Free tool Cookie policy generator: a cookie policy template with your real cookies
A cookie policy is only useful if its table is right: the name of each cookie, who sets it, why, how long it lasts and whether it is first- or third-party. Tick the services on your site and the generator fills in their cookies from each provider’s own documentation, marking durations the provider does not publish instead of guessing. Add your own cookies one per line, choose how visitors give consent, and download the policy as Markdown or HTML.
- Names and durations from official docs
- Template, not legal advice
- Generated in your browser
List what your site stores, get the policy
Every change rewrites the policy. The checklist flags cookies that need consent and lines it could not read.
About you
English or Chinese; each is written for its own readers, not translated.
YYYY-MM-DD. Leave empty for today.
The cookie policy links to it. No privacy policy yet? Use the privacy policy generator.
TapCub
Check Compliance centre in your TapCub site settings.
Third-party services
Your own cookies and consent
One per line: name | provider | category | duration | purpose. Category is necessary, preferences, analytics or marketing.
For example “the Cookie settings link in the footer”.
Checklist
Consent requirements and anything the generator could not read.
- CoveredTapCub analytics in anonymous mode writes nothing to the browser, so it adds a paragraph but no cookie row.
- CoveredEach cookie row gives its duration and whether a third party sets it, the details the EU Court of Justice said must be given in Planet49 (C-673/17).
Preview
Cookie Policy
Northwind · Last updated: 2026-11-11
This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our Privacy Policy.
1. What cookies and similar technologies are
A cookie is a small text file a website stores in your browser and reads on later visits. First-party cookies are set by the site you are visiting; third-party cookies are set by another domain, such as an embedded video or an advertising service. Session cookies are deleted when you close the browser; persistent cookies stay until they expire or you delete them.
Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.
2. How we use cookies
- Strictly necessary. Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.
- Preferences. Remember choices you make, such as language or region, so you do not have to set them again.
- Marketing. Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.
We set strictly necessary cookies because the site cannot work without them. We only set the other categories after you agree in our cookie banner, and you can choose each category separately.
3. The cookies we use
Strictly necessary
| Name | Provider | Purpose | Duration | Where it is stored |
|---|---|---|---|---|
session_id | Northwind | Keeps you signed in | Session | Your browser (first-party cookie) |
cart | Northwind | Remembers the items in your cart | 30 days | Your browser (first-party cookie) |
cookie_consent | Northwind | Remembers your cookie choices | 6 months | Your browser (first-party cookie) |
tc_chat_<site-key> | TapCub | Written only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation | 24 hours without chat activity (30 days if you choose to remember the conversation) | Local storage |
__stripe_mid | Stripe | Fraud prevention for payments | 1 year | Your browser (first-party cookie) |
__stripe_sid | Stripe | Fraud prevention for payments | 30 minutes | Your browser (first-party cookie) |
Preferences
| Name | Provider | Purpose | Duration | Where it is stored |
|---|---|---|---|---|
lang | Northwind | Remembers your language | 1 year | Your browser (first-party cookie) |
Marketing
| Name | Provider | Purpose | Duration | Where it is stored |
|---|---|---|---|---|
_gcl_au | Google (Google Ads) | Measures ad conversions on this site | 90 days | Your browser (first-party cookie) |
_gcl_aw | Google (Google Ads) | Stores the Google Ads click that brought you here | 90 days | Your browser (first-party cookie) |
YSC | Google (YouTube embeds) | Security | Session | Your browser (third-party cookie, youtube.com) |
VISITOR_INFO1_LIVE | Google (YouTube embeds) | Security and advertising | 180 days | Your browser (third-party cookie, youtube.com) |
Analytics without cookies (TapCub)
We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.
If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.
Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.
4. How to manage cookies
When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.
You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.
5. Third-party providers
These providers set their own cookies when we use their services, and handle the data under their own policies:
- Stripe: cookie and privacy information
- Google (Google Ads): cookie and privacy information
- Google (YouTube embeds): cookie and privacy information
6. Changes to this policy
We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.
7. Contact
Questions about cookies: privacy@northwind.example.
<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->
# Cookie Policy
**Northwind** · Last updated: 2026-11-11
This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our [Privacy Policy](https://northwind.example/privacy).
## 1. What cookies and similar technologies are
A cookie is a small text file a website stores in your browser and reads on later visits. **First-party** cookies are set by the site you are visiting; **third-party** cookies are set by another domain, such as an embedded video or an advertising service. **Session** cookies are deleted when you close the browser; **persistent** cookies stay until they expire or you delete them.
Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.
## 2. How we use cookies
- **Strictly necessary.** Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.
- **Preferences.** Remember choices you make, such as language or region, so you do not have to set them again.
- **Marketing.** Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.
We set strictly necessary cookies because the site cannot work without them. **We only set the other categories after you agree in our cookie banner**, and you can choose each category separately.
## 3. The cookies we use
### Strictly necessary
| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `session_id` | Northwind | Keeps you signed in | Session | Your browser (first-party cookie) |
| `cart` | Northwind | Remembers the items in your cart | 30 days | Your browser (first-party cookie) |
| `cookie_consent` | Northwind | Remembers your cookie choices | 6 months | Your browser (first-party cookie) |
| `tc_chat_<site-key>` | TapCub | Written only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation | 24 hours without chat activity (30 days if you choose to remember the conversation) | Local storage |
| `__stripe_mid` | Stripe | Fraud prevention for payments | 1 year | Your browser (first-party cookie) |
| `__stripe_sid` | Stripe | Fraud prevention for payments | 30 minutes | Your browser (first-party cookie) |
### Preferences
| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `lang` | Northwind | Remembers your language | 1 year | Your browser (first-party cookie) |
### Marketing
| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `_gcl_au` | Google (Google Ads) | Measures ad conversions on this site | 90 days | Your browser (first-party cookie) |
| `_gcl_aw` | Google (Google Ads) | Stores the Google Ads click that brought you here | 90 days | Your browser (first-party cookie) |
| `YSC` | Google (YouTube embeds) | Security | Session | Your browser (third-party cookie, youtube.com) |
| `VISITOR_INFO1_LIVE` | Google (YouTube embeds) | Security and advertising | 180 days | Your browser (third-party cookie, youtube.com) |
### Analytics without cookies (TapCub)
We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.
If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.
Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.
## 4. How to manage cookies
When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.
You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.
## 5. Third-party providers
These providers set their own cookies when we use their services, and handle the data under their own policies:
- Stripe: [cookie and privacy information](https://stripe.com/cookie-settings)
- Google (Google Ads): [cookie and privacy information](https://policies.google.com/technologies/cookies)
- Google (YouTube embeds): [cookie and privacy information](https://policies.google.com/technologies/cookies)
## 6. Changes to this policy
We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.
## 7. Contact
Questions about cookies: [privacy@northwind.example](mailto:privacy@northwind.example).
For static sites, docs tools and editors that accept Markdown.
<article lang="en" class="policy">
<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->
<h1>Cookie Policy</h1>
<p><strong>Northwind</strong> · Last updated: 2026-11-11</p>
<p>This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our <a href="https://northwind.example/privacy">Privacy Policy</a>.</p>
<h2>1. What cookies and similar technologies are</h2>
<p>A cookie is a small text file a website stores in your browser and reads on later visits. <strong>First-party</strong> cookies are set by the site you are visiting; <strong>third-party</strong> cookies are set by another domain, such as an embedded video or an advertising service. <strong>Session</strong> cookies are deleted when you close the browser; <strong>persistent</strong> cookies stay until they expire or you delete them.</p>
<p>Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.</p>
<h2>2. How we use cookies</h2>
<ul><li><strong>Strictly necessary.</strong> Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.</li><li><strong>Preferences.</strong> Remember choices you make, such as language or region, so you do not have to set them again.</li><li><strong>Marketing.</strong> Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.</li></ul>
<p>We set strictly necessary cookies because the site cannot work without them. <strong>We only set the other categories after you agree in our cookie banner</strong>, and you can choose each category separately.</p>
<h2>3. The cookies we use</h2>
<h3>Strictly necessary</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>session_id</code></td><td>Northwind</td><td>Keeps you signed in</td><td>Session</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>cart</code></td><td>Northwind</td><td>Remembers the items in your cart</td><td>30 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>cookie_consent</code></td><td>Northwind</td><td>Remembers your cookie choices</td><td>6 months</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>tc_chat_<site-key></code></td><td>TapCub</td><td>Written only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation</td><td>24 hours without chat activity (30 days if you choose to remember the conversation)</td><td>Local storage</td></tr><tr><td><code>__stripe_mid</code></td><td>Stripe</td><td>Fraud prevention for payments</td><td>1 year</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>__stripe_sid</code></td><td>Stripe</td><td>Fraud prevention for payments</td><td>30 minutes</td><td>Your browser (first-party cookie)</td></tr></tbody></table></div>
<h3>Preferences</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>lang</code></td><td>Northwind</td><td>Remembers your language</td><td>1 year</td><td>Your browser (first-party cookie)</td></tr></tbody></table></div>
<h3>Marketing</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>_gcl_au</code></td><td>Google (Google Ads)</td><td>Measures ad conversions on this site</td><td>90 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>_gcl_aw</code></td><td>Google (Google Ads)</td><td>Stores the Google Ads click that brought you here</td><td>90 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>YSC</code></td><td>Google (YouTube embeds)</td><td>Security</td><td>Session</td><td>Your browser (third-party cookie, youtube.com)</td></tr><tr><td><code>VISITOR_INFO1_LIVE</code></td><td>Google (YouTube embeds)</td><td>Security and advertising</td><td>180 days</td><td>Your browser (third-party cookie, youtube.com)</td></tr></tbody></table></div>
<h3>Analytics without cookies (TapCub)</h3>
<p>We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.</p>
<p>If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.</p>
<p>Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.</p>
<h2>4. How to manage cookies</h2>
<p>When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.</p>
<p>You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.</p>
<h2>5. Third-party providers</h2>
<p>These providers set their own cookies when we use their services, and handle the data under their own policies:</p>
<ul><li>Stripe: <a href="https://stripe.com/cookie-settings">cookie and privacy information</a></li><li>Google (Google Ads): <a href="https://policies.google.com/technologies/cookies">cookie and privacy information</a></li><li>Google (YouTube embeds): <a href="https://policies.google.com/technologies/cookies">cookie and privacy information</a></li></ul>
<h2>6. Changes to this policy</h2>
<p>We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.</p>
<h2>7. Contact</h2>
<p>Questions about cookies: <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>.</p>
</article>
An HTML fragment with tables, to paste into your CMS or page template.
Version v1.0Updated Update history
Reading the cookie table
Each column answers a question a regulator or a curious visitor would ask.
Category
Strictly necessary cookies can be set without consent in the EU and UK; preferences, analytics and marketing cookies need a “yes” first. The category is your claim, so be honest: an ad cookie is not “necessary” because you need the revenue.
Provider and where it is stored
First-party cookies are set on your own domain, even if a third-party script writes them (like _ga). Third-party cookies live on another domain, such as youtube.com. Local and session storage are listed too, because the same rules apply to them.
Duration
The maximum the provider sets. “Not stated by the provider” means we did not find it in official documentation; check the actual expiry in your browser before you replace it with a number.
The checklist
Flags cookies that need consent when you have no banner, provider-specific notes, and lines in your own list it could not read, with the line number.
Cookies change when you add a tool or a provider updates its tag. Re-check the table whenever your site changes.
Build the table from what your site really sets
Start from the browser, not from memory.
-
1
Inspect your site
Open it in a private window, accept all cookies, and look at developer tools → Application → Cookies, Local storage and Session storage. Note every name and its domain.
-
2
Tick the services and add the rest
Tick the services listed here; add your own cookies, and those of any other tool, one per line as name | provider | category | duration | purpose.
-
3
Choose the consent setup
Pick whether you use a banner, and where visitors can change their mind later. The cookie banner generator makes a banner that matches.
-
4
Publish and link it
Publish at a stable address such as /cookies, link it from the banner and the footer, and update it with each new tool.
Consent, information and the exemption
The rules below decide which rows need consent and what each row must say.
- ePrivacy Directive 2002/58/EC Art. 5(3): storing or reading information on a device needs consent based on clear and comprehensive information, unless it is strictly necessary for a service the user asked for
- CJEU Planet49 (C-673/17, 2019): a pre-ticked box is not valid consent, and users must be told how long cookies last and whether third parties can access them
- GDPR Art. 7: consent must be as easy to withdraw as to give; the EDPB consent guidelines 05/2020 and France’s CNIL expect refusing to be as easy as accepting
- China PIPL Art. 14 and 15: consent must be informed, voluntary and explicit, and easy to withdraw; cookie identifiers that can identify someone are personal information
| Category | Examples | Prior consent? |
|---|---|---|
| Strictly necessary | Sign-in session, cart, consent choice, payment fraud prevention | No |
| Preferences | Language, region, layout | Yes, unless the user explicitly asked for it |
| Analytics | GA4, Clarity, Baidu Tongji, TapCub identification mode | Yes |
| Marketing | Google Ads, Meta Pixel, embedded YouTube | Yes |
| Nothing stored | TapCub analytics in anonymous mode | Not for storage; other rules may still apply |
The default example, row by row
Northwind runs TapCub analytics and chat, Google Ads, embedded YouTube videos and Stripe checkout, plus four cookies of its own. This is the table the generator writes.
| Name | Category | Duration | Source |
|---|---|---|---|
session_id, cart, cookie_consent | Strictly necessary | Session, 30 days, 6 months | Typed in by the site owner |
tc_chat_<site-key> | Strictly necessary | 24 hours without chat activity (30 days if remembered) | TapCub chat widget code |
__stripe_mid, __stripe_sid | Strictly necessary | 1 year, 30 minutes | Stripe cookie settings page |
lang | Preferences | 1 year | Typed in by the site owner |
_gcl_au, _gcl_aw | Marketing | 90 days each | Google’s advertising cookies page |
YSC, VISITOR_INFO1_LIVE | Marketing (third-party, youtube.com) | Session, 180 days | Google’s advertising cookies page |
| TapCub analytics | No row | Nothing stored | Explained in a paragraph instead |
If Northwind switched TapCub to identification mode, rows for tc_did, tc_consent / tc_optout and three session-storage keys would appear under analytics and necessary.
Cookie policies that do not match the site
Cookie checks are easy to automate, so mismatches are easy to find.
Copying a generic list
A list of cookies you do not set, missing the ones you do, fails the one job a cookie policy has. Build it from your browser’s storage view.
Calling ad cookies “necessary”
Strictly necessary means needed for what the user asked for. Analytics and advertising cookies do not qualify, however useful they are to you.
Guessing durations
Write the duration the provider documents, or say it is not published. Browsers also cap them: Chrome has not allowed cookie expiry dates more than 400 days ahead since version 104 (2022).
Forgetting local storage and pixels
The consent rule covers any storing or reading on the device, not only cookies. List local storage, session storage and tracking pixels too.
Analytics that adds no rows to your cookie table
In its default mode TapCub analytics stores nothing in the browser, so it does not add a cookie to declare.
Cookieless by default
No cookie and no local storage in anonymous mode; visits are told apart by a keyed hash computed on the server.
Learn moreConsent when you need identities
Identification mode waits for your banner’s consent before it stores a device ID; visitors who decline are counted anonymously.
Learn moreEvery storage item documented
TapCub’s cookie page lists everything the website, console, script and chat widget write, with durations.
Learn moreCookie policy questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
Is this cookie policy generator free?
Yes, with no sign-up and no watermark. The policy is generated in your browser and nothing you type is sent to TapCub.
Do I need a cookie policy?
If your site stores or reads anything on visitors’ devices, the EU and UK rules require clear information about it, and in practice that means a cookie policy or a cookie section in your privacy policy. If your site really stores nothing, a short statement saying so is still helpful.
What is the difference between a cookie policy and a cookie banner?
The banner asks for consent at the moment it matters; the policy is the detailed information behind it. You usually need both, and the banner should link to the policy. Make a banner with the cookie banner generator.
Where do the cookie durations come from?
From each provider’s own documentation, checked on the date shown in our notes: Google’s Analytics and advertising cookie pages, Meta’s developer docs, Microsoft’s Clarity docs and Stripe’s cookie settings. Where a provider publishes no duration, the table says so rather than guessing.
Does TapCub analytics need to be in my cookie policy?
In the default anonymous mode the script writes no cookies and nothing to local storage, so it has no row in the table; the generator adds a short paragraph explaining how visits are counted instead. In identification mode it stores a device ID after consent, and the generator lists those items.
How often should I update the cookie policy?
Whenever you add or remove a tool, and at least on a regular review cycle, because providers change their cookies. Change the date at the top when you do.
Do cookieless tools mean I need no banner at all?
Only if nothing else on your site needs consent. Embedded videos, ad pixels and many chat or analytics tools set cookies; each of those still needs a consent decision.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Data this tool relies on
- Third-party cookie names and lifetimes — checked 2026-11-10, reviewed every 6 months (next review by 2027-05-10)
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Fewer cookies to declare, fewer reasons for a banner
TapCub analytics sets no cookies by default, and the chat widget stores one token only after a visitor starts a conversation.