Free UK cookie policy template
The Privacy and Electronic Communications Regulations (PECR) say you must give people clear and comprehensive information about anything your website stores on, or reads from, their device. This template does that for a typical small business website. List your own cookies and tools, and delete what does not apply.
Last checked against legislation.gov.uk on 14 October 2026. A starting point to adapt, not legal advice.
Your cookie policy must match your website. If a developer or agency has added a tool since the policy was written, it will be missing. Check your website to see the tracking tools your homepage loads and whether your privacy policy names them.
The cookie policy template
Cookie policy
Last updated: [date]
This policy explains how [organisation name]'s website uses cookies and similar technologies, which store information on your device or read information from it.
Cookies we always use
Some are needed for the website to do what you ask, such as remembering what is in your basket or keeping the site secure. These do not need your consent. [List them, for example: [cookie name], set by [us / provider], to [purpose], kept for [period].]
Analytics
[Choose one.]
[Option A, if you ask for consent: With your consent, we use [tool] to count visits and see how the website is used, so we can improve it. You can change your choice at any time using [link or button].]
[Option B, only if every condition of the statistics exemption is met: We use [tool] only to collect statistics about how our website is used, so we can improve it. The information is not shared with anyone except to help us make those improvements. You can object, free of charge, by [simple means, for example a switch on this page], and we will stop.]
Advertising and social media
[If you use them: With your consent, we use [tools, for example a Meta Pixel or Google Ads tag] to [purpose, for example measure our adverts]. These tools share information with their providers. You can change your choice at any time using [link or button].] [If you do not, say so.]
Embedded content
[If you embed videos or maps: Some pages show content from [providers, for example YouTube or Google Maps], which may set their own cookies. [Say whether you ask for consent first.]]
Changing your choices
You can change your cookie choices at any time using [link or button]. You can also block or delete cookies in your browser settings, but some parts of the website may then not work.
More information
Our privacy notice at [link] explains how we use personal information. Contact us at [privacy@yourdomain] with any questions.
The 2026 analytics exemption, in brief
Since 5 February 2026, PECR Schedule A1 lets you use cookies or similar technology for statistics without consent, but only if all of these are true: the sole purpose is to improve your own website or service; the information is not shared except to help with that; people get clear and comprehensive information; and they have a simple, free way to object and have not objected. Advertising is not covered. Read more about Google Analytics and consent.
Sources: PECR regulation 6; PECR Schedule A1.
Does your policy name every tool your site uses?
The Privacy Register finds the analytics, advertising and other tools on your homepage and lists any your privacy policy does not name. Free, no sign-up.
Questions
Do I need a separate cookie policy?
Not necessarily. PECR requires clear and comprehensive information, not a separate page. Many small websites put a cookies section in their privacy notice. A separate page is easier to keep up to date if you use several tools.
Do I need a cookie banner?
If you use anything that needs consent, such as advertising tools or analytics that do not meet every condition of the exemption, you need a way to ask for consent before it runs. If you only use cookies that are strictly necessary, or analytics that meet every condition, you need to give clear information and, for analytics, a simple way to object.