Two Documents, Two Jobs
Website owners frequently treat "cookie policy" and "privacy policy" as interchangeable, or assume one absorbs the other. They are related — both are transparency documents about how you handle data — but they answer different questions and, in most jurisdictions, are required by different laws. Confusing them leads to gaps that regulators and privacy-conscious users notice.
In short: a privacy policy explains how you collect, use, share, and protect personal data across your entire operation. A cookie policy zooms in on one specific technology — the cookies and similar trackers running on your website — and details each one. This guide breaks down what each must contain, why most sites genuinely need both, and how they fit together with your consent banner. For the legal backdrop, it helps to understand what GDPR is first.
What a Privacy Policy Covers
A privacy policy is the broad document. Under the GDPR's transparency requirements (Articles 13 and 14), it must tell people, in clear language, the essential facts about your data processing:
- Who you are — the identity and contact details of the data controller.
- What data you collect — names, emails, payment details, behavioral data, and so on.
- Why and on what legal basis — the purposes of processing and the lawful basis for each.
- Who you share it with — processors, partners, and any international transfers.
- How long you keep it — your retention periods.
- What rights people have — access, rectification, erasure, objection, portability, and how to exercise them.
The privacy policy is therefore about all personal data — from a contact form submission to a server log to a CRM record. Cookies are just one source among many that it references.
What a Cookie Policy Covers
A cookie policy is the specialist document. It exists because cookies and similar technologies are governed not only by the GDPR but also by the ePrivacy Directive (the "cookie law"), which has its own specific disclosure and consent rules. The UK's Information Commissioner's Office offers practical guidance on cookies and similar technologies that underpins these disclosure duties. A complete cookie policy tells visitors:
- What cookies the site uses — ideally an itemized list, not a vague "we use cookies" sentence.
- What each cookie does — its purpose, grouped by category: strictly necessary, analytics, marketing, preferences.
- Who sets it — first-party or which third party (see first-party vs third-party cookies).
- How long each lasts — the cookie's duration.
- How to control them — how to change consent and manage browser settings.
The itemized list is what separates a real cookie policy from a token gesture. Producing it accurately requires knowing exactly what runs on your site — which is why a cookie scanner is the practical starting point.
A Cookie Policy Must Reflect Reality
A cookie policy listing cookies you no longer use — or omitting trackers a marketing tag quietly added — is worse than none, because it misrepresents your processing. Cookie inventories drift constantly as third-party scripts update. Keep the policy in sync with an automated scan, not a one-time manual list.
Do You Need Both?
For the overwhelming majority of websites, the answer is yes. Here is the reasoning:
If your site collects any personal data — contact forms, accounts, payments, analytics — you need a privacy policy to satisfy GDPR transparency. Almost every commercial website does.
If your site uses any non-essential cookies or trackers — analytics, advertising pixels, embedded videos, social widgets — you fall under the ePrivacy rules and need both a consent mechanism and clear cookie disclosures. That disclosure is your cookie policy.
Some smaller sites combine the two into a single document with a dedicated cookie section. That is legally acceptable in many cases, provided the cookie-specific information (the itemized list, durations, and controls) is genuinely present and easy to find. What is not acceptable is having a privacy policy that hand-waves at cookies with a single sentence while trackers run unlisted.
Combine or Separate — Either Works
You can keep them as two linked documents or merge the cookie policy as a clearly-labeled section within the privacy policy. The legal test is not the number of documents but whether all required information is present, accurate, and accessible. Many sites keep them separate simply because the cookie list changes far more often than the rest of the privacy policy.
How They Work With Your Consent Banner
The two policies and the consent banner form a chain. The banner is the action point — where the visitor grants or refuses consent before non-essential cookies run. The cookie policy is the detail the banner links to, so a curious user can see exactly what each category contains. The privacy policy is the context — the full picture of your data practices that both reference.
A well-built setup links them explicitly: the banner offers a "Cookie settings" or "Learn more" link to the cookie policy, and both policies cross-link to each other. Critically, the banner must actually enforce the choice — refusing analytics in the banner has to stop the analytics cookies the policy lists, which is the job of blocking scripts until consent. A policy that describes consent the banner doesn't enforce is a compliance gap hiding in plain sight.
Common Mistakes
Copy-pasting a generic template. A boilerplate cookie policy that doesn't match your actual cookies fails the accuracy test. The list must be yours.
Treating the privacy policy as enough. A privacy policy alone, with no itemized cookie disclosure and no consent mechanism, does not satisfy the ePrivacy rules for non-essential cookies.
Never updating. Add a marketing tool, and it may introduce new trackers overnight. If the policy isn't refreshed, it's instantly inaccurate.
Burying the links. Both documents must be easy to reach — typically from the footer and from the consent banner. Hidden policies undermine the transparency they're meant to provide.
Vague language. "We may use cookies to improve your experience" tells the user nothing. Name the cookies, their purpose, and their duration.
Cookie Policy & Privacy Policy Checklist
Publish a privacy policy covering all personal data processing
Identity, data collected, purposes and legal bases, sharing, retention, and data-subject rights.
Publish a cookie policy with an itemized list of cookies
Each cookie's name, purpose, category, first- or third-party origin, and duration.
Generate the cookie list from an actual scan, not a template
The list must reflect the trackers really running on your site.
Keep the cookie list in sync as scripts change
Third-party tools add and update trackers; re-scan regularly so the policy stays accurate.
Link the consent banner to the cookie policy
Give users a clear path from the banner to the detailed disclosures.
Cross-link the two policies and place them in the footer
Both must be easy to find from anywhere on the site.
Ensure the banner actually enforces what the policy describes
Refusing a category must stop the cookies that category lists.
Get the Documents and the Enforcement Right Together
The clearest cookie policy in the world means little if the banner doesn't enforce the choices it describes. Pair an accurate, scanner-generated cookie policy with a consent banner that genuinely blocks scripts until consent — and keep both updated as your cookie inventory changes.