Privacy Policy vs Cookie Policy: They Are Not the Same Thing
Most websites confuse or combine these two documents — and pay the price in regulatory fines. Here is exactly what each document must contain, why they are legally distinct, and what happens when you get it wrong.
The Most Common Compliance Mistake on the Internet
Walk through almost any website and you will find one of two problems: either the privacy policy and cookie policy are merged into one confusing document, or there is a privacy policy but no cookie policy at all.
Both are GDPR violations. Both carry fine risk. And both are completely preventable.
Understanding exactly what each document is, what it must contain, and why they are legally separate will save your business from a regulatory headache.
What Is a Privacy Policy?
A Privacy Policy (also called a Privacy Notice under GDPR) is a comprehensive legal document that explains everything your organisation does with personal data.
It covers the full picture of how you collect, use, store, share, and delete personal information — from the moment a user visits your website to how you handle their data years later.
What a Privacy Policy Must Contain (Under GDPR Articles 13-14)
Who you are:
What data you collect and why:
Who you share data with:
How long you keep data:
Your rights:
How to contact you:
A Privacy Policy is the foundation of your entire data protection compliance. Without one — or with one that doesn't accurately reflect your actual data practices — you are non-compliant from day one.
What Is a Cookie Policy?
A Cookie Policy is a focused legal document that explains specifically how your website uses cookies and similar tracking technologies (pixels, local storage, session tokens, fingerprinting scripts, etc.).
It is required under the EU ePrivacy Directive (often called the Cookie Law) and the UK PECR (Privacy and Electronic Communications Regulations) — separate legislation from GDPR, but closely linked.
What a Cookie Policy Must Contain
A complete list of all cookies used:
Categories of cookies:
How users can manage consent:
Cookie banner requirements:
The 4 Critical Differences
| | Privacy Policy | Cookie Policy |
|--|---------------|--------------|
| Legal basis | GDPR Articles 13-14 | ePrivacy Directive / PECR |
| Covers | All personal data processing | Cookies and tracking technologies only |
| Trigger | Any processing of personal data | Any use of cookies or trackers |
| Linked to | All data practices site-wide | Cookie consent banner specifically |
Can You Combine Them Into One Document?
Technically, you can include a cookie section within your Privacy Policy. However, regulators and privacy lawyers strongly advise against this for three reasons:
Best practice: Separate documents, both linked from your footer and from your cookie consent banner.
What Happens When You Get It Wrong
Missing Cookie Policy:
Inaccurate Privacy Policy:
No documents at all:
The Practical Checklist
For your Privacy Policy:
For your Cookie Policy:
Two Documents. Both Mandatory. Both Different.
A Privacy Policy without a Cookie Policy leaves you exposed to ePrivacy enforcement. A Cookie Policy without a proper Privacy Policy leaves you exposed to GDPR enforcement. You need both, and they need to be accurate.
Need both documents drafted correctly? Our Website Compliance Bundle includes a GDPR-compliant Privacy Policy, Cookie Policy, cookie consent banner, and Terms of Service — all customised to your actual website and business practices. Delivered in 24-72 hours.
Need Legal Documents?
Get expert-drafted legal documents customized for your business. From NDAs to GDPR policies, we've got you covered.
