How to Write a Cookie Policy
A cookie policy explains the small files your site stores on a visitor's device and what they are used for. Work through the form with this beside you.
What a cookie policy is
A cookie policy explains the small files a website stores on a visitor's device, and what those files are used for.
Cookies do several different jobs. Some are strictly necessary: they keep you logged in and remember what is in your basket. Some measure how the site is used. Some follow a visitor between sites so advertising can be targeted at them.
That last group is why the policy exists. Necessary cookies rarely trouble anybody. Analytics and advertising cookies are the ones people want disclosed and want a choice about.
The policy sits alongside your privacy policy rather than replacing it. The privacy policy covers personal data generally; the cookie policy covers this specific mechanism.
Who needs one
Any website using more than the bare minimum of cookies, which is nearly all of them.
If you have installed an analytics tool, you are using cookies. A Meta or TikTok pixel, the same. Embedded video, chat widgets and social share buttons all commonly set cookies of their own.
Most site owners have more cookies running than they realise, because each tool was added at a different time for a different reason.
A cookie policy is also what makes a consent banner meaningful. The banner asks for permission; the policy is where the visitor finds out what they are being asked to permit.
Before you start
Find out what your site actually sets before you describe it.
Open your own site in a private browser window, then look at the cookies stored under your browser's developer tools or site settings. It is usually more than expected.
List the tools you have installed: analytics, advertising pixels, chat, embedded media, A B testing.
Decide whether you run a consent banner, because that answer changes what the policy has to say about choice.
And check whether your banner actually blocks anything before consent, since many are decorative.
The walkthrough
Filling in the form, step by step
Every question you will be asked, what it means, and an example of a good answer.
Step 1 of 3
Cookie Policy
Your site and your country
The cookie policy opens straight into the practical detail, without the website or app question the other policies start with. Cookies are a browser mechanism, so this document is about a site.
The URL scopes it. If you run several domains, each needs its own policy or a clear statement that one covers them all, because the cookies differ between properties.
The country sets the standard you are held to. Nigerian data protection law treats information gathered through cookies as personal data where it can identify somebody, so the disclosure duty is real rather than cosmetic. If you have European or UK visitors, their rules on prior consent apply to them.
- What is your website URL?
- The site this policy covers, for example www.yourbusiness.com. Name the specific domain. Cookies differ between properties, so one policy stretched silently over several sites will misdescribe most of them.
- Enter the Country
- The country you publish from, which sets the baseline standard applied to your tracking. A Nigerian site should say Nigeria here. Visitors arriving from Europe or the United Kingdom bring stricter consent expectations with them whatever you enter.
Step 2 of 3
Cookie Policy
Who runs the site
This step names the party responsible for the cookies being set.
It matters because the responsibility is yours even for cookies you did not write. When you install an analytics tool or an advertising pixel, you are choosing to let a third party set cookies on your visitors. The vendor supplies the technology; you made the decision.
So the entity named here is the one a visitor asks about their data, and the one that answers for what the site does.
- Pick One
- Choose I am a Business or Startup where a registered business name or company runs the site. Choose I am an Individual if it is yours personally. Either way the responsibility for cookies set on visitors sits with whoever is named.
- Name of Business/ Startup
- The registered entity responsible for the site, written exactly as it appears in your privacy policy and terms. A visitor who compares the three documents should find the same business named in each.
- Address of Business
- A postal address with street, city and state. Visitors querying what is stored on their device, and regulators asking the same, need somewhere to write.
Step 3 of 3
Cookie Policy
Banners, analytics and advertising
These answers decide what the policy actually describes, and they are worth answering carefully rather than optimistically.
The consent banner question is about what you have, not what you intend to install. If you say you have one, the policy will describe how visitors give and withdraw consent, and a visitor who finds no banner has been told something untrue by your own document.
There is a further point most site owners miss. A banner that appears while the analytics and advertising scripts have already loaded is not collecting consent, it is announcing a decision. If yours behaves that way, the honest fix is to make the banner gate the scripts rather than to describe it as something it is not.
Analytics and advertising are separate questions for a reason. Analytics measures your own site. Advertising tools follow visitors beyond it, which is a bigger disclosure and the one people care most about.
- Do you have a cookie notice/ banner on your website?
- Answer Yes only if a banner actually appears to visitors now. The policy will then explain how consent is given and withdrawn. Answer No if you do not have one, rather than describing a banner you plan to add later.
- Do you use any analytical tool?
- Answer Yes if you run anything that measures traffic or behaviour, such as Google Analytics, Search Console tagging, heatmaps or session recording. Most sites do, often installed once and forgotten.
- Do you use any advertizing tool/ platform?
- Answer Yes if you run advertising or retargeting pixels, such as Meta, Google Ads or TikTok. These follow visitors beyond your site, which is the disclosure people most want to see made plainly.
- How can visitors/users contact you as regards your cookie policy
- Choose the routes somebody actually reads. Visitors use these to ask what is stored on their device or to withdraw consent they gave earlier.
- Phone No.
- A reachable number, if you ticked phone. Include the country code where you have overseas visitors, for example +234 801 234 5678.
- The address for cookie and tracking questions, if you ticked email. Sharing the address used in your privacy policy is sensible, since these enquiries usually arrive together.
- Link
- A contact page, if you ticked that option, for example www.yourbusiness.com/contact. Check it loads, because a broken link in a consent document undermines the point of publishing one.
Ready to make yours?
Answer those questions in the builder and download a finished cookie policy in Word and PDF.
Start now, ₦5,000After you download it
Link it from the banner itself
The consent banner should link straight to this policy. That is the moment a visitor is deciding, and it is the only moment the detail is genuinely useful to them.
Make the banner do what the policy says
If the policy describes consent before tracking, the banner has to gate the scripts. A banner that appears after everything has loaded contradicts your own document.
Re-check after installing anything new
A new pixel, chat widget or embedded player usually brings cookies with it. Look again at what your site sets whenever you add a tool.
Keep it beside the privacy policy
The two documents answer neighbouring questions and visitors move between them. Publish both in the footer rather than burying the cookie policy somewhere separate.
Questions people ask
What is a cookie policy?
A page explaining the small files your site stores on a visitor's device, what each type is used for, and how a visitor can control them.
Is a cookie policy the same as a privacy policy?
No. The privacy policy covers personal data generally. The cookie policy covers this specific mechanism, including analytics and advertising trackers, and the two sit alongside each other.
Do I need a cookie banner?
If you run analytics or advertising cookies, a banner is how visitors exercise choice. For European and UK visitors consent is expected before non essential cookies are set.
What are strictly necessary cookies?
The ones a site cannot function without, such as keeping you logged in or holding your basket. They are treated differently from analytics and advertising cookies, which are optional.
How do I find out what cookies my site uses?
Open your own site in a private browser window and inspect stored cookies through your browser's developer tools or site settings. Most owners find more than they expected.
Do embedded videos and chat widgets set cookies?
Commonly yes. Embedded media, chat tools and social buttons frequently set their own cookies, and they belong in the policy because you chose to install them.
Documents that go with this
Terms used on this page
Data Protection
Data protection is the law governing how you collect, store and use other people's personal information. In Nigeria it is the Nigeria Data Protection Act 2023, and it applies to far smaller businesses than most owners assume.
Consumer Protection
Consumer protection law gives buyers rights against sellers: honest information, safe goods, and redress when something is wrong. In Nigeria it is enforced by the FCCPC.
Cybercrime
Cybercrime covers offences committed using computers and networks, from unauthorised access and identity theft to online fraud. In Nigeria it is governed by the Cybercrimes Act 2015, as amended.
Intellectual Property
Intellectual property is the legal ownership of things you create rather than things you can touch, including trademarks, copyright, patents and designs. In Nigeria each type has its own registry and its own rules.
Read more on this
What Is a Privacy Policy? Guide and Template
What Is a Privacy Policy? What It Does and the Legal Requirement for One In today’s digital economy, businesses collect more personal information than ever before. Every time a customer fills out a form, signs up for a n…
NDPA 2023: Why Every Nigerian Website — Even Your Instagram Shop — Now Needs a Privacy Policy
The Nigeria Data Protection Act 2023 (NDPA) is not theoretical. It is being enforced. And if you run any business that collects personal data from Nigerians...
What Should I Write in My Terms and Conditions? Guide and Template
What Should I Write in My Terms and Conditions Most people see terms and conditions as a long legal document sitting at the bottom of a website. Many users click “agree” without reading it. Yet behind that simple checkbo…
Step by step guides for every document on LegalDoc
Browse all guides