# Your Cookie Policy Page: What Regulators Expect It to Actually List Source: https://cookiecitadel.com/blog/2026-11-14-cookie-policy-what-it-must-list.html [Home](../index.md) / [Blog](index.md) / Your Cookie Policy Page: What Regulators Expect It to Actually List Published 2026-11-14 Open any cookie policy and you will find the same shape: four categories, a paragraph about what cookies are, and a link to the banner settings. Read it as a regulator would and it fails the first test. The ePrivacy Directive requires clear and comprehensive information as a precondition for valid consent, and the GDPR's transparency rules require the information to be concise, intelligible, in clear and plain language, and easily accessible. The practical version of that standard is a checklist, and it is short. Every cookie must be listed with six fields. Every policy on the internet omits at least two of them, usually duration and legal basis. ## The six fields, per cookie Name, provider, purpose, duration, type, and legal basis. The provider is the domain that sets it, first-party or third-party. The purpose has to be in plain words, not a category label: analytics means nothing until the policy says what is measured and who receives it. Duration is a session or an expiry date, not a vague range. Type is strictly necessary, performance, functional, or targeting, because the type decides whether consent is needed at all. Legal basis is the ground the cookie runs on, consent or legitimate interest, stated per cookie. The policy also has to cover the technologies that are not cookies. The EDPB guidance on the technical scope of the ePrivacy rules makes clear this is not just cookies: local storage, pixels, and device fingerprinting count too. A policy that lists cookies and ignores the fingerprinting script is describing a different site than the one visitors actually load. ## The pre-consent rule, stated plainly Article 5(3) of the ePrivacy Directive is the rule that outnumbers all others in enforcement actions: no cookie that is not strictly necessary may be stored or accessed before the visitor consents. The policy has to state that, and the site has to do it. A policy that promises pre-consent blocking while the tag manager fires analytics on page load is the exact gap the EDPB's cookie banner taskforce documented in January 2023, when it identified ten categories of non-compliant practices. Withdrawal has to be as easy as giving consent, and the policy has to say how. A link to the consent preferences, reachable from the policy and the footer, with reject as prominent as accept. The CNIL treats keeping a visitor's choice, acceptance or refusal, for about six months as good practice before asking again. Consent-free audience measurement cookies get a 13-month maximum lifespan, not extended on later visits. ## The maintenance rule nobody follows The ICO's storage and access guidance, finalized in 2026, is explicit that transparency obligations are ongoing rather than a one-off publication. A cookie policy written once and never updated is wrong within a quarter, because trackers arrive through marketing changes, not just code changes. Every new embed, chat widget, or A/B tool has to land in the policy the same week it lands on the site. The check is mechanical. Load the site in a clean browser, list what actually fires before consent, and compare it against the policy line by line. Anything that fires and is not listed is a finding. Anything listed that no longer fires is a smaller finding, but still a sign the policy is not maintained. Keep reading: [Server-Side Tagging Does Not Remove the Consent Question](https://cookiecitadel.com/blog/2026-11-13-server-side-tagging-consent-question.md), [The Store Locator That Pings Google Before Consent: Maps Are Trackers Too](https://cookiecitadel.com/blog/2026-11-11-embedded-map-consent-store-locator.md), [Testing Your Cookie Banner Without Breaking the Law: What You Can A/B Test](https://cookiecitadel.com/blog/2026-11-10-cookie-banner-ab-test-legal-limits.md) cover the nearby cases in this series. ## Frequently asked questions ### What must a cookie policy list for each cookie? Six fields: name, provider, purpose, duration, type, and legal basis. Duration and legal basis are the two most commonly omitted. Vague categories are not enough; the regulator's test is whether a normal person could read the policy and understand what is happening to them. ### Is a cookie policy the same as a privacy policy? No. The privacy policy covers all personal-data processing. The cookie policy is the subset covering cookies and similar technologies, and it carries the one rule the privacy policy does not: each cookie must be named individually with its six fields. ### Do we need to list local storage and pixels too? Yes. The EDPB guidance makes clear the rules cover local storage, pixels, and device fingerprinting, not just cookies. A policy that lists cookies and ignores the fingerprinting script describes a different site than the one visitors load. ### How often should the cookie policy be updated? Whenever a tracker changes, and on a quarterly schedule at minimum. The ICO's 2026 guidance treats transparency as ongoing, not a one-off publication. Trackers arrive through marketing changes as well as code changes, so the policy has to be checked against the live site.