A cookie policy is a page that explains to your visitors which cookies your website uses, what user data those cookies record, what they’re used for and where the data is handled. In Loopia Sitebuilder you create it as a separate page and link to it from your footer or cookie consent banner.
What is a cookie policy?
Under the GDPR, your cookie policy should also describe how visitors can decline cookies or change their cookie settings on your site. To keep full control of your cookies and make sure the policy is accurate and up to date, it’s important to create a GDPR-compliant cookie policy that covers the main areas where your site collects data.
Who needs a cookie policy? The GDPR is an EU-wide law, so it applies to every website that receives visitors from the EU, wherever the site is based. All websites should therefore explain their use of cookies to visitors.
Do I need a separate cookie policy if I already have a privacy policy?
The GDPR gives visitors the right to specific, up-to-date information about the data recorded about them, why it’s collected, where it’s handled and how they can object. This legal requirement makes a dedicated cookie policy necessary – with specific, accurate and current information about your site’s use of cookies and visitors’ options to accept or reject them. The rules cover the cookie policy, the cookie notice, consent and the record of consents.
The difference between a cookie policy and a privacy policy
Your privacy policy is an overarching document covering all processing of personal data on your site, while your cookie policy deals specifically with cookies. The distinction matters because cookies can change quickly – they can track, store and share user behaviour, often via third-party services with their own policies – and your cookie policy must cover this.
When you update your privacy policy you must inform users, and frequent updates can annoy them. When you update your cookie policy, however, there’s no obligation to send a notice.
What your cookie policy should include
- Which types of cookies are used.
- How long cookies stay in the user’s browser.
- What data cookies collect.
- Why the data is collected (for example functionality, performance, statistics or marketing).
- Recipients and any sharing of the data.
- How to decline cookies and change cookie settings.
There are many cookie policy examples and templates available online.
Note: your cookie policy must be reviewed and updated regularly so it gives accurate information about the cookies used on your site.
Creating a cookie policy page
- Click Pages in the top menu to open the Page Manager.
- Click the blue (+) button to add a new page.
- Choose the Blank page template in the Add page menu and name the page, for example Cookie policy. Leave Show in navigation unticked if you don’t want the page in the main menu. Click Submit.
- Click the blue (+) button to add a block to the new page. Choose the Text block in the Block library, then choose a layout (with or without an image).
- Type or paste your cookie policy text into the block and format it. When you’re done, click Publish.
Showing your cookie policy on your site
You can include it in your privacy policy, place it in your site’s footer, or show it in the cookie consent banner.
Adding the cookie policy to your footer
- Go to your Footer block and click the footer navigation to open List settings. (If footer navigation isn’t enabled, go to Block settings and tick Footer navigation.)
- Click the blue (+) button to add a new item.
- Choose Open a page as the click action and select your cookie policy page from the list.
- Type the navigation item’s name in the Title field and click Submit in this and the next window.
You can also point visitors to your cookie policy from your cookie consent banner, or via CookieBot if you’ve connected it to your site.
Best practice for your cookie policy
- Map every cookie used on your site so your policy is specific and accurate.
- Write the policy in plain language to meet GDPR requirements.
- Keep it updated with specific, accurate and current information.
- Consider third-party cookies, which may have their own policies.
- Inform users of their rights regarding data collection and how to exercise them.
Note: GDPR compliance is complex, and you may need to consult a legal expert to ensure full compliance with the regulation.