If your website sets any cookies beyond strictly necessary ones (analytics, advertising, embedded videos, or social widgets), you need a cookie policy. No law demands a document literally titled "cookie policy," but disclosing your cookie use is a legal obligation across the EU, UK, and most regions. The answer depends on the cookies you set and where your visitors are.
Below: requirements by region, when you don't need one, how the documents differ, and what happens if you skip it.
Do I Need a Cookie Policy? The Short Answer
Yes, if your site sets non-essential cookies. The UK's ICO states it plainly.
"Visitors to your website need to be told that cookies are being used, and what they do."
For any cookie that is not strictly necessary, the ICO adds that you also need the user's agreement to use it.
Here is the self-qualification test at a glance.
| You need a cookie policy if... | You probably don't if... |
|---|---|
| You run Google Analytics or any analytics tool | Your site sets only session or login cookies |
| You embed YouTube, Google Maps, or social widgets | You run no analytics, no ads, no third-party embeds |
| You use advertising or marketing pixels | You have no chat widgets, A/B tools, or tracking scripts |
| You have any EU, UK, or EEA visitors | Your site is a truly static page with no third-party tools |
| You are subject to CCPA/CPRA or a US state law | You do not meet any CCPA business threshold |
| You run an e-commerce store | (Practically speaking, no e-commerce site qualifies) |
Why a Cookie Policy Is Usually Required (Even Where No Law Names It)
Most privacy laws do not mandate a document titled "cookie policy." What they mandate is disclosure. You must tell users which cookies you use and explain what they do. In most jurisdictions, you must also get consent or offer an opt-out before non-essential cookies load.
A cookie policy is how you satisfy that disclosure duty in practice.
Two legal instruments drive the requirement across most of the world.
- GDPR (Regulation 2016/679): treats cookie identifiers as personal data (Recital 30) and requires transparency on personal-data processing.
- ePrivacy Directive ("the cookie law," Directive 2002/58/EC, amended 2009): the instrument that specifically requires consent before storing or accessing non-essential information on a user's device.
The ICO's PECR guide sets the basic rule. You must tell people if you set cookies, explain what those cookies do and why, and get the user's consent.
For the full breakdown of what a cookie policy is and what it must contain, see the dedicated explainer.
Do You Need a Cookie Policy in Your Region?
The answer shifts based on where you operate and where your visitors are. Which data privacy laws apply turns on both.
European Union and EEA (GDPR + ePrivacy Directive)
Yes, required. Any site setting non-essential cookies for EU or EEA visitors must disclose those cookies and obtain opt-in consent before they load.
The governing law is GDPR combined with the ePrivacy Directive. The EU follows a strict opt-in model: analytics, advertising, and embedded-media cookies cannot fire until the user actively accepts. Pre-ticked boxes and implied consent through continued browsing do not meet EU standards. The European Commission's own cookie policy demonstrates the model in practice.
"Every time you visit the Commission's websites, you will be prompted to accept or refuse cookies."
The difference between opt-in versus opt-out consent determines how your banner must behave for each region.
United Kingdom (UK GDPR + PECR)
Yes, required. The UK applies the same trigger as the EU: non-essential cookies require disclosure and opt-in consent.
The governing law is PECR (Privacy and Electronic Communications Regulations) plus UK GDPR. PECR Regulation 6 sets the basic rule. The ICO confirms: "Do I need a cookie warning notice on my website? Yes." The Data (Use and Access) Act 2026 received Royal Assent on 19 June 2026. All provisions affecting data protection law and PECR are now in force. The Act raised the PECR fine ceiling from 500,000 pounds to the UK GDPR maximum. Cookie breaches now carry far higher financial risk.
United States (CCPA/CPRA and State Laws)
Likely yes, even without a federal mandate. The US has no single federal cookie law. A cookie policy is still necessary for most commercial sites.
California's CCPA/CPRA requires businesses to disclose what personal information they collect. Cookies routinely enable that collection. Businesses must also offer an opt-out of the sale or sharing of that information. The CPRA, in force since January 1, 2023, added "sharing" alongside "selling," closing the loop on behavioral advertising. Businesses subject to CPRA must honor Global Privacy Control (GPC) signals as opt-out requests.
CCPA applies to businesses meeting any one of three thresholds.
- Annual gross revenues over $25 million
- Buy, sell, or receive personal information of 100,000 or more consumers or households per year
- Derive 50% or more of annual revenues from selling consumers' personal information
Additional states have followed: Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and Texas have each enacted comprehensive state privacy laws. The patchwork is widening.
A common belief in developer communities is that the US has no cookie law, so US sites are fine. That misses two points. First, state laws create disclosure and opt-out duties even without a federal statute. Second, a US site with EU or UK visitors is in scope under GDPR and PECR regardless of where the business is incorporated.
The FTC defines cookies as information saved by the browser. It does not establish a federal cookie law. It enforces against deceptive privacy practices under Section 5 of the FTC Act.
The California OAG's CCPA guidance confirms the disclosure and opt-out obligations for covered businesses.
Canada (PIPEDA and Quebec Law 25)
Effectively yes where cookies collect personal information. Canada's federal law is PIPEDA (Personal Information Protection and Electronic Documents Act). It requires meaningful consent for personal-data collection. Implied consent is acceptable for low-risk cookies at the federal level, but behavioral advertising cookies require an opt-out that takes effect immediately.
Quebec's Law 25 came into force in September 2023. It is stricter than PIPEDA: opt-in consent is required for non-necessary cookies for Quebec visitors, aligning Quebec more closely with the EU model.
Australia (Privacy Act 1988)
Transparency required; no blanket opt-in mandate. Australia's Privacy Act 1988 focuses on disclosure rather than prior consent. Under the Australian Privacy Principles (APPs), businesses must explain how they collect and use personal information, including through cookies and tracking technologies. A cookie policy (or a dedicated section in your privacy policy) is the standard way to meet this transparency obligation.
Australia does not require GDPR-style opt-in consent for cookies at the federal level. Privacy reforms are pending and may tighten online tracking rules.
Brazil (LGPD)
Generally yes where cookies process personal data. Brazil's LGPD (Lei Geral de Proteção de Dados) requires a legal basis for processing personal data. Cookies that collect identifiers, behavior data, or other personal information fall under the LGPD's scope. Non-necessary cookies (analytics, advertising) require consent before loading. Sites serving Brazilian users should inform users of the cookies used, state the purpose and legal basis, and obtain consent for tracking cookies.
Region-by-Region Summary
This table compresses the rules above into one view. Match your visitors' location to the governing law and consent model.
| Region | Governing law | Consent model | Cookie policy needed? |
|---|---|---|---|
| EU / EEA | GDPR + ePrivacy Directive | Opt-in (active, unambiguous) | Yes |
| United Kingdom | PECR + UK GDPR | Opt-in | Yes |
| United States (federal) | State laws (CCPA/CPRA, etc.) | Opt-out | Yes (most commercial sites) |
| California | CCPA / CPRA | Opt-out + GPC | Yes (if thresholds met) |
| Canada (federal) | PIPEDA | Implied consent acceptable (low risk) | Yes |
| Quebec | Law 25 | Opt-in | Yes |
| Australia | Privacy Act 1988 | Transparency (no blanket opt-in) | Yes (disclosure required) |
| Brazil | LGPD | Opt-in for non-necessary | Yes |
When You Don't Need a Cookie Policy
You can skip a cookie policy only if your site sets nothing beyond strictly necessary cookies.
The specific exclusion conditions are narrow:
- Your site uses only session cookies, login cookies, security cookies, load-balancing cookies, or shopping-cart cookies
- You run zero analytics tools (no Google Analytics, no Matomo, no equivalent)
- You have no advertising or marketing pixels, no embedded YouTube or Maps iframes, no social plugins, no chat widgets
- You are not otherwise covered by a disclosure-triggering law for your visitors
- Your site does not meet any CCPA/CPRA business threshold and has no EU or UK visitors
Even then, the ICO notes it is still good practice to inform users about essential cookies. A short disclosure costs nothing and removes ambiguity.
PECR provides two formal exemptions from the consent requirement. Both are quoted verbatim from the ICO's PECR guide.
- The cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
- The cookie is strictly necessary to provide an information society service requested by the subscriber or user. Cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent.
In practice, a truly cookieless static page is the only site that needs nothing. Any site running Google Analytics, embedding a YouTube video, or using a third-party chat widget is already past the exemption threshold.
If you do need to act, here is how to comply with cookie laws end to end.
Cookie Policy vs Privacy Policy vs Cookie Banner: Which Do You Need?
These three documents are not interchangeable, and many sites need all three.
| Artifact | What it does | When you need it |
|---|---|---|
| Cookie policy | Discloses which cookies you use, their purpose, duration, and third-party involvement | Whenever your site sets any cookies; standalone or as a privacy-policy section |
| Privacy policy | Covers all personal-data collection, use, storage, and rights across your entire site | Whenever you process any personal data (almost always) |
| Cookie banner | The consent mechanism: collects opt-in or offers opt-out before non-essential cookies load | Whenever your site sets non-essential cookies for visitors in consent-requiring jurisdictions |
A cookie banner does not replace a cookie policy. Adding a banner is not the same as compliance. The banner collects the consent; the policy discloses what you are collecting consent for. Omitting the policy while having a banner leaves users without the information they are entitled to.
A cookie policy can be a standalone page linked in your footer, or a dedicated section within your privacy policy. A standalone page is the cleaner approach for most sites and the more common practice.
What Happens If You Don't Have One?
Not having a required cookie policy exposes you to two risk channels.
Regulatory enforcement. Regulators treat a missing cookie policy as a failure to meet the transparency and consent obligations under GDPR, PECR, and CCPA. GDPR Article 83 sets maximum fines at 20 million euros or 4% of global annual turnover, whichever is higher. UK PECR fines were historically capped at 500,000 pounds. The Data (Use and Access) Act 2026 raised them to the UK GDPR level: up to 17.5 million pounds or 4% of global turnover. Enforcement has reached major companies. France's CNIL fined Google 150 million euros and Facebook 60 million euros specifically for cookie compliance failures.
Private litigation. A rising wave of cookie and pixel lawsuits now targets sites that track without proper disclosure or consent. The Meta Pixel lawsuits are the clearest US example: businesses using the Meta Pixel without proper disclosure face class-action exposure. Website wiretapping lawsuits over session-replay trackers follow the same pattern, many filed under California's wiretapping law, CIPA. For a breakdown of the specific cookie consent violations that trigger fines and litigation, see the dedicated guide.
How to Create a Cookie Policy the Right Way
Creating a compliant cookie policy requires knowing what cookies you actually set, not what you think you set. Third-party tools add cookies you did not place yourself.
The correct process:
- Scan your site to find every cookie and tracker, including those from third-party tools (analytics, advertising, embeds, chat)
- Categorize each cookie as strictly necessary, functional, analytics, or marketing/advertising
- Document the name, purpose, duration, and first-versus-third-party status of each
- Write the policy in plain language and publish it, linked from the footer, inside the banner, and from the privacy policy
- Pair it with a consent banner where required (opt-in for EU and UK visitors, opt-out for US state-law visitors)
- Keep it updated when your cookies or third-party services change
Two routes exist. You can write and maintain the policy by hand, which requires re-auditing each time services change. Or you can use a consent management platform that scans your site and generates the policy from the actual cookie inventory.
How Consently Generates Your Cookie Policy
Consently scans your site for cookies and generates a cookie policy from that scan, in 10+ languages, with EU opt-in and US opt-out banner templates. The consent side matches each visitor's region automatically. It fits cost-conscious site owners and agencies who need cross-region compliance without a lawyer.
A generated policy is only as accurate as the scan behind it. Consently's scanner detects cookies, trackers, scripts, and iframes across your pages. Its cookie policy generator then turns that detected inventory into a disclosure document reflecting what is actually running, not a generic template.
Three specific features address what this article is built around. The Cookie Policy Generator produces the disclosure document from the scan results, editable in a rich-text editor and embeddable directly on your site. Region-based consent templates with automatic geotargeting show EU visitors an opt-in banner and US visitors an opt-out banner. The consent mechanism matches each jurisdiction automatically. The policy supports 10+ languages and includes a draft, publish, and regenerate workflow for when your cookies or business details change.
One honest limit: a generated policy is compliance assistance, not legal advice. It does not auto-rewrite based on each visitor's location, and it should be regenerated whenever you add or remove cookies or third-party services.
Start free with Consently: 14-day trial, no credit card required, all features on every plan.
FAQs
Is a cookie policy a legal requirement?
Yes, where your site sets non-essential cookies. GDPR, the ePrivacy Directive, and PECR require you to disclose which cookies you use. For non-essential cookies, they also require consent or an opt-out. The governing law does not always name a document titled "cookie policy," but the disclosure obligation is mandatory. The EU and UK require opt-in; the US requires opt-out at state level.
Do I need a cookie policy if I'm in the USA?
Most likely yes. No single federal cookie law exists. California's CCPA/CPRA requires disclosure of data collection and an opt-out of sale or sharing of personal information. Cookies frequently enable that collection. Colorado, Virginia, Connecticut, and Texas have enacted similar state laws. A US site with EU or UK visitors is also in scope under GDPR and PECR. The "no US law, so I'm fine" belief misses both the state-law layer and the extraterritorial reach of EU law.
Do I need a cookie policy if I only use necessary cookies?
Consent is not required for strictly necessary cookies under PECR. You do not need an opt-in banner for session, security, or load-balancing cookies. Disclosing even essential cookies in a short cookie policy or a privacy policy section is good practice (per the ICO). It removes ambiguity about what your site sets.
Do I need a cookie policy for Google Analytics?
Yes. Google Analytics sets non-essential analytics cookies. In the EU and UK, those cookies cannot load until the user consents, and a cookie policy must disclose them. In US states subject to CCPA/CPRA, disclosure and an opt-out mechanism are required for covered businesses.
Can I put cookie information in my privacy policy instead?
Yes, and it is legally valid. A dedicated section in your privacy policy satisfies the disclosure obligation in most jurisdictions. A standalone cookie policy is the more common best practice because it keeps cookie-specific information clear and easy for users to find. Either way, a separate consent banner is still required for non-essential cookies in opt-in jurisdictions.
Do small or personal websites need a cookie policy?
Size does not exempt you. The trigger is the cookies you set and the visitors you reach, not your site's traffic or revenue. A small personal blog running Google Analytics needs a cookie policy for its EU and UK visitors. A truly cookieless static page (no analytics, no embeds, no third-party tools) does not. The question is always: what does this site actually set?
Is a cookie policy the same as a cookie banner?
No. The cookie policy is the static document that discloses which cookies your site uses, their purpose, duration, and who places them. The cookie banner is the interactive mechanism that collects the user's consent or offers an opt-out before non-essential cookies load. Many sites need both: the policy to satisfy the disclosure obligation and the banner to satisfy the consent or opt-out requirement.
How do I know if my website uses cookies?
Run a cookie scan. A scanner crawls your pages and lists every cookie and tracker your site sets. That includes cookies added by third-party tools: Google Analytics, advertising pixels, and embedded content. The scan output shows which cookies are present, their categories, and their durations. That inventory is what you need to write or generate an accurate cookie policy.
