Cookie policy generator
A policy that
matches your cookies.
A cookie policy generator turns the list of cookies your site sets into a page that says what each one does, who sets it and how long it lasts. This one writes the policy from your list, checks it for gaps against what the ICO and Article 13 of the GDPR say, and never guesses which cookies you have.
It runs in your browser and nothing you type is sent to us. The wording is plain English and ours; it is a starting point, not legal advice. A policy only describes your cookies: whether you may set them without asking is a separate question, answered in do I need a cookie banner.
By the Builderify team
Your cookies
Add:
The example below lists 4 cookies. With JavaScript on, you can edit the list and the policy updates as you type.
- Clear Nothing is missing from what you entered. That is not the same as a complete list: check for cookies you have not listed.
-
- Clear Nothing is missing from what you entered. That is not the same as a complete list: check for cookies you have not listed.
Cookie policy for Maple & Pine
Last updated: 12 November 2026
Who this policy is from
This policy explains how Maple & Pine uses cookies on maplepine.example. If you have a question about it, write to privacy@maplepine.example.
What cookies are
Cookies are small text files that a website stores on your device when you visit it. Similar technologies, such as local storage, work in much the same way, and this policy covers them too.
How we use cookies
- Strictly necessary (2): These make the site work, for example by remembering what is in a basket or keeping a connection secure. Without them parts of the site would not work.
- Analytics (2): These tell us how the site is used, for example which pages are visited, so we can improve it.
Your consent
We ask for your permission before we set cookies that are not strictly necessary. Until you agree, we set only the strictly necessary ones.
The cookies we use
Strictly necessary
| Cookie | Set by | What it does | How long it lasts |
|---|---|---|---|
| __cf_bm | Cloudflare | Helps Cloudflare tell bots from people, to protect the site from automated traffic. | 30 minutes of inactivity |
| cart_id | Maple & Pine | Remembers what is in your basket. | Until you close the browser |
Analytics
| Cookie | Set by | What it does | How long it lasts |
|---|---|---|---|
| _ga | Tells one visitor from another, so repeat visits can be recognised. | 2 years | |
| _ga_<container-id> | Keeps the state of a visit (the session) for Google Analytics. | 2 years |
Your choices
You can change your choices at any time using the cookie settings on this site. If you withdraw your consent, that does not affect anything we did with it before you withdrew it.
You can also block or delete cookies in your browser settings. If you do, parts of this site may stop working.
Other companies
Some of these cookies are set by other companies: Google, Cloudflare. They handle what they collect under their own policies, and we do not control that.
Personal data
Some cookies may collect personal data. What we do with it, our legal basis, who receives it, how long we keep it and your rights, including the right to complain to a data protection authority, are in our privacy policy: https://maplepine.example/privacy.
Changes to this policy
If the cookies we use change, we will update this page and the date at the top. Where we need your permission again, we will ask for it.
The policy is only as complete as your list. What it can’t do.
What a cookie policy says
is simple. Making it true isn’t.
Neither the ICO nor the GDPR hands you a template. They list what people must be told. Everything the generator writes is built from that list and from the cookies you give it.
Tell people, and say why
The ICO says the UK rules on cookies sit in regulation 6 of PECR: tell people the cookies are there, explain what they are doing and why, and get consent to store them. PECR does not set out exactly what information to give or how; it has to be “clear and comprehensive” about your purposes, clear and easy to find.
Read 11 Nov 2026: Cookies and similar technologies (Guide to PECR)
List the cookies one by one
The ICO’s audit checklist asks you to confirm each cookie’s purpose, whether it lasts for a session or longer, whether it is first or third party, how long it lasts, and which are strictly necessary. The generator’s table has the name, who sets it, what it does and how long it lasts, grouped by category. It does not ask first or third party, because the “Set by” column already names the company.
Read 11 Nov 2026: Cookies and similar technologies (Guide to PECR)
Point to the personal-data details
Where cookies collect personal data, Article 13 of the GDPR lists what to tell people: who the controller is, the purposes and legal basis, the recipients, how long data is kept, the rights people have, the right to withdraw consent and the right to complain. A cookie policy rarely carries all that, so the generated one points to your privacy policy.
Read 11 Nov 2026: Art. 13 GDPR: information to be provided (gdpr-info.eu, a reproduction of the Regulation)
First, that information about cookies alone does not show consent: you cannot show consent if the information sits in a privacy policy that is hard to find, difficult to understand or rarely read, and you cannot set non-essential cookies on the homepage before the user has consented. A policy is the “tell people” half, a banner is the “ask” half. Second, that the page is based on the previous version of the ICO’s detailed cookies guidance, and that the ICO is consulting on a revised version, so the wording of its advice may change.
Read 11 Nov 2026: Cookies and similar technologies (Guide to PECR)
Nine checks,
each with its reason.
A fix is something the policy cannot be published without. A check is something to look at before you do.
| Check | Level | Why | Source |
|---|---|---|---|
| Your business name is missing | fix | The policy has to say who it is from. Article 13 of the GDPR starts its list of what to tell people with the identity and contact details of the controller. | GDPR text |
| Your website address is missing | fix | Say which site the policy covers, so a reader knows it is about the page they are on. | Ours |
| There is no contact address | fix | Give people a way to ask about the policy. Article 13 of the GDPR also asks for the controller's contact details. | GDPR text |
| A cookie has no purpose | fix | The ICO says you must explain what the cookies are doing and why, in clear and comprehensive terms. Write one plain sentence for each of these | ICO |
| Non-essential cookies are set without asking | fix | For the UK, the ICO says you must get consent, and that you cannot set non-essential cookies before the user has consented. The policy describes what you told this form, but the fix is in your set-up, not in the wording. If your visitors are in the EU, check your national data protection authority’s guidance: this page does not quote EU cookie law. Affected | ICO |
| No cookies are listed | check | The policy now says the site uses no cookies or similar technologies. Only publish that after you have looked at the cookie panel in your browser's developer tools on every kind of page, before and after clicking accept. The ICO's audit checklist starts with knowing which cookies your service uses. | ICO |
| A cookie has no lifetime | check | The ICO's audit checklist asks you to establish how long your cookies last. Your browser's cookie panel shows it as the expiry date or Max-Age. The policy says “Not stated” for these until you add it | ICO |
| Visitors can only change their mind in their browser | check | The ICO says users should have the means to enable or disable non-essential cookies, and that you should make this easy to do. Browser settings are the only route you chose. | ICO |
| There is no privacy policy address | check | A cookie policy covers the cookies. Article 13 of the GDPR also lists the legal basis, the recipients, how long data is kept, the rights people have and the right to complain, and those usually live in a privacy policy. The policy has a placeholder where its address goes. | GDPR text |
The EU or UK setting controls three of these (non-essential cookies without asking, no way to change a choice on the site, no privacy policy address) and the personal-data section of the policy. Choosing “Somewhere else” turns them off rather than applying another country’s law, because this page does not cover any.
Three services,
and what their own pages say.
The presets save typing for three common services. Each row comes from the service’s own cookie page, opened on 11 November 2026. Where that page gives no lifetime, the preset leaves it empty and the check asks you for it.
| Preset | Adds | The page states | Not in the preset |
|---|---|---|---|
| Google Analytics 4 |
_ga, _ga_<container-id> |
First-party cookies; both last 2 years by default, one to distinguish users and one to persist session state. You can override the expiry in the tag settings, from immediately to 25 months. | Google says a tag linked to a Google Ads account sets additional cookies, which are not in the table. If your site is, add them by hand. |
| Cloudflare bot protection Cloudflare |
__cf_bm, cf_clearance |
__cf_bm is set on sites using Bot Management or Bot Fight Mode and expires after 30 minutes of continuous inactivity. cf_clearance stores proof that a challenge was passed; no lifetime is given. Cloudflare calls its listed cookies strictly necessary to provide the services its customers requested, and encourages customers to tell their visitors about them. |
The other Cloudflare cookies (load balancing, waiting room, rate limiting, Access). Add one only if your set-up uses that product. |
| Microsoft Clarity Microsoft |
_clck, _clsk |
Both first-party. _clck persists the Clarity user ID and preferences; _clsk connects page views into one session recording. Microsoft says Clarity’s typical use sets non-essential cookies, and that it enforces consent signals for visits from the EEA, the UK and Switzerland. No lifetimes are given. |
The page also lists five third-party cookies (CLID, ANONCHK, MR, MUID, SM). Add them if they show up in your browser. |
Other common services, such as Meta, Hotjar and Stripe, are not preset because on 11 November I could not open a vendor page that gives their cookie names and lifetimes. Add them by hand from what your browser shows. The preset categories are the vendors’ own descriptions where they give one; whether a cookie really is strictly necessary for your visitors is your decision, and the ICO notes that cookies that are only essential for your own purposes still need consent.
How to find the cookies
your site really sets.
The list is the part no generator can do for you, and it is where most policies go wrong. This is our method, and it takes about twenty minutes.
Start from nothing
Open the site in a private window, so no old cookies are there. Open your browser’s developer tools and find the panel that lists cookies and local storage. Visit a page of each kind (home, a product or service, a blog post with an embed, checkout or a form) and write down what appears before you click anything on the banner.
Accept, then look again
Accept everything, reload and visit the same pages. What is new is what your banner is holding back. Then refuse everything in a fresh window and check that nothing from that list appears. A policy that says “we ask first” is only true if that second test passes.
Fill in each row
For each cookie: its name, the company behind it, one plain sentence on what it does, how long it lasts, and the category. The vendor’s own cookie page is the best source for the sentence. Do it again whenever you add a tag, a widget or an embed.
The Cookie Consent module has a cookie scanner that costs 0 credits, and it recognises 117 well-known cookies with their provider, purpose and lifetime. Its Cookie Policy link goes into the banner with one click. Its own page is honest about the limit: the scanner sees the cookies that page scripts can read, so HttpOnly and third-party cookies have to be added by hand. The generator above is free to use with or without it. See pricing.
Product facts from the Cookie Consent page, read 11 Nov 2026. On a site builder? See the guides for Squarespace, Wix and Shopify.
A policy describes.
It doesn’t comply for you.
Better you read the limits here than find them out later. This page is general information, not legal advice.
It writes about the cookies you list and no others. A cookie you forgot is a sentence your policy gets wrong. Run the test in section 04 on the live site, not in your head.
A policy tells people. A banner asks them, and has to stop the non-essential cookies until they answer: the ICO is explicit that you cannot set them first. Adding a cookie banner covers that half.
The consent and personal-data wording follows the ICO’s guidance and Article 13 of the GDPR. It does not cover US state laws or the rules of any other country, and it is in English only. If your visitors are elsewhere, have a lawyer or your regulator’s guidance check what it should say.
The category descriptions and the sentences around the table are plain English we wrote, not a legal text from anyone. Read every line and change what is not true of your site before you publish it.
The policy is true on the day you write it. A new tag, a new embed or a vendor changing a lifetime makes it wrong, and the date at the top is a promise that you checked.
Cookie policies, before you ask.
In the UK, the ICO says the rules in regulation 6 of PECR require you to tell people about the cookies you set, explain what they do and why, and get consent to store them, with an exception for cookies that are strictly necessary for a service the user asked for. PECR does not say exactly what the information must contain, only that it must be clear and comprehensive about your purposes. Other countries have different rules, which this page does not cover; ask a lawyer or your regulator.
No. A policy is the "tell people" half. The ICO says you cannot show consent if the information sits in a privacy policy that is hard to find or rarely read, and that you cannot set non-essential cookies on your homepage before the user has consented. That takes a banner that holds the cookies back, and a list that matches what your site really sets.
For each cookie: its name, the company that sets it, what it is for, how long it lasts and whether it is strictly necessary. The ICO's audit checklist asks you to confirm the purpose, whether it is a session or persistent cookie, whether it is first or third party, how long it lasts and whether it needs consent. The generator's table covers the name, who sets it, what it does and how long it lasts, grouped by category.
Open the site in a private window and look at the cookie panel in your browser's developer tools, on each kind of page, before and after you accept the banner. Then refuse everything in a fresh window and check that the non-essential ones do not appear. A scanner helps, but it only sees cookies that page scripts can read, so cookies marked HttpOnly and some third-party cookies have to be added by hand.
No. The policy is built in your browser and nothing you enter is sent to our servers. The three presets (Google Analytics 4, Cloudflare bot protection and Microsoft Clarity) come from each company's own cookie page, read on 11 November 2026, and where a page gives no lifetime the preset leaves it blank for you to fill in.
Sources
Every page above was opened on 11 November 2026. The ICO page says it is based on the previous version of its detailed cookies guidance. The GDPR text is a reproduction on gdpr-info.eu, not the Official Journal. The policy wording, the category descriptions and the checks are ours. ← All free tools
More on cookies and privacy
All privacy guides- Do I Need a Cookie Banner? EU, UK and US Rules Do you need a cookie banner? What the EU, UK and US require, which cookies need a yes, and a six-question checker for your own site.
- How to Add a Cookie Banner to Your Website (2026) How to add a cookie banner to your website on Squarespace, Wix, Shopify, Webflow or WordPress: what the built-in banner holds, and how to make tags wait.
- GDPR Compliant Website Checklist, EU and UK A GDPR compliant website checklist for small businesses: cookies, privacy notice, processors, transfers, rights and breaches, plus a checker for your site.
- Meta Pixel Cookie Consent: Hold It Until a Yes Meta Pixel cookie consent from Meta's own docs, plus TikTok and Microsoft UET, and a checker that finds pixels firing before consent and gates them.
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.