Search "do I need a cookie policy" and you'll find confident answers on both sides: some say a privacy policy already covers it, others say a separate cookie policy is mandatory. Both answers are right, for different sites. The honest answer depends on what your site actually does with cookies, not on a rule that applies the same way to everyone.
Here's how the two documents actually differ, which laws drive the difference, and a clear way to decide whether your site needs one document or two.
What each document is actually for
A privacy policy is the broad disclosure: what personal data you collect, why, who you share it with, how long you keep it, and what rights a visitor has over it. It covers every way your business touches personal data, account details, checkout information, support emails, and yes, cookies, as one section among several.
A cookie policy is narrower on purpose. It documents the specific tracking technologies your site uses, cookies, but also local storage, pixels, and similar client-side mechanisms, category by category (strictly necessary, analytics, marketing) and often vendor by vendor, along with how long each one persists and how a visitor can control or withdraw consent. It doesn't try to cover your checkout process or your support inbox, only the tracking layer.
Our own privacy policy at privacyterms.io is a useful example of the "one document" pattern: cookies get their own named section inside the policy (what a cookie is, what we use them for, a named disclosure of Google Analytics, and how to opt out through browser settings) rather than a standalone page. That's a completely valid structure for a site with a modest, stable set of cookies and no granular consent banner to document.
What each document actually covers
| Privacy policy | Cookie policy | |
|---|---|---|
| Scope | All personal data handling | Tracking technologies only |
| Typical length | Long, many sections | Short, often a table |
| Legal basis | GDPR, CCPA, general data law | ePrivacy Directive, GDPR Art. 5(3) |
| Usually linked from | Footer, account pages, checkout | Cookie banner, consent center |
| Lists individual vendors | Sometimes, in a data-sharing section | Yes, typically by category and name |
| Can stand alone |
That last row matters: a cookie policy is a supplement, not a substitute. It exists to document a specific consent mechanism, and by itself it doesn't tell a visitor what happens to the account information they hand over at checkout. A privacy policy always has to exist. A separate cookie policy is the optional half of the pair.
Why the two documents answer to different laws
The split isn't arbitrary, it follows two different legal sources. General data protection law, GDPR and CCPA/CPRA among them, governs personal data broadly and is what requires a privacy policy in the first place. Cookies specifically are also governed by a narrower rule: in the EU and UK, the ePrivacy Directive (sometimes called the "cookie law," implemented differently in each member state, and interacting with GDPR Article 5(3) since a cookie identifier is usually personal data too) requires informed consent before non-essential cookies load, independent of whatever your privacy policy says elsewhere.
That's the legal reason a cookie policy tends to exist as its own document once a site adopts a real consent banner: the banner needs a linkable reference that lists exactly what a visitor is consenting to, by category and often by vendor, and that reference has to be kept current independently of your privacy policy's own update schedule. Folding a detailed, frequently-changing cookie list into the middle of a long privacy policy makes both documents harder to maintain.
CCPA and CPRA work differently here. California's law doesn't require a separate cookie-specific document at all, cookies fall under the general definition of "personal information," and the opt-out right ("Do Not Sell or Share My Personal Information") is satisfied with a link and a working mechanism, not a dedicated policy page. A cookie policy that exists purely to satisfy CCPA is a nice-to-have for clarity, not a legal requirement the way it functionally is for a GDPR-scoped site running a granular consent banner.
The decision: one document or two
In practice, three factors decide it:
How many cookies, and how they're categorized. A site running only a handful of strictly necessary cookies (a session cookie, a login token) has little reason to split anything out, a short section in the privacy policy says everything that needs saying. A site running a consent management platform with necessary/analytics/marketing categories and a dozen third-party vendors has outgrown a paragraph, and a standalone, updatable reference page is the practical choice.
Whether GDPR's opt-in consent model applies to you. If you have meaningful EU or UK traffic, the ePrivacy Directive's consent requirement means your banner needs something to link to that lists exactly what a visitor is agreeing to. A standalone cookie policy is the standard way to satisfy that, most consent management platforms (Cookiebot, OneTrust, Complianz) assume one exists and link to it by default.
How often your cookie stack changes. If you're regularly adding or swapping analytics tools, ad pixels, or embedded content, a standalone cookie policy is easier to keep accurate, you update one focused page instead of hunting through a long privacy policy to find and revise a buried cookie paragraph.
None of this is a strict legal mandate for a specific document count, both approaches can be fully compliant. It's a maintainability and clarity decision as much as a legal one: pick the structure that makes it easiest to keep the disclosure accurate as your site changes.
Building either one
Our Privacy Policy Generator builds a complete policy that can include cookies as a section, GDPR and CCPA coverage, data rights, and third-party disclosures assembled from your actual answers, not a generic template. If your cookie setup has grown past what a single section can hold, pair it with our Cookie Policy Generator to produce a standalone, category-by-category document your consent banner can link to directly.
For the closely related question of how a privacy policy differs from a terms and conditions agreement, a different document pair entirely, see our guide on privacy policy vs terms and conditions.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
