If your website uses cookies for anything beyond making the page work, you almost certainly need a cookie policy on your website, or at minimum cookie disclosures inside your privacy policy. No single global law forces every site to publish one, but the practical rule is simple: analytics, advertising pixels, social widgets, embedded videos, and cross-site trackers all trigger disclosure obligations somewhere your visitors live. Only cookies that are strictly necessary to deliver something the visitor asked for, like keeping a shopping cart alive or maintaining a login session, escape the rules.
When a Cookie Policy Is Required
Two questions decide it: where your visitors are, and what your cookies do.
If any meaningful share of your traffic comes from the European Union, the GDPR and the ePrivacy Directive apply to those visitors. If California residents visit and your business meets certain revenue or data-volume thresholds, the CCPA applies. Nearly 20 other U.S. states have passed comprehensive privacy laws with transparency requirements around data collection. And the Federal Trade Commission can act against any website whose stated privacy practices don’t match what it actually does.
These laws follow the visitor, not the server. A small business in Texas whose site happens to attract European readers is expected to comply with EU cookie rules for those readers. Because most site owners can’t control who shows up, most sites with any real traffic need a cookie policy.
One boundary worth stating plainly: a site that sets no cookies at all, and loads no third-party scripts that set cookies, has nothing to disclose. That describes very few modern websites. Most site owners are surprised at what their pages actually load once they check.
What EU Rules Require
The EU has the world’s most prescriptive cookie rules, built from two overlapping regulations. The ePrivacy Directive requires consent before any information is stored on or read from a visitor’s device, with a narrow exception for cookies that are strictly necessary to deliver a service the user requested.1European Data Protection Board. Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive Analytics, advertising pixels, and social media widgets all fall outside that exception.
The GDPR sits on top of that. It treats cookie identifiers as personal data when they can be tied to a specific person, which pulls the full weight of GDPR consent rules onto tracking cookies. Consent must be freely given, specific, informed, and unambiguous. In its Planet49 ruling, the Court of Justice of the European Union confirmed that a pre-checked checkbox is not valid consent, and that websites must tell visitors how long each cookie lasts and whether third parties can access it.2Court of Justice of the European Union. Judgment in Case C-673/17 – Planet49 Users must be able to withdraw consent as easily as they gave it.
The practical rule for EU visitors: non-essential cookies cannot fire until the visitor clicks accept. A banner that loads tracking scripts while asking permission violates the law, even if it looks compliant on the surface.
What U.S. Rules Require
The U.S. takes a different approach. Rather than opt-in consent, the California Consumer Privacy Act gives residents the right to opt out of the sale or sharing of their personal information, including data collected through cookies and tracking technologies.3California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Covered businesses must disclose their data collection practices and give consumers a clear way to exercise that opt-out right.
The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds: gross annual revenue above roughly $26.6 million, buying or selling the personal information of 100,000 or more California residents or households, or deriving at least half of annual revenue from selling or sharing personal information.4California Privacy Protection Agency. Frequently Asked Questions The revenue figure is adjusted annually for inflation.
Children’s data gets stricter treatment. Businesses cannot sell or share the personal information of anyone they know to be under 16 unless the consumer, or a parent for children under 13, affirmatively opts in.
Beyond California, comprehensive privacy statutes in Virginia, Colorado, Connecticut, Texas, and more than a dozen other states impose their own transparency and opt-out requirements. The specific triggers vary, but disclosure obligations in the U.S. are expanding.
Federal enforcement matters too. Section 5 of the FTC Act prohibits unfair and deceptive practices, and the FTC has used that authority against companies whose actual tracking behavior didn’t match their stated privacy practices.5Federal Trade Commission. Privacy and Security Enforcement If your site says “we don’t track you” but loads third-party advertising cookies, that’s a textbook deceptive practice.
Websites Directed at Children
If your website or app is directed at children under 13, or you have actual knowledge a child is using it, the Children’s Online Privacy Protection Act adds a separate layer. COPPA defines personal information broadly to include persistent identifiers like cookies that recognize a user over time or across different sites.6eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule Even passive tracking through analytics or advertising cookies counts as collecting personal information from a child, and operators must obtain verifiable parental consent before doing so. A checkbox saying “I am over 13” doesn’t meet the standard.
What Your Cookie Policy Should Say
No law says the policy must be a standalone page. Cookie disclosures can live inside your privacy policy. A separate cookie policy is easier for visitors to find and simpler to update when tracking tools change, and for sites with EU visitors it’s the safer format because the required detail can overwhelm a general privacy policy.
Whatever the format, the disclosures should cover:
- The categories of cookies your site uses: strictly necessary, analytics and performance, preferences, and advertising or cross-site tracking.
- What each category actually does, in plain language. “We use cookies to improve your experience” tells the reader nothing. Naming the specific purpose does.
- The third parties setting cookies through your pages, and why. If Google Analytics, Meta, or an ad network places cookies on your site, visitors deserve to know.
- How long cookies last. Session cookies expire when the browser closes; persistent cookies last for a set period that should be disclosed. EU law specifically requires this.
- How visitors can accept, reject, or change their choices, whether through your consent tool, browser settings, or both.
- A link between your cookie disclosures and your main privacy policy if they’re separate.
The Consent Banner That Makes It Work
The written policy only becomes enforceable through the mechanism visitors interact with. For EU visitors, the banner must appear before any non-essential cookies load, and it must offer real options: accept all, reject all, or choose specific categories. Burying “reject” three clicks deep while making “accept all” a single bright button is the kind of design regulators increasingly target.
For CCPA compliance, the banner or a persistent link should let visitors opt out of the sale or sharing of their data. Many sites handle both regimes with a single consent tool that detects visitor location and adjusts, showing a full opt-in banner to EU visitors and an opt-out mechanism to U.S. visitors.
A few implementation points that trip site owners up:
- No pre-checked boxes. Every non-essential category must default to off for EU visitors; the visitor’s first affirmative action enables them.2Court of Justice of the European Union. Judgment in Case C-673/17 – Planet49
- Record consent. Log when each visitor consented, what they consented to, and what version of the policy was live. If a regulator asks, you need proof.
- Respect withdrawal. If someone revokes consent, non-essential cookies must stop firing immediately, and withdrawing must be as simple as consenting was.
- Make the banner accessible. It should work with keyboards and screen readers, use adequate button sizes on mobile, show clear focus indicators, and use language a visitor with cognitive disabilities can follow.
How to Find Out What Cookies Your Site Sets
You can’t write an accurate policy without knowing what cookies your site actually sets. Many owners are surprised to find trackers they never intentionally added, injected by third-party scripts, embedded videos, social sharing buttons, or chat widgets.
The simplest free method is your browser’s developer tools. In Chrome, open DevTools, go to the Application panel, and look under Storage and Cookies. You’ll see every cookie organized by domain, with name, value, expiration, and a warning icon on third-party cookies. The Network panel flags cookies with potential issues.
For a more thorough audit, dedicated scanning tools crawl the whole site and produce a categorized report, and many consent management platforms include this feature. Run scans on a fresh browser session with no existing cookies, and repeat them periodically. Every new plugin, embedded video, or third-party integration can add cookies without you noticing. A scan is only accurate as of the day it ran.
What Non-Compliance Costs
Financial exposure varies sharply by jurisdiction. Under the GDPR, data protection authorities can impose fines of up to €10 million or 2% of global annual revenue for less severe violations, and up to €20 million or 4% of global annual revenue for more serious ones, whichever is higher. Cookie consent violations have already generated significant fines against major companies operating in Europe.
Under the CCPA, civil penalties apply per violation, adjusted annually for inflation, and currently run from roughly $2,600 for an unintentional violation to about $7,900 for an intentional one. When a violation affects thousands of consumers and each instance counts separately, totals climb quickly.
The FTC can seek up to $53,088 per violation of Section 5 of the FTC Act for deceptive tracking practices, and COPPA violations carry the same per-violation maximum.7Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025 Some laws also allow private lawsuits. Under the CCPA, individual consumers can seek statutory damages of $100 to $750 per person per incident when a data breach results from inadequate security practices.
For most websites, adding a proper consent tool and writing an honest cookie policy costs a few hundred dollars at most. Compared to a single regulatory action, that’s a rounding error.