Many businesses ask whether they need separate cookie and privacy policies, or whether one document can cover everything. Here's the distinction and what the law requires.
What a privacy policy covers
A privacy policy is a comprehensive document describing how your business collects, uses, stores, and shares personal data — across your entire operation. It covers data from contact forms, purchases, user accounts, email marketing, customer service, and any other context where you handle personal information.
A privacy policy is legally required in most jurisdictions if you collect personal data.
What a cookie policy covers
A cookie policy (sometimes called a cookie notice) specifically addresses the cookies and similar tracking technologies your website uses. It explains:
- What cookies your site sets
- What each cookie does
- Which are essential (exempt from consent) and which are non-essential (require consent)
- Which third parties set cookies on your site
- How users can control or delete cookies
A cookie policy is required under the EU ePrivacy Directive and UK PECR if you use non-essential cookies.
Can you combine them into one document
Yes — and many businesses do. It's perfectly acceptable to include a dedicated "Cookies" section within your privacy policy rather than maintaining two separate documents. The key requirement is that the cookie information is easily findable, clear, and comprehensive.
The advantage of a standalone cookie policy is that it's easier to reference from a cookie banner ("Click here to read our cookie policy") and easier to update when your cookie inventory changes without touching your entire privacy policy.
What regulators focus on
EU and UK regulators have focused enforcement on two specific cookie issues:
- Non-essential cookies being set before consent is obtained
- Cookie banners that make accepting cookies easier than rejecting them ("dark patterns")
Having accurate, up-to-date cookie documentation is important, but the functional requirement — getting valid consent before setting non-essential cookies — is where enforcement tends to land.
Keeping both up to date
Cookie inventories change frequently. When you add a new analytics tool, install a new chat widget, or change your advertising platform, new cookies appear on your site. Your cookie policy must reflect what is actually being set. Trust Center scans and maintains your cookie documentation automatically.