Say what each cookie does, in plain words.

Where the duty to inform comes from

Article 5(3) of the ePrivacy Directive ties consent to clear information, in particular about the purposes. When personal data is involved, Article 13 GDPR lists what you must tell people at the moment you collect it.

In Planet49 (C-673/17, 2019) the EU’s Court of Justice added two points for cookies: visitors must be told how long the cookies will be active and whether third parties can access them.

Most sites keep these details on a separate cookie page and link to it from the banner, the footer and the privacy policy. The Dutch Data Protection Authority (AP) asks that the page is easy to find and written in clear language.

What to list for each cookie or tool

List every cookie, every item in browser storage and every tool that stores or reads something, such as a pixel or an embedded video. The AP asks you to say how many organisations you share data with, which ones, and why. The CNIL, France’s regulator, recommends an up-to-date list of every company that uses trackers on your site, reachable from every page.

For each item:

• Name: the cookie or storage key, or the tool’s name for a pixel or script
• Provider: who sets it and receives the data, with a link to their privacy policy
• Purpose: what it does, in one plain sentence
• Duration: how long it stays on the device, such as “session”, “30 days” or “1 year”
• First or third party: set by your own domain or by another company
• Category: the group it falls under in your banner, such as necessary, statistics or marketing
• Data outside the EEA: whether data goes to a country outside the EU, Iceland, Liechtenstein and Norway, and on what basis

What the GDPR adds

Keep two periods apart. How long a cookie stays on the device is one; how long you or a provider keep the data it collected is another. Planet49 asks for the first, and Article 13 GDPR for the second.

When cookies or tools process personal data, Article 13 also asks for the following. Many sites cover it once in the privacy policy and link there from the cookie page:

• Who you are and how to contact you, plus your data protection officer if you have one
• The purposes and the legal basis for each, such as consent for advertising
• The legitimate interest you rely on, where that is the basis
• Who receives the data
• Transfers to countries outside the EEA, and the adequacy decision or safeguards they rely on
• How long you keep the data, or how you decide that
• The visitor’s rights, including withdrawing consent at any time and complaining to a data protection authority

Sites without a banner explain themselves too

A site that needs no consent still stores or loads something: a login cookie, a cart, a font, cookieless analytics. Visitors can’t see that from the page.

The CNIL recommends telling visitors about exempt cookies too, for example in the privacy policy, and that includes analytics that run without consent. The Dutch AP says that when you rely on legitimate interest for functional or limited analytics cookies, you still have to inform visitors clearly and make it easy for them to object.

A short page is enough, and it shows visitors that someone checked.

Keep it current

A cookie page goes out of date the day someone adds a plugin, an embed or a tag. From then on it tells visitors something that isn’t true, and it no longer matches your banner.

Scan each site after every change and at regular moments, compare the result with the page, and show the date of the last check. The EDPB’s Cookie Banner Taskforce discussed site owners’ responsibility to keep these lists, hand them to a regulator on request and show why each cookie marked essential is essential.

The AP points to a free website auditing tool from the European Data Protection Board (EDPB) that shows which cookies a site uses and whether visitor data is sent elsewhere. Gatelamp builds the declaration from what its scanner finds, per language, and updates every page that uses a tool when that tool’s description changes.

A template to start from

Copy this, replace the brackets and delete what doesn’t apply. Add one line per cookie or tool, grouped by category.

Write it for a visitor, in the language of the page. Short sentences work better here than legal phrasing.