Cookie Policy for a Nigerian Website
A cookie policy tells visitors what your website stores on their device, what it is used for, and how they can turn it off. It sits alongside your privacy policy rather than replacing it.
Most Nigerian sites set far more cookies than their owners realise. Add Google Analytics, a Facebook pixel, a live chat widget and an embedded video and you have quietly introduced four third parties to every visitor.
Why It Matters Under Nigerian Law
The Nigeria Data Protection Act 2023 governs personal data, and cookie identifiers that can be tied to a person fall within that. Analytics and advertising cookies in particular build a profile of an individual, which is processing of personal data, which needs a lawful basis and proper information given to the person.
That is why a cookie banner that simply says "we use cookies" and offers only an OK button is weak. It informs without giving a choice, and for advertising cookies a choice is what the law is looking for.
The Four Kinds of Cookie
Strictly necessary. Login sessions, shopping baskets, security tokens, load balancing. The site does not work without them. These do not need consent, because the visitor asked for the service they enable.
Preference cookies. Language, currency, dark mode, whether you dismissed a banner. Useful, low risk, and usually treated as requiring at least clear information.
Analytics cookies. Google Analytics and similar. They track behaviour across a session and often across visits. These should be subject to consent.
Marketing and advertising cookies. Pixels from advertising platforms, retargeting tags. These follow people across sites and are the most intrusive category. Consent, clearly and freely given, is the only sensible basis.
What the Policy Should Contain
What a cookie is, in one short paragraph, plus a mention of the similar technologies you use such as local storage, pixels and software development kits in an app.
A table of the cookies you set. Name, purpose, category, who sets it, and how long it lasts. This is the part that takes work and the part that makes the policy real.
Third parties by name. Not "our partners". If it is Google, Meta or a chat provider, name them and link to their own policies.
How to give and withdraw consent. Where the settings control is, and how to change a choice already made.
How to block cookies in a browser. Briefly, with a note that blocking strictly necessary cookies may break parts of the site.
When it was last updated. Because you will add a tool and forget.
Getting the Banner Right
The policy is the detail. The banner is where consent is actually given or refused, and most banners are built badly.
A banner that works gives an accept and a reject option with equal prominence, does not set analytics or advertising cookies before a choice is made, records the choice, and lets somebody change it later. A banner with a big green Accept and a grey link buried underneath is not offering a real choice, and an accept-only banner is not offering one at all.
The common technical failure is worse than the design one. Many sites show a banner while the analytics script has already loaded and already set its cookie. The banner is then decoration.
Finding Out What You Actually Set
Open your own site in a private browser window, open the developer tools, and look at the storage tab before you click anything. You will usually find cookies you did not know about, set by a plugin, an embedded font, a video player or a chat widget.
Do this before writing the policy. A cookie table listing three cookies on a site that sets fourteen is worse than no table, because it is a statement that happens to be untrue.
Frequently Asked Questions About Cookie Policies in Nigeria
Do Nigerian websites need a cookie banner? If you set analytics or advertising cookies, you are processing personal data and need a lawful basis for it, which in practice means asking. A site that sets only strictly necessary cookies needs clear information but not a consent banner.
Can I have one document covering cookies and privacy? Yes, and many small sites do. A combined document is fine as long as the cookie detail, especially the table of what you set, is genuinely there rather than reduced to a sentence.
What if I only use Google Analytics? That is still analytics tracking of individuals, so it belongs in the policy and should be subject to consent. It is also the single most common cookie on Nigerian sites, so it is the one a complainant will point at first.
How long can a cookie last? Technically as long as you set it for, but a retention period should be justifiable against the purpose. Analytics cookies lasting two years are hard to defend when the same insight can be had from a much shorter window.
What about cookies set by embedded content? A YouTube embed, a font service or a social share button can set cookies from its own domain. They are still being set through your site, so list them and, where they are not strictly necessary, load the embed only after consent.
Getting Your Cookie Policy Right
Read next: our guide to privacy policies, since the two documents work as a pair. You will need the privacy policy itself as well.
The policy that works is the one that matches what your site actually does, names the third parties involved, and points to a control the visitor can really use.
Answer a few questions about the tools your site runs and you will have a cookie policy written for Nigerian use, ready to download in Word and PDF.