Skip to content

Question 1 of 10

01The basics

What is the business called?

The party responsible for the cookies the site sets.

Enter to continue

What this generator asks, and what it writes

Ten questions produce a document of 10 sections. Answers change the wording, not just the blanks, so two sites with different obligations get different policies.

The questions

  1. What is the business called?

    The party responsible for the cookies the site sets.

  2. What is the website address?

    Cookies are scoped to a domain, so one policy covers one domain.

  3. How should people reach you about cookies?

    Consent has to be withdrawable, which needs a route that works.

    Choices: Email address, Contact form on the site, Mailing address, Email and mailing address.

  4. What is the address?

    Printed in the contact section exactly as written.

  5. What does the site set beyond the strictly necessary cookies?

    Strictly necessary cookies are always covered, so they are not listed here.

    Choices: Preferences and functionality, Analytics and performance, Advertising and targeting, Nothing, only the strictly necessary ones.

  6. Which third party services run on the site?

    Each one is named in the policy, because a visitor cannot consent to something unnamed.

    Choices: Google Analytics, Meta Pixel, Google Ads conversion tracking, A privacy-first analytics tool, Embedded video from YouTube or Vimeo, None of these.

  7. Does the site show a consent banner?

    Where consent is required, it has to be collected before anything optional is set.

    Choices: No consent banner, A banner with accept and reject, A banner with a choice per category.

  8. How long do the cookies last?

    Lifetimes belong in the policy. Vague duration is a common audit finding.

    Choices: Session only, cleared when the browser closes, Up to 30 days, Up to 12 months, It varies by cookie.

  9. Where are your visitors?

    The EU and UK require consent before setting. Most of the US does not.

    Choices: United States, California, European Union or UK, Canada.

  10. When does this take effect?

    Usually the day you publish it.

The sections it writes

  1. What cookies are

    Explains cookies in plain terms and extends the policy to equivalent technologies.

  2. Who sets them

    Separates first party cookies from those set by services running on the site.

  3. Strictly necessary cookies

    Covers the cookies that may be set without consent and says why.

  4. Optional categories

    Describes each optional category the site uses and what it is for.

  5. Third party services

    Names each service by name, since consent to something unnamed is not consent.

  6. How long they last

    States cookie lifetimes, which vague policies routinely omit.

  7. Your consent

    Explains how consent is asked for, if at all, and how it is withdrawn.

  8. Regional rules

    Adds the consent rules that apply where the visitors actually are.

  9. Managing cookies yourself

    Points to browser controls and declines to overclaim about do not track.

  10. Changes and contact

    Fixes the effective date and gives the route for questions.