Most online shops have a cookie policy. Many are copied from a template, generated once by an app, or written before the store installed half its current apps. The result is a page that lists cookies the site no longer uses and misses the ones it does. That undermines the point of the policy: under PECR, visitors should get clear and comprehensive information about the cookies and similar technologies you use, so their consent is informed.
Here's how to write one that matches reality.
Step 1: Find the cookies you actually use (15 minutes)
Don't start with a template. Start with your site.
- Open a private window with DevTools open (F12, or Cmd+Option+I).
- Load your homepage and click Accept all, so everything that can load does.
- Browse like a customer: a collection page, a product, add to basket, start checkout. Log in if you offer accounts.
- Open Application › Cookies and note every cookie for your domain and third-party domains. Record its name, domain and expiry.
- Check Local storage and Session storage too. PECR covers "similar technologies", not just cookies.
- In the Network tab, note third parties receiving data even where they don't set a visible cookie, such as tracking pixels.
If your consent app has a cookie scanner, compare its list with yours. Scanners are useful but often miss cookies set after interactions like add-to-basket or login.
Step 2: Categorise each cookie
| Category | Typical examples on a shop | Consent needed? |
|---|---|---|
| Strictly necessary | Basket, checkout, security, load balancing, remembering the consent choice itself | Generally no, but still describe them |
| Preferences / functional | Remembering currency, language or recently viewed items | Generally yes, unless strictly necessary for something the user asked for |
| Analytics | GA4 (_ga, _ga_*), Hotjar, Microsoft Clarity | Generally yes (see the note below on recent changes) |
| Marketing / advertising | Meta (_fbp), TikTok (_ttp), Google Ads, Pinterest, Microsoft Ads (_uetsid) | Yes |
The Data (Use and Access) Act 2025 amended PECR, including some limited exceptions for certain analytics, subject to conditions. These changes are being brought in in stages and don't cover advertising. Check the ICO's current guidance before treating any analytics as exempt.
Not sure what your store fires before consent?
Send us your URL and we'll run a free homepage pre-consent scan: which trackers and cookies load before a shopper chooses. No obligation.
Get my free scan Use the free checklistStep 3: Write the policy, section by section
1. What cookies and similar technologies are
Two or three plain-English sentences. Mention that you also use similar technologies such as pixels and local storage, if you do.
2. How we use them
Explain each category in terms of what it does for the customer or the business. "Analytics cookies help us understand which pages are useful so we can improve the shop" is better than "to enhance user experience".
3. The cookie list
A table per category with these columns: name, provider (you, Shopify, Google, Meta…), purpose, duration and first or third party. This is the part most policies get wrong. It must match what Step 1 found.
4. Third parties
Name the companies that receive data through cookies and pixels, and link to their privacy information. Make sure your privacy policy names them too.
5. Your choices
Explain how to accept, reject or change preferences. Link to the footer "Cookie settings" control that reopens your banner, and mention browser settings as an extra option, not the main one.
6. Changes and contact
The date the policy was last updated and how to contact you.
Platform notes
Shopify
Shopify sets its own cookies for the storefront and checkout and publishes documentation listing them. Use it to describe Shopify's cookies accurately, and check the current version because the list changes. Apps add their own. Your DevTools sweep is the only reliable way to catch everything.
WooCommerce
WooCommerce and WordPress set session and basket cookies, and each plugin may add more. Consent plugins such as Complianz or CookieYes can generate a cookie list from a scan. Review it against your own sweep, especially for plugins that load third-party scripts.
Common mistakes
- Copied lists that include cookies you don't use and miss ones you do
- Vague purposes like "to improve your experience" for advertising cookies
- No mention of pixels or local storage
- No way to change your mind except "clear your browser cookies"
- A policy that doesn't match the banner. The categories in your banner and your policy should line up.
- Never updated. Every new app, plugin or tag can add cookies.
Keep it accurate
Put a reminder in your calendar to re-run the 15-minute sweep quarterly, and after any new app, plugin, theme change or tag. While you're there, check the banner really blocks what the policy says needs consent. A policy that says "we only set analytics cookies with your consent" is worse than useless if GA4 fires before the banner loads. Our 10-minute consent audit covers that check.
Quick answers
Can I just use a template?
A template is fine for the structure and wording of the general sections. The cookie list must come from your own site, because no template knows which apps and tags you run.
Where should the policy live?
On its own page, linked from your cookie banner and your site footer, so visitors can find it before and after they choose.
Does the policy replace the banner?
No. The policy gives the information; the banner collects the choice and should actually control what loads.
Want it checked properly?
The TrackCheck Health Check is a fixed-price review for UK Shopify and WooCommerce stores: a full consent test (before choice, after "Reject all", after "Accept all", including Consent Mode v2 signals), a GA4-vs-orders reconciliation, a prioritised fix list and a recorded walkthrough, delivered in 5 working days.
See Health Check pricing Start with a free scanThis article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.