A cookie policy is at the heart of compliance with most major data privacy legislations in the world – while some laws require end-user consent and others opt-out options for visitors, almost all require your website to keep an updated account of all cookies and trackers, and to make this available to end-users visiting your domain.
Data privacy is also one of the fastest expanding fields of consumer demand – end-users want transparency into and control of how their data is handled when visiting your website, and consumers are increasingly ready to do business elsewhere if their data privacy is disrespected.
In this blogpost, learn more about building trust with your end-users through transparent and compliant use of cookies, and get an automatic cookie policy generated for your website with Cookiebot consent management platform (CMP).
In short, what is a cookie policy?
Why is a cookie policy required? What should a cookie policy contain?
A cookie policy is a list of all the cookies in use on your website with detailed information about each tracker made available for end-users to provide them with insights into how their personal data is being processed when visiting your domain.
Think of your website’s cookie policy as a map of all the tracking technologies that make up your domain’s data processing structure, which would otherwise be operating out of sight for visitors.
As a key part of being compliant with most major data privacy legislations in the world (including the EU’s GDPR, California’s CCPA/CPRA, Brazil’s LGPD and South Africa’s POPIA), your website’s cookie policy must always be up to date and should answer the following questions –
- What types/categories of cookies are set?
- What categories of personal data is processed by the cookies?
- What are the purposes of each cookie on your website?
- How long do the cookies stay on end-user browsers?
- Where in the world is end-user data sent to and what third parties is it shared with?
- How can end-users choose whether to allow cookies to process their data or not, and how can they later check or change their consent state?
In a 2021 analysis by Gartner, it is predicted that 75% of the world will be covered by different data privacy legislations that include end-user consent by 2023.
This means that – much like ingredients lists on food packaging – a cookie policy is poised to become a common legal requirement for most websites in the world, according to which you must inform users of exactly what they can expect from your website when it comes to cookies and processing of personal data.
And much like sustainability and organic labels on packaging, data privacy is becoming a key influence guiding consumer behavior too – with 79% of consumers saying that it is a buying factor for them, according to a 2021 study by Cisco.
In short, a cookie policy on your website is both legally required in most parts of the world and a vital part of building long-lasting, trustful customer relations for any online business today.
Privacy policy vs cookie policy
The difference between a privacy policy and a cookie policy is that a privacy policy includes all the different ways your website and/or business might be collecting, processing, and storing data from users – both offline and online, whereas a cookie policy is specifically about the tracking technologies embedded on your website that process personal data from end-users.
That’s why websites often include a cookie policy in their privacy policy, as a subsection detailing one of the ways in which the business is processing data.
However, another major difference between the privacy policy and the cookie policy is the fact that your cookie policy needs to be regularly updated because cookies on your website are dynamic and often change upon repeated visits.
In fact, 18% of cookies on any average website are “trojan horse” trackers that are loaded in secret within other cookies, and
50% of these trojan trackers will have changed to new trackers from different providers when the end-user returns on a repeated visit.
In other words, your website’s cookie policy – which is legally obligated to always be up to date – needs to be changed often and should be based on information from a deep-scanning technology like Cookiebot CMP, capable of shedding light on all cookies and trackers present, even the ones in hiding.
Get an automated cookie policy with Cookiebot CMP
Cookiebot CMP is a leading solution on the e-privacy market for providing end-users with transparency and control when it comes to cookies on your website.
After signing up to Cookiebot CMP, your website will be scanned automatically every month (or more frequently if desired) and all cookies will be detected and controlled according to the specific data privacy requirements in your end-users’ locations – whether that be prior consent in Europe, opt-out in California or different compliance requirements from global data privacy laws like Brazil’s LGPD, South Africa’s POPIA and many others.
Cookiebot CMP also generates an automatic cookie policy for your website that is exhaustive and complete, providing end-users with full transparency and control. Simply install it in your privacy policy or as a standalone subpage that is easy to find for your end-users, ensuring data privacy compliance and trustful customer relations at the same time.
Cookiebot CMP is a plug-and-play consent management platform built around an unrivaled scanning technology that finds 68% more cookies than any competitor and is used by small websites, enterprise clients and investigative journalists alike, and offers your website full compliance with all major data privacy laws in the world today.
Your website’s cookie policy, in detail
How to get a compliant cookie policy on your website
The best way to make sure that your website’s cookie policy is fully compliant with all major data privacy laws in the world is to sign up to Cookiebot CMP and have its unrivaled scanning technology detect and control all cookies and trackers on your domain.
A closer look at your website’s cookie policy, which must be detailed and always up to date.
But even though Cookiebot CMP can automate the entire cookie policy process for you, it’s good to know what is legally required of you when using cookies and processing personal data from users on your domain.
Regardless of whether you have a small food blog or an enterprise-size business website, the legal requirements are the same – so, what does a website cookie policy need to consist of to be compliant with data privacy legislations and respect end-user data privacy?
Your website’s cookie policy, a quick how-to guide
Here’s a quick guide on how to make sure that your website’s cookie policy is complete and compliant.
It is not intended as legal guidance, but rather as a quick overview of the most common requirements for your website – that you can automate by signing up to Cookiebot CMP, bringing you industry-leading scanning technology to your domain with just a few lines of JavaScript.
1) What your website’s cookie policy should contain
Your website’s cookie policy must contain the following information –
The different types and categories of cookies in use,
The duration of each cookie and tracker (how long they remain active on end-user browsers)
The categories of personal data/information that each cookie collects and processes
The purpose of each cookie (whether it’s for necessary functionality, statistics, marketing, etc.)
The third parties that each cookie share personal data with
The countries/regions that each cookie sends personal data to,
Information about how end-users can give their consent to your website’s cookies, i.e. how they can accept or reject cookies, and how they can check and change their consent status.
Cookies and trackers are fundamental to the make-up of most modern websites – they help your domain with its most basic functions, enable statistics and analytics about its performance and make advertisement and social media outreach possible.
Cookies come in four categories:
Necessary cookies
Preference cookies
Statistics cookies
Marketing cookies
Necessary cookies are usually benign and exempt from data privacy requirements, while marketing cookies often process personal data from your end-users and share it with third parties all over the world (requiring consent under the EU’s GDPR and opt-out options under California’s CCPA).
However, all cookies must be documented clearly in your website’s cookie policy, regardless of type and category.
2) How to update your website’s cookie policy
Your cookie policy must always be up to date and, since cookies and trackers are dynamic (meaning that they often change upon repeated visits by users), you need to scan your website regularly to detect any new cookies and trackers that might have changed since last time you published a cookie policy on your website.
Making sure that your cookie policy is always up to date by listing the exact tracking technologies in operation on your domain, though, is a legal requirement that can be difficult to live up to, especially considering that –
72% of cookies on websites are loaded in secret by other-third party cookies,18% of cookies on websites are “trojan horses”, i.e. cookies that hide as deep as within eight other cookies, loading each other without your knowledge,
50% of trojan horses will change on repeated visits by users to your website.
Source: Beyond the Front Page, a 2020 research paper on website cookies.
Using Cookiebot CMP as your website’s compliance solution and cookie policy tool means that you’ll find 68% more cookies than with any competitor cookie scanner on the market today.
Once your website’s cookie policy is complete and up to date, users must be able to easily find it – you can choose to feature it on its own subpage or integrate it as part of the broader privacy policy of your website.
3) Regional cookie policy requirements for your website
Though most cookie policy requirements are the same across all major data privacy laws, some obligations remain specific to countries and regions in the world.
For the EU’s General Data Protection Regulation (GDPR), this includes informing end-users about where and how they can make a choice of consent to all the non-necessary cookies in use on your domain.
If you have users from inside the EU, you are legally required to first obtain their explicit consent before you activate any cookies that process personal data (except the cookies that are strictly necessary for the basic function of your website).
This is usually done through a consent banner that presents end-users with a clear overview of all cookies in use on your website and provides them with an easy choice of saying yes or no to cookies.
Learn more about the EU’s GDPR and cookies
See the EU Commission’s own cookie policies
Get an automatic cookie policy from Cookiebot CMP
Cookiebot CMP automatically manages different data privacy laws relevant to each of your website’s end-users.
For California’s CCPA/CPRA data privacy regime, it includes informing your end-users about where on your website they will be able to opt out of having their personal information shared or sold to third parties through cookies and trackers.
If you have users from California, you might be legally required to have a link or button on your website titled Do Not Sell My Personal Information through which visitors to your website can opt-out of having their personal information sold to third-party data brokers.
Learn more about California’s CCPA/CPRA and cookies
Cookie policy, a summary
The most core and common requirement across most data privacy laws in the world is the cookie policy – a legal and technical list documenting all tracking technologies in use on your website.
With an expansion of data privacy legislations across the world and an increasing consumer demand for transparency and control of personal data processing, your website can’t afford to ignore its cookie policy.
Your website’s cookie policy must be exhaustive, detailed and always kept up to date – using a plug-and-play solution like Cookiebot CMP can automate this entire process for you.
Sign up to Cookiebot CMP for free today and build stronger data privacy trust with your end-users.
FAQ
A cookie policy is a list of all the cookies and trackers in use on your website, made available to visitors as part of your website’s broader privacy policy or as a separate subpage.
A common requirement in most of the world’s data privacy legislations is for a cookie policy to include details about what kinds of data are processed, their duration on users’ browsers, their provider and purpose of use, as well as where in the world data is sent to and with whom it is shared.
A cookie policy is required by most data privacy legislations in the world, just as the EU’s GDPR, California’s CCPA/CPRA, Brazil’s LGPD, South Africa’s POPIA, but also in New Zealand, Australia and many other regions and countries of the world.
Cookiebot CMP scans your website monthly (or more frequently if desired) and always presents you with the most up-to-date cookie policy, automatically generated by an unrivaled scanning technology to ensure transparency for your end-users and full compliance with the world’s major data privacy laws.
The main difference between a cookie policy and a privacy policy is that a privacy policy deals with all aspects of the privacy of users/customers, e.g. mailing lists, log-in details, phone numbers, etc. A cookie policy, instead, focuses specifically on a website’s use of cookies and the processing of data that these cookies are engaged in. If you already have a privacy policy, a cookie policy can be included as a subsection in it.
You must list all cookies and trackers in use on your website, including technical details, providers, purpose, duration on end-user browsers, and what third parties data is shared with. You are required to always keep your website’s cookie policy up to date. You must also inform end-users from inside the EU of how they can give and withdraw their consent to the cookies in use on your domain.
You must list all cookies and trackers in use on your website, including technical details, providers, purpose, duration on end-user browsers, and which third parties data is shared with or sold to. You are required to always keep your website’s cookie policy up to date. You must also inform end-users from California of how they can give opt out of having their personal information sold.