Cookie policy: the page nobody reads and everybody checks

A cookie policy is the page that tells visitors what your site stores on their device, what each thing is for, and how long it stays. It is separate from your privacy policy, though they are often merged, and it is the document regulators and prospective customers check first because it is public and takes ninety seconds to verify. That verifiability is the whole problem: a cookie policy that lists three cookies on a site that sets thirty is not a drafting error, it is evidence.

What a cookie policy has to say

• What is actually set, by category: strictly necessary, functional, analytics, advertising.
• Who sets it — first party or a named third party — because the third-party ones are the ones people care about.
• What each is for, in plain language rather than the vendor’s own description.
• How long each persists, distinguishing session from persistent, and the actual duration rather than "as required".
• How to refuse and how to change a decision later, with a working link to the settings rather than instructions to edit browser preferences.
• The date it was last reviewed, since a policy that has not been touched in three years advertises that nobody is checking.

The banner is the compliance question, not the policy

Almost every enforcement action in this area is about consent mechanics rather than the wording of the page.

1. Nothing but strictly necessary storage before consent — analytics that fire on page load defeat the entire arrangement, however good the policy text.
2. Refusing must be as easy as accepting: one click, at the same level, in the same visual weight. An "Accept all" button beside a "Manage settings" link is the classic failure.
3. No pre-ticked boxes, and no treating continued scrolling as agreement.
4. A way to withdraw consent later that is actually reachable from every page.
5. Consent recorded — what was agreed, when, and against which version of the categories.

Cookie banners are governed by ePrivacy rules in Europe rather than only by the GDPR, which is why the consent standard applies to storage on the device regardless of whether the data is personal. The practical consequence is that "it is anonymous analytics" does not remove the consent requirement, though several regulators now accept genuinely privacy-preserving measurement without it. The details differ by country and are actively changing.

The mistakes that show up on inspection

• The list does not match reality, usually because a marketing tag was added months after the policy was written.
• The policy is generated once and never regenerated, so it describes a previous version of the site.
• Third-party embeds — a video, a map, a chat widget — setting cookies nobody catalogued.
• The banner blocks nothing: consent is collected and then ignored by tags that fire anyway.
• Different behaviour in different regions with no stated logic, which is legitimate if deliberate and indefensible if accidental.

Where the policy lives

Ettex Sites is where the page itself belongs — on your own domain, linked from every page, with the review date visible. The discipline that keeps it true is not writing: it is checking what the site actually sets whenever anything is added to it, which is a step in your release routine rather than a legal task. It sits beside the privacy policy, which covers what you do with personal data generally rather than what you store on the device. Ettex does not audit your site’s cookies, does not provide a consent banner, and this is not legal advice — the rules differ by jurisdiction and are being revised.