websites to obtain informed consent before storing cookies on a user's device. It works alongside GDPR and applies across the EU and EEA.

Further Reading

Go deeper on this topic with our guide.

Blog Post
Cookie Consent Laws Explained: Do You Need a Cookie Banner?
Do you actually need that annoying cookie popup? The answer depends on where your visitors are. Here's the full breakdown by jurisdiction.

Other Free Legal Generators

Privacy Policy Generator
GDPR & CCPA compliant privacy policies
GDPR Privacy Policy
Full EU GDPR compliance documentation
Terms of Service
Complete ToS for websites & apps
Data Processing Agreement
GDPR DPA for controllers & processors

Why a Cookie Policy Actually Matters

Cookie law is one of the most actively enforced areas of EU privacy regulation. And it's not just an EU problem anymore.

Cookies sound innocuous. Small text files. Hardly the stuff of regulatory drama. But the ePrivacy Directive, combined with GDPR, turned cookie compliance into one of the most litigated and enforced areas of EU data law. The UK's ICO, France's CNIL, Italy's Garante, and Germany's state authorities all actively investigate websites that set tracking cookies without proper consent.

The enforcement is real and it's getting stricter.

France's CNIL fined Google €150 million and Facebook €60 million in early 2022 specifically for making it harder to refuse cookies than to accept them. The ICO has issued formal enforcement notices to major publishers. Austria ruled that Google Analytics itself violates cookie law when data is sent to US servers. If regulators are going after Google and Facebook, smaller sites are definitely not invisible.

Here's what most website owners don't realize: using Google Analytics means you're setting cookies. Google Tag Manager means cookies. Facebook Pixel means cookies. Embedded YouTube videos mean cookies. Hotjar, Intercom, Drift, any chat widget: all cookies. Almost every third-party tool you add to your site drops at least one cookie, and most of those cookies are non-essential, which means they require explicit prior consent from EU users before being set.

Beyond the EU, cookie compliance is creeping into other jurisdictions. The UK PECR (Privacy and Electronic Communications Regulations) mirrors the ePrivacy Directive. California's CCPA effectively covers many cookie practices. Brazil's LGPD has similar requirements. Canada's PIPEDA requires meaningful consent for tracking. The global direction of travel is clearly toward stricter cookie consent, not looser.

And then there are the practical business consequences. Shopify can flag stores with non-compliant cookie practices. Google Ads and Facebook Ads both have policies requiring proper cookie disclosure on landing pages. Some payment processors include cookie compliance in their merchant requirements. A cookie policy isn't just a legal checkbox. It protects your revenue channels too.

Who Needs One

Any website using analytics, advertising, social sharing buttons, chat widgets, embedded media, or any other third-party script that sets cookies on visitor devices.

Without One

ICO, CNIL, or other EU regulator fines, blocked advertising accounts, Shopify payment processing issues, and private complaints from EU visitors who know their rights.

With a Good One

Full transparency about your tracking, documented consent process, compliant ad platform usage, and users who trust you because you're upfront about what you do.

What's Included in Your Generated Cookie Policy

A complete breakdown of every section the generator produces for you.

What Cookies Are (Plain Language)

A simple explanation of what cookies are and how they work, written for actual humans rather than lawyers. Users who understand cookies make more informed consent decisions.

Strictly Necessary Cookies

The cookies that keep your site running: login sessions, shopping carts, security tokens, and preferences. These don't need consent but still need to be disclosed.

Analytics Cookies

Google Analytics, Hotjar, Mixpanel, and similar tools. This section explains what data they collect, how long the cookies last, and how users can opt out.

Advertising and Retargeting Cookies

Facebook Pixel, Google Ads, and other ad network cookies. These require explicit consent under GDPR and the ePrivacy Directive before being set.

Third-Party Cookie List

A table or list of the specific third-party services that set cookies on your site, with links to their own privacy and cookie policies for full transparency.

How Users Can Control Cookies

Browser-by-browser instructions for managing or deleting cookies, plus links to opt-out tools like Google's opt-out extension, the NAI opt-out page, and YourOnlineChoices.

Consent Mechanism Explanation

Describes how your cookie consent banner works, what choices users have, how they can change their mind, and how long their consent preference is remembered.

Cookie Duration Table

How long each type of cookie persists, from session cookies that disappear when the browser closes to persistent cookies that last months or years.

Policy Update Process

How and when the cookie policy will be updated when new cookies are added, with guidance that users should check back periodically and reconsent if practices change materially.

More Cookie Policy Questions

The technical and legal questions that actually come up when you're setting this up

First-party cookies are set by your own domain. If someone is on yourwebsite.com and a cookie is set by yourwebsite.com, that's first-party. Third-party cookies are set by a different domain than the one the user is visiting. When you load Google Analytics, Google sets cookies from google-analytics.com. When you use Facebook Pixel, Meta sets cookies from facebook.com. Third-party cookies are the ones regulators and browsers are most concerned about, and most modern browsers are already blocking or phasing them out.
For EU visitors, yes. Google Analytics sets cookies that track individual users across sessions, which requires prior consent under the ePrivacy Directive and GDPR. Google Analytics 4 has a "consent mode" that lets it function with reduced data when consent isn't given, but you still need a banner to collect or record that consent decision. Several EU data protection authorities ruled in 2022 that standard Google Analytics use violates GDPR regardless of whether you have a banner, due to US data transfers. GA4 with consent mode and a proper DPA is the current best practice.
Strictly necessary cookies are only those without which the core functionality of the site breaks. This means: session cookies for maintaining login state, shopping cart cookies for e-commerce, security tokens like CSRF protection, load balancing cookies, and cookies that remember user consent choices. Analytics, advertising, personalization, and A/B testing cookies are not necessary. Neither are social media sharing buttons' cookies. The test is whether removing the cookie would prevent the user from using a core service they specifically requested.
There's no universal legal maximum, but regulators apply a proportionality test. A session cookie that expires when the browser closes is never questioned. Cookies lasting 13 months are a common upper limit many companies use for analytics to cover a full year of comparison data. The French CNIL recommends a maximum of 13 months. Google Analytics 4 uses a 13-month default. Advertising cookies lasting 2 years have been criticized by regulators as disproportionate. Whatever duration you use, it needs to be disclosed in your cookie policy.
No. They serve different purposes. A cookie policy specifically covers what cookies your site uses, why, and how users can control them. A privacy policy covers all personal data processing, including but not limited to cookies. GDPR requires both. Many websites combine them into one document, but they need to cover all the required disclosures. Our generator produces a standalone cookie policy, which is best practice for sites with significant cookie usage since it allows for easy updates without touching the main privacy policy every time you add a new tool.
In the short term, probably nothing. Regulators focus on larger sites first. But the enforcement environment is getting more aggressive. Privacy advocacy organizations like NOYB (Max Schrems' organization) file systematic complaints against non-compliant sites and have won repeatedly. ICO in the UK has an active cookie compliance team. And practically, ad platforms including Google are increasing requirements around cookie consent for advertising campaigns. Ignoring cookie law is a risk that gets less comfortable every year.
Not exactly, but close. GDPR and the ePrivacy Directive require consent to be specific. You can't just have one "accept all" and one "reject all." Best practice, and what regulators consider compliant, is offering granular consent by category: necessary (no consent needed), analytics, advertising, and functional or personalization. Users should be able to accept analytics cookies while rejecting advertising cookies, for example. Many consent management platforms handle this automatically. If your cookie banner only has "accept all" and no equal reject option, it almost certainly doesn't meet current standards.

FreeTOS vs Paid Cookie Tools

Some cookie compliance tools charge monthly fees that add up faster than the fines they protect you from at small scale.

Feature FreeTOS Cookiebot OneTrust
Price $19 a month $9/mo+ $23/mo+
Cookie Policy Document Yes Yes Yes
Consent Banner Script Yes Yes Yes
Automatic Cookie Scanning Manual Yes Yes
PDF Download Included Paid Paid
Consent Log Storage No Yes Yes

FreeTOS generates the policy document and banner code. For enterprise-grade consent logging and automatic cookie scanning, a paid CMP may be appropriate. For most small to medium sites, FreeTOS covers the essentials.

How to Add Your Cookie Policy to Your Website

The policy document, the banner script, and where everything needs to go.

WordPress

  1. Generate your cookie policy on FreeTOS
  2. Create a new WordPress page titled "Cookie Policy"
  3. Paste the HTML in the block editor's Custom HTML block or switch to the HTML editor
  4. Publish and add to your footer menu
  5. Copy the banner script from FreeTOS
  6. Paste it before the closing body tag using a plugin like Insert Headers and Footers
  7. Test that the banner appears for new visitors and that the cookie policy link works

Shopify

  1. In Shopify Admin, go to Online Store, then Pages
  2. Create a new page titled "Cookie Policy"
  3. Use the HTML editor to paste the policy content
  4. Add the page to your footer navigation
  5. For the banner script, go to Online Store, then Themes, then Edit Code
  6. Add the banner script to theme.liquid before the closing body tag
  7. Consider a Shopify cookie consent app for easier setup and GDPR compliance logging

Any HTML Website

  1. Download the cookie policy HTML file from FreeTOS
  2. Save it as cookie-policy.html and upload to your server
  3. Add a footer link on every page: Cookie Policy
  4. Copy the banner script and paste it before the closing body tag in your main layout
  5. The banner should block analytics and ad scripts from loading until consent is given
  6. Test in an incognito window to confirm the banner appears on first visit
Critical implementation note: A cookie policy alone is not enough for GDPR compliance. You also need to ensure non-essential cookies are not set until the user gives consent. This means your analytics and advertising scripts should only load after consent is recorded, not before. A banner that appears but doesn't actually block scripts is a "cookie wall" and doesn't meet GDPR standards. Our banner script handles the blocking automatically.

Further Reading

GDPR
Cookie Consent Law Explained: What Your Website Actually Needs
Cookie banners are everywhere and almost all of them are wrong. Here's what the law actually requires, which types of cookies need consent, and what a compliant banner looks like in practice.