Most new site owners get the cookie banner working, connect Google Analytics, and consider the job done. The cookie policy page — the document actually explaining what cookies the site uses and why — often gets skipped entirely, or filled in with a copied template that doesn’t match the site’s real setup. That creates two real problems: many consent banner plugins require a linked policy page to function correctly, and a policy that doesn’t match what’s actually running is a basic transparency gap the moment anyone reads it carefully.
Creating one properly doesn’t need to be complicated. A short, accurate page that matches your real setup is worth more than a lengthy generic document listing categories you don’t use — and it’s more likely to survive scrutiny if anyone ever checks.
What Belongs on the Page
Create a new WordPress page titled Cookie Policy at a /cookie-policy/ slug, and don’t publish it as a placeholder — have the real content ready first. Open with one short paragraph explaining what cookies actually are: small files stored in a visitor’s browser that let a website remember information between pages or sessions. No need to go deeper than that.
The core of the page is listing the cookies your site genuinely uses, broken into only the categories that actually apply. Essential cookies — login sessions, security tokens, basic functionality — are always active regardless of consent. Analytics cookies, most commonly Google Analytics on smaller sites, track how visitors use the site. Marketing or advertising cookies only belong here if you’re actually running ads or tracking pixels — most small sites shouldn’t include this section at all. Including a marketing category when nothing marketing-related is installed isn’t just unnecessary, it’s the kind of inconsistency that makes the whole page look careless to anyone who reads it closely. Name the specific tools active under each category — Google Analytics, Google Tag Manager, a consent plugin — briefly rather than in technical detail; you’re being transparent, not writing documentation.
Close with a short section on how visitors can manage or refuse cookies: accepting or rejecting non-essential cookies through your cookie consent banner, changing browser settings to block or clear cookies, and returning to the banner at any time to change their choice if you’re using a consent plugin that supports it.
Linking It Where It Actually Gets Found
A cookie policy is only useful if visitors can find it. Link it from your footer alongside the privacy policy and terms, from the cookie consent banner directly (most consent plugins have a dedicated field for the policy URL), and from your privacy policy wherever it mentions cookies in its broader data section — the two shouldn’t contradict each other. Footer and consent banner placement are the two non-negotiable spots; a policy buried in a sub-menu that nothing else links to isn’t doing its job.
Treat it as part of the same legal foundation as a privacy policy and terms and conditions page, and publish it before you start collecting any visitor data — it’s straightforward to handle at launch and awkward to retrofit once a site is already indexed and running.
A worked example is easier to copy than an abstract instruction. For a typical small WordPress site running Google Analytics and nothing else, the cookie list section can be genuinely short: one essential cookie for the WordPress session itself, one or two Google Analytics cookies (_ga and _ga_*, each configured for a two-year lifespan by default — though Chrome and Safari both cap first-party cookies at 400 days regardless of what a site sets) under Analytics, and no marketing section at all. That’s the entire substantive content of the page for most sites in this position — the surrounding explanation and management instructions are what pad it out, not a long cookie inventory.
Writing It Yourself vs Using a Plugin
For a straightforward blog or portfolio with basic analytics and nothing else, writing the page manually gives full control and takes under an hour — there’s no reason to add a plugin for a simple cookie setup. For an ecommerce site, multiple tracking tools, or active ad campaigns, a plugin is the more practical choice: CookieYes (actively maintained, updated within days of this review) scans your site for active cookies, generates the policy page automatically, and keeps it synced with your consent management setup as tools change. That’s a genuine time saving once manual maintenance stops being realistic.
Whichever route you take, keep the page current — add a new analytics tool or a cookie-setting plugin, and update the policy to match. An inaccurate policy is worse than a minimal one; it creates a documented inconsistency between what you say the site does and what it actually does.
The EU’s Cookie Consent Rules Are Changing — Not Yet, But Worth Watching
None of the above changes today, but it’s worth knowing what’s coming. The EU withdrew its long-planned ePrivacy Regulation in February 2025 and replaced it with a “Digital Omnibus” proposal that would fold cookie consent rules directly into the GDPR. As drafted, it would require single-click reject buttons, ban re-asking for consent within six months of a refusal, and — the most disruptive change for how banners work — require sites to honour a browser-level consent signal, letting a visitor set their preference once and have every site respect it automatically. As of mid-2026 this is still in trilogue negotiation between the European Parliament, Council, and Commission, with the browser-signal provision specifically dropped from the Council’s position in June 2026 after industry lobbying, and no final text adopted. None of it is enforceable yet — the existing consent-banner-per-site model is still what your policy page and banner need to match — but it’s the kind of change worth revisiting this page for once (or if) it actually passes.
A cookie policy page only needs to do one thing well: accurately describe how your site uses cookies. Write it to match your actual setup, link it where visitors will actually see it, and update it when your tools change. If you’re still setting up the rest of the site around it, the step-by-step guide to building a WordPress website covers hosting through legal pages in sequence.
Etienne Basson works with website systems, SEO-driven site architecture, and technical implementation. He writes practical guides on building, structuring, and optimizing websites for long-term growth.