We’ve all been asked to “accept” or “reject” cookie consent banners at least once when visiting a website.
If you’re a website owner who uses cookies, a cookie policy is one of the best practices to implement on your site.
Not only does it protect your site visitors, but it also helps you comply with the EU Cookie Law and General Data Protection Regulation (GDPR).
Continue reading to find out the parts of a cookie policy and why you might need one for your website.
Is a Cookie Policy a Legal Requirement?
In the U.S., no comprehensive federal law requires a cookie policy for websites.
Privacy laws only exist on a state level to regulate online data processing and cookie usage to some extent, such as:
- California Consumer Privacy Act (CCPA)
- California Privacy Rights Act (CPRA)
- Virginia’s Consumer Data Protection Act (CDPA)
That said, US-based websites still NEED a cookie policy if they have EU clients.
The European Union established the General Data Protection Regulation (GDPR) and ePrivacy Directive (aka the cookie law) to protect their residents’ personal data.
The European Data Protection Board (EDPB) clarifies that these privacy laws work to complement each other.
EU member states have also updated their own laws to adhere to EU directives.
Under the EU cookie laws, online businesses that target EU citizens need to inform users what data they collect and how the personal information collected will be used.
If your site uses cookies, it collects user data. Therefore, you need to comply with the ePrivacy Directive.
An important requirement of the EU directive is to obtain consent from users before placing cookies on their devices.
What Is a Cookie?
A cookie is a small text file from a web server that is placed into a user’s device to collect data.
You can think of cookies as the web’s “short-term memory.” They allow websites to remember bits of information about users during each visit.
Most cookies are meant to enhance a user’s web experience, which is generally a positive thing.
Web servers also use cookies to track users’ online activities, preferences, and devices for advertising, targeting, social, and statistical purposes.
There are four main types of cookies:
- Essential cookies – Necessary for a website’s core functionality
- Preference cookies – Remember website visitors’ preferences during a session
- Analytics cookies – Assess how website visitors use the site
- Marketing cookies – Tracks website visitors across different sites to target them with relevant ads
There are also third-party and first-party cookies.
First-party cookies are unique to the website that are essential to its operation, while the latter are created by advertising services to display ads.
When people think about cookies, their biggest concern comes from persistent, third-party cookies that continue to track users even after they leave a site.
These cookies pose a risk to users’ digital privacy.
Why Do I Need a Cookie Policy?
If your site collects personal data from the EU or California residents, then you need a cookie policy.
Because cookies collect personal information, website owners MUST be legally compliant with the GDPR, ePrivacy Directive, and CCPA regulations.
The GDPR and the ePrivacy Directive have set up safeguards to ensure their citizens’ online privacy.
It includes having a compliant cookie policy showing all the cookie details used by your website.
A cookie policy can be seen with a cookie consent notice that asks for prior consent from website visitors before the site sets.
Cookie consent gives visitors more control over how their personal data will be collected and used.
It must be CLEARLY and EXPLICITLY shown through a cookie banner or pop-up.
What Will Happen if I Don’t Have a Cookie Banner?
Websites that use cookies to collect users’ personal data must comply with Cookie Law regulations.
Non-compliance with data privacy laws will risk enforcement action from data protection authorities.
The GDPR imposes two levels of fines for businesses that violate regulations:
- Less severe: €10 million, or 2% of the company’s worldwide turnover from the preceding financial year
- Severe: €20 million, or 4% of the company’s worldwide turnover from the preceding financial year
Depending on the severity of the offense and the amount of traffic your website gets, the fine could add up to hundreds of millions of dollars.
It’s crucial that you comply with the Cookie Law and its cookie consent requirements to avoid these hefty fines.
Do I Need to Have Both a Cookie Policy Post and Cookie Banner?
Cookie policy posts and cookie banners work hand in hand.
If your website collects personal data using cookies, it’s recommended to have BOTH to comply with the GDPR and the ePrivacy Directive.
A cookie policy post is a statement that informs visitors of the user data that cookies collect, why they’re being collected and where it will be stored.
In comparison, a cookie banner allows visitors to give their consent to a website for data collection and processing.
You can place the cookie policy on an existing privacy policy page or on a separate web page.
Under the GDPR and ePrivacy Regulation, cookie consent banners must be noticeable to visitors immediately.While a cookie policy post need not be as obvious, the cookie banner must be conspicuous during the first visit.
What Should a Cookie Policy Contain?
A cookie policy is a legal document informing website visitors that your site collects, processes, and stores data using cookies.
It must outline what type of cookies a website uses and how website visitors can set their preferences.
Alongside these details, below are other essential information you need to incorporate:
- Information about what cookies are and what type of cookies your site uses
- The types of cookies your site or third parties may use
- The reasons why your website uses cookies
- How the data collected from cookies will be used
- How visitors can opt out of having cookies placed on their devices
- How visitors can withdraw consent after giving prior consent
- How your website will store data
- Your company’s contact information
If your website already has an existing privacy policy, you don’t need to make a separate cookie policy page.
You can include the cookie policy in a separate section on the privacy policy page.
Creating a cookie policy for your website can be done in three basic steps using a cookie policy generator.
Let’s look at how you can make a Cookie Law-compliant cookie policy:
1: Types of Cookies You Need to Use
The first step is to find out what cookies your website will set and what they will be used for.
You can do this using a cookie audit or a website cookie scan tool.
Privacy policy generators will then give options on which data privacy laws your cookie policy wants to comply with.
Your cookie policy should give a brief explanation of each cookie your site will use.
The types of cookies can be classified into different categories (e.g., essential vs. non-essential, session vs. persistent, etc.).
2: How You Will Use Cookies
To abide by the ePrivacy Regulation, your cookie policy must inform visitors how your website will use cookies.
Your cookie policy should explain all this information about how data will be collected, whether or not it will be shared, and how it will be stored.
Cookie policies should also inform users about other technologies that track users’ online activities.
3: Get Visitors’ Consent
Once you’ve listed what cookies you’ll use and how they’ll be used, you need to obtain their consent before placing cookies.
A cookie policy should have a cookie banner that appears immediately when site visitors enter your website.
The cookie banner asks users for their consent to use cookies to collect personal data.
Opt-out options must exist for users who don’t want to consent to certain cookie usage (e.g., preference cookies, analytics cookies, etc.).
The options to “accept” and “reject” cookies should be EQUALLY PROMINENT on the cookie banner.
Implied consent via continued browsing is NOT considered compliant with Cookie Laws.
Types of Cookies to Include in Your Cookie Policy
Transparency is KEY for privacy notices. That’s why it’s critical to highlight the types of cookies your website will use.
There are certain cookies that require consent, while necessary cookies do not.
See below the cookie types worth mentioning in your cookie policy:
Session Cookies
These are temporary cookies that only exist during a certain session. Session cookies help websites track a user as they navigate web pages.
Once the user exits the site, session cookies are deleted.
These cookies are commonly found on e-commerce websites.
Persistent Cookies
In contrast to session cookies, persistent cookies are permanent.
They are kept in local storage on a user’s device and remain there even after the user exits the website.
This cookie type is responsible for remembering login information. Although it can save time for users, it can also pose a risk to privacy.
Third-party Cookies
Third-party cookies are created and placed by third-party advertising services.
These cookies are used to track users’ online activities across different sites to deliver behavioral advertising.
They are known for displaying ads that are personalized to the user based on their activities.
Flash Cookies
Flash cookies stay on users’ devices permanently, even after cookies have been deleted.
Zombie Cookies
This type of cookie is stored in multiple locations, which makes it difficult to remove.
Zombie cookies don’t depend on standard cookie protocols. Web browsers can continue recreating them even when deleted.
Frequently Asked Questions
Below are related questions about cookie policies and how you can integrate them into your site:
Will I Need a Cookie Policy if I Have a WordPress Site?
Your WordPress site is subject to Cookie Law regulations if you use cookies to collect user data.
One of the easiest ways to ensure compliance is by using a WordPress plugin. A WordPress plugin automates the creation of a comprehensive cookie policy.
You simply need to install a plugin, activate it to add a code snippet, and save it to your WordPress website.
Do I Need a Cookie Policy if My Website Doesn’t Use Cookies?
You DON’T need a cookie policy if your website doesn’t use cookies.
That said, having one is generally recommended, especially if you use services from third-party companies that may use cookies.
Having a cookie policy gives your website additional protection.
Conclusion
A comprehensive cookie consent gives users control over their online privacy.
More importantly, a cookie policy ensures that your website complies with Cookie Law regulations.
Even if you’re not based in the EU or in certain states with data privacy laws, integrating a cookie policy is a good practice for any website.
Consult with web developers or legal experts to learn more about protecting your website from liability.