TapCub is live — analytics, insights and live chat, free on one platform

Free tool Cookie policy generator: a cookie policy template with your real cookies

A cookie policy is only useful if its table is right: the name of each cookie, who sets it, why, how long it lasts and whether it is first- or third-party. Tick the services on your site and the generator fills in their cookies from each provider’s own documentation, marking durations the provider does not publish instead of guessing. Add your own cookies one per line, choose how visitors give consent, and download the policy as Markdown or HTML.

  • Names and durations from official docs
  • Template, not legal advice
  • Generated in your browser
Generator

List what your site stores, get the policy

Every change rewrites the policy. The checklist flags cookies that need consent and lines it could not read.

This is a template, not legal advice. Check the cookie table against what your site actually sets (developer tools → Application → Cookies and Storage) and have the text reviewed before you publish it.

About you

English or Chinese; each is written for its own readers, not translated.

YYYY-MM-DD. Leave empty for today.

The cookie policy links to it. No privacy policy yet? Use the privacy policy generator.

TapCub

Check Compliance centre in your TapCub site settings.

Third-party services

Your own cookies and consent

One per line: name | provider | category | duration | purpose. Category is necessary, preferences, analytics or marketing.

For example “the Cookie settings link in the footer”.

Checklist

Consent requirements and anything the generator could not read.

  • CoveredTapCub analytics in anonymous mode writes nothing to the browser, so it adds a paragraph but no cookie row.
  • CoveredEach cookie row gives its duration and whether a third party sets it, the details the EU Court of Justice said must be given in Planet49 (C-673/17).

Preview

Cookie Policy

Northwind · Last updated: 2026-11-11

This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our Privacy Policy.

1. What cookies and similar technologies are

A cookie is a small text file a website stores in your browser and reads on later visits. First-party cookies are set by the site you are visiting; third-party cookies are set by another domain, such as an embedded video or an advertising service. Session cookies are deleted when you close the browser; persistent cookies stay until they expire or you delete them.

Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.

2. How we use cookies

  • Strictly necessary. Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.
  • Preferences. Remember choices you make, such as language or region, so you do not have to set them again.
  • Marketing. Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.

We set strictly necessary cookies because the site cannot work without them. We only set the other categories after you agree in our cookie banner, and you can choose each category separately.

3. The cookies we use

Strictly necessary

NameProviderPurposeDurationWhere it is stored
session_idNorthwindKeeps you signed inSessionYour browser (first-party cookie)
cartNorthwindRemembers the items in your cart30 daysYour browser (first-party cookie)
cookie_consentNorthwindRemembers your cookie choices6 monthsYour browser (first-party cookie)
tc_chat_<site-key>TapCubWritten only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation24 hours without chat activity (30 days if you choose to remember the conversation)Local storage
__stripe_midStripeFraud prevention for payments1 yearYour browser (first-party cookie)
__stripe_sidStripeFraud prevention for payments30 minutesYour browser (first-party cookie)

Preferences

NameProviderPurposeDurationWhere it is stored
langNorthwindRemembers your language1 yearYour browser (first-party cookie)

Marketing

NameProviderPurposeDurationWhere it is stored
_gcl_auGoogle (Google Ads)Measures ad conversions on this site90 daysYour browser (first-party cookie)
_gcl_awGoogle (Google Ads)Stores the Google Ads click that brought you here90 daysYour browser (first-party cookie)
YSCGoogle (YouTube embeds)SecuritySessionYour browser (third-party cookie, youtube.com)
VISITOR_INFO1_LIVEGoogle (YouTube embeds)Security and advertising180 daysYour browser (third-party cookie, youtube.com)

Analytics without cookies (TapCub)

We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.

If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.

Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.

4. How to manage cookies

When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.

5. Third-party providers

These providers set their own cookies when we use their services, and handle the data under their own policies:

6. Changes to this policy

We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.

7. Contact

Questions about cookies: privacy@northwind.example.

Markdown
<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->

# Cookie Policy

**Northwind** · Last updated: 2026-11-11

This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our [Privacy Policy](https://northwind.example/privacy).

## 1. What cookies and similar technologies are

A cookie is a small text file a website stores in your browser and reads on later visits. **First-party** cookies are set by the site you are visiting; **third-party** cookies are set by another domain, such as an embedded video or an advertising service. **Session** cookies are deleted when you close the browser; **persistent** cookies stay until they expire or you delete them.

Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.

## 2. How we use cookies

- **Strictly necessary.** Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.
- **Preferences.** Remember choices you make, such as language or region, so you do not have to set them again.
- **Marketing.** Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.

We set strictly necessary cookies because the site cannot work without them. **We only set the other categories after you agree in our cookie banner**, and you can choose each category separately.

## 3. The cookies we use

### Strictly necessary

| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `session_id` | Northwind | Keeps you signed in | Session | Your browser (first-party cookie) |
| `cart` | Northwind | Remembers the items in your cart | 30 days | Your browser (first-party cookie) |
| `cookie_consent` | Northwind | Remembers your cookie choices | 6 months | Your browser (first-party cookie) |
| `tc_chat_<site-key>` | TapCub | Written only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation | 24 hours without chat activity (30 days if you choose to remember the conversation) | Local storage |
| `__stripe_mid` | Stripe | Fraud prevention for payments | 1 year | Your browser (first-party cookie) |
| `__stripe_sid` | Stripe | Fraud prevention for payments | 30 minutes | Your browser (first-party cookie) |

### Preferences

| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `lang` | Northwind | Remembers your language | 1 year | Your browser (first-party cookie) |

### Marketing

| Name | Provider | Purpose | Duration | Where it is stored |
| --- | --- | --- | --- | --- |
| `_gcl_au` | Google (Google Ads) | Measures ad conversions on this site | 90 days | Your browser (first-party cookie) |
| `_gcl_aw` | Google (Google Ads) | Stores the Google Ads click that brought you here | 90 days | Your browser (first-party cookie) |
| `YSC` | Google (YouTube embeds) | Security | Session | Your browser (third-party cookie, youtube.com) |
| `VISITOR_INFO1_LIVE` | Google (YouTube embeds) | Security and advertising | 180 days | Your browser (third-party cookie, youtube.com) |

### Analytics without cookies (TapCub)

We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.

If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.

Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.

## 4. How to manage cookies

When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.

## 5. Third-party providers

These providers set their own cookies when we use their services, and handle the data under their own policies:

- Stripe: [cookie and privacy information](https://stripe.com/cookie-settings)
- Google (Google Ads): [cookie and privacy information](https://policies.google.com/technologies/cookies)
- Google (YouTube embeds): [cookie and privacy information](https://policies.google.com/technologies/cookies)

## 6. Changes to this policy

We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.

## 7. Contact

Questions about cookies: [privacy@northwind.example](mailto:privacy@northwind.example).

For static sites, docs tools and editors that accept Markdown.

HTML
<article lang="en" class="policy">
<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->
<h1>Cookie Policy</h1>
<p><strong>Northwind</strong> · Last updated: 2026-11-11</p>
<p>This policy explains how Northwind Trading Ltd uses cookies and similar technologies on Northwind (https://northwind.example): what they are, which ones we use, why, how long they last and how you can control them. How we handle personal data in general is explained in our <a href="https://northwind.example/privacy">Privacy Policy</a>.</p>
<h2>1. What cookies and similar technologies are</h2>
<p>A cookie is a small text file a website stores in your browser and reads on later visits. <strong>First-party</strong> cookies are set by the site you are visiting; <strong>third-party</strong> cookies are set by another domain, such as an embedded video or an advertising service. <strong>Session</strong> cookies are deleted when you close the browser; <strong>persistent</strong> cookies stay until they expire or you delete them.</p>
<p>Websites can also store information in your browser with local storage and session storage, or load small pieces of code (pixels or tags) from other services. In this policy, “cookies” covers all of these.</p>
<h2>2. How we use cookies</h2>
<ul><li><strong>Strictly necessary.</strong> Needed for the site to work or to provide something you asked for, such as signing in, a shopping cart or remembering your cookie choice. They cannot be switched off in our banner.</li><li><strong>Preferences.</strong> Remember choices you make, such as language or region, so you do not have to set them again.</li><li><strong>Marketing.</strong> Used by advertising platforms to measure our ads and to show you ads, on this site and elsewhere. They may build a profile of your interests.</li></ul>
<p>We set strictly necessary cookies because the site cannot work without them. <strong>We only set the other categories after you agree in our cookie banner</strong>, and you can choose each category separately.</p>
<h2>3. The cookies we use</h2>
<h3>Strictly necessary</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>session_id</code></td><td>Northwind</td><td>Keeps you signed in</td><td>Session</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>cart</code></td><td>Northwind</td><td>Remembers the items in your cart</td><td>30 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>cookie_consent</code></td><td>Northwind</td><td>Remembers your cookie choices</td><td>6 months</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>tc_chat_&lt;site-key&gt;</code></td><td>TapCub</td><td>Written only after you open the chat window: keeps the session token so a refresh or a new tab continues the same conversation</td><td>24 hours without chat activity (30 days if you choose to remember the conversation)</td><td>Local storage</td></tr><tr><td><code>__stripe_mid</code></td><td>Stripe</td><td>Fraud prevention for payments</td><td>1 year</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>__stripe_sid</code></td><td>Stripe</td><td>Fraud prevention for payments</td><td>30 minutes</td><td>Your browser (first-party cookie)</td></tr></tbody></table></div>
<h3>Preferences</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>lang</code></td><td>Northwind</td><td>Remembers your language</td><td>1 year</td><td>Your browser (first-party cookie)</td></tr></tbody></table></div>
<h3>Marketing</h3>
<div class="table-scroll"><table><thead><tr><th>Name</th><th>Provider</th><th>Purpose</th><th>Duration</th><th>Where it is stored</th></tr></thead><tbody><tr><td><code>_gcl_au</code></td><td>Google (Google Ads)</td><td>Measures ad conversions on this site</td><td>90 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>_gcl_aw</code></td><td>Google (Google Ads)</td><td>Stores the Google Ads click that brought you here</td><td>90 days</td><td>Your browser (first-party cookie)</td></tr><tr><td><code>YSC</code></td><td>Google (YouTube embeds)</td><td>Security</td><td>Session</td><td>Your browser (third-party cookie, youtube.com)</td></tr><tr><td><code>VISITOR_INFO1_LIVE</code></td><td>Google (YouTube embeds)</td><td>Security and advertising</td><td>180 days</td><td>Your browser (third-party cookie, youtube.com)</td></tr></tbody></table></div>
<h3>Analytics without cookies (TapCub)</h3>
<p>We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.</p>
<p>If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.</p>
<p>Durations are the maximum the provider sets; some browsers shorten them. Third-party providers may change their cookies; their own policies are linked below.</p>
<h2>4. How to manage cookies</h2>
<p>When you first visit, our banner lets you accept or reject each optional category; rejecting is as easy as accepting, and nothing is pre-selected. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect anything that happened before.</p>
<p>You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, such as signing in or checkout, may stop working.</p>
<h2>5. Third-party providers</h2>
<p>These providers set their own cookies when we use their services, and handle the data under their own policies:</p>
<ul><li>Stripe: <a href="https://stripe.com/cookie-settings">cookie and privacy information</a></li><li>Google (Google Ads): <a href="https://policies.google.com/technologies/cookies">cookie and privacy information</a></li><li>Google (YouTube embeds): <a href="https://policies.google.com/technologies/cookies">cookie and privacy information</a></li></ul>
<h2>6. Changes to this policy</h2>
<p>We update this policy when we add, remove or change cookies. The date at the top shows when it last changed. If we add a cookie that needs your consent, we will ask you again.</p>
<h2>7. Contact</h2>
<p>Questions about cookies: <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>.</p>
</article>

An HTML fragment with tables, to paste into your CMS or page template.

Runs entirely in your browser. Nothing you type here is uploaded or stored by TapCub.

Version v1.0Updated Update history

Read the result

Reading the cookie table

Each column answers a question a regulator or a curious visitor would ask.

Category

Strictly necessary cookies can be set without consent in the EU and UK; preferences, analytics and marketing cookies need a “yes” first. The category is your claim, so be honest: an ad cookie is not “necessary” because you need the revenue.

Provider and where it is stored

First-party cookies are set on your own domain, even if a third-party script writes them (like _ga). Third-party cookies live on another domain, such as youtube.com. Local and session storage are listed too, because the same rules apply to them.

Duration

The maximum the provider sets. “Not stated by the provider” means we did not find it in official documentation; check the actual expiry in your browser before you replace it with a number.

The checklist

Flags cookies that need consent when you have no banner, provider-specific notes, and lines in your own list it could not read, with the line number.

Cookies change when you add a tool or a provider updates its tag. Re-check the table whenever your site changes.

How to use it

Build the table from what your site really sets

Start from the browser, not from memory.

  1. 1

    Inspect your site

    Open it in a private window, accept all cookies, and look at developer tools → Application → Cookies, Local storage and Session storage. Note every name and its domain.

  2. 2

    Tick the services and add the rest

    Tick the services listed here; add your own cookies, and those of any other tool, one per line as name | provider | category | duration | purpose.

  3. 3

    Choose the consent setup

    Pick whether you use a banner, and where visitors can change their mind later. The cookie banner generator makes a banner that matches.

  4. 4

    Publish and link it

    Publish at a stable address such as /cookies, link it from the banner and the footer, and update it with each new tool.

What the rules ask for

Consent, information and the exemption

The rules below decide which rows need consent and what each row must say.

  • ePrivacy Directive 2002/58/EC Art. 5(3): storing or reading information on a device needs consent based on clear and comprehensive information, unless it is strictly necessary for a service the user asked for
  • CJEU Planet49 (C-673/17, 2019): a pre-ticked box is not valid consent, and users must be told how long cookies last and whether third parties can access them
  • GDPR Art. 7: consent must be as easy to withdraw as to give; the EDPB consent guidelines 05/2020 and France’s CNIL expect refusing to be as easy as accepting
  • China PIPL Art. 14 and 15: consent must be informed, voluntary and explicit, and easy to withdraw; cookie identifiers that can identify someone are personal information
Which category needs consent in the EU and UK
CategoryExamplesPrior consent?
Strictly necessarySign-in session, cart, consent choice, payment fraud preventionNo
PreferencesLanguage, region, layoutYes, unless the user explicitly asked for it
AnalyticsGA4, Clarity, Baidu Tongji, TapCub identification modeYes
MarketingGoogle Ads, Meta Pixel, embedded YouTubeYes
Nothing storedTapCub analytics in anonymous modeNot for storage; other rules may still apply
Worked example

The default example, row by row

Northwind runs TapCub analytics and chat, Google Ads, embedded YouTube videos and Stripe checkout, plus four cookies of its own. This is the table the generator writes.

Cookies and storage on the example site
NameCategoryDurationSource
session_id, cart, cookie_consentStrictly necessarySession, 30 days, 6 monthsTyped in by the site owner
tc_chat_<site-key>Strictly necessary24 hours without chat activity (30 days if remembered)TapCub chat widget code
__stripe_mid, __stripe_sidStrictly necessary1 year, 30 minutesStripe cookie settings page
langPreferences1 yearTyped in by the site owner
_gcl_au, _gcl_awMarketing90 days eachGoogle’s advertising cookies page
YSC, VISITOR_INFO1_LIVEMarketing (third-party, youtube.com)Session, 180 daysGoogle’s advertising cookies page
TapCub analyticsNo rowNothing storedExplained in a paragraph instead

If Northwind switched TapCub to identification mode, rows for tc_did, tc_consent / tc_optout and three session-storage keys would appear under analytics and necessary.

Common mistakes

Cookie policies that do not match the site

Cookie checks are easy to automate, so mismatches are easy to find.

Copying a generic list

A list of cookies you do not set, missing the ones you do, fails the one job a cookie policy has. Build it from your browser’s storage view.

Calling ad cookies “necessary”

Strictly necessary means needed for what the user asked for. Analytics and advertising cookies do not qualify, however useful they are to you.

Guessing durations

Write the duration the provider documents, or say it is not published. Browsers also cap them: Chrome has not allowed cookie expiry dates more than 400 days ahead since version 104 (2022).

Forgetting local storage and pixels

The consent rule covers any storing or reading on the device, not only cookies. List local storage, session storage and tracking pixels too.

FAQ

Cookie policy questions

Still have a question?

Chat with the team behind TapCub — we usually reply within a few hours on business days.

Is this cookie policy generator free?

Yes, with no sign-up and no watermark. The policy is generated in your browser and nothing you type is sent to TapCub.

Do I need a cookie policy?

If your site stores or reads anything on visitors’ devices, the EU and UK rules require clear information about it, and in practice that means a cookie policy or a cookie section in your privacy policy. If your site really stores nothing, a short statement saying so is still helpful.

What is the difference between a cookie policy and a cookie banner?

The banner asks for consent at the moment it matters; the policy is the detailed information behind it. You usually need both, and the banner should link to the policy. Make a banner with the cookie banner generator.

Where do the cookie durations come from?

From each provider’s own documentation, checked on the date shown in our notes: Google’s Analytics and advertising cookie pages, Meta’s developer docs, Microsoft’s Clarity docs and Stripe’s cookie settings. Where a provider publishes no duration, the table says so rather than guessing.

Does TapCub analytics need to be in my cookie policy?

In the default anonymous mode the script writes no cookies and nothing to local storage, so it has no row in the table; the generator adds a short paragraph explaining how visits are counted instead. In identification mode it stores a device ID after consent, and the generator lists those items.

How often should I update the cookie policy?

Whenever you add or remove a tool, and at least on a regular review cycle, because providers change their cookies. Change the date at the top when you do.

Do cookieless tools mean I need no banner at all?

Only if nothing else on your site needs consent. Embedded videos, ad pixels and many chat or analytics tools set cookies; each of those still needs a consent decision.

Changelog

Update history

New features, fixes and data refreshes for this tool, newest first.

  1. · v1.0

    LaunchedFirst release.

Data this tool relies on

  • Third-party cookie names and lifetimes — checked 2026-11-10, reviewed every 6 months (next review by 2027-05-10)

Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates

Next step

Fewer cookies to declare, fewer reasons for a banner

TapCub analytics sets no cookies by default, and the chat widget stores one token only after a visitor starts a conversation.

See your data clearly. Find your growth.

Every click, backed by data. Install one line of code and see your first numbers in a minute.

No credit card · Free plans for analytics and chat · Cookieless analytics