Privacy Policy vs Cookie Policy: Which Page Carries What, and Why Both Exist
A team writes one long privacy policy, adds a paragraph about cookies, and calls the job done. A regulator opens the file and asks a question the merged document cannot answer: which cookies does this site set, who sets them, and how long does each one last. The paragraph about cookies does not name a single cookie. The document has failed at the one thing the cookie policy exists to do.
The two documents have different jobs, different legal bases, and different readers. Merging them saves a page and loses the information.
Two documents, two jobs
The privacy policy covers all personal-data processing: what you collect, why, on what legal basis, who receives it, and for how long. It is the document for the whole relationship between the site and the visitor. The cookie policy is the subset covering cookies and similar technologies: local storage, pixels, device fingerprinting. It carries the one rule the privacy policy does not, which is that each cookie must be named individually with six fields: name, provider, purpose, duration, type, and legal basis.
The legal bases differ too. The cookie policy rests on the ePrivacy Directive's Article 5(3), which requires clear and comprehensive information as a precondition for valid consent, plus the GDPR's transparency requirements in Articles 12 to 14. The privacy policy rests on the GDPR alone. A site with no cookies still needs a privacy policy. A site with cookies needs both.
The overlap that confuses teams
The two documents share three topics, and the overlap is where teams duplicate or contradict themselves. Both have to explain how consent is collected and how it can be withdrawn, and withdrawal has to be as easy as giving consent. Both have to name third parties that receive data. Both have to state retention periods.
The rule for the overlap is simple: the privacy policy states the principle, the cookie policy states the instance. The privacy policy says analytics data is kept for 13 months. The cookie policy says the _ga cookie lasts 13 months, the _gid cookie lasts 24 hours, and both are set by Google Analytics. A reader who wants the principle reads one page. A reader who wants the cookie reads the other.
The maintenance rule
The ICO's storage and access guidance, finalized in 2026, is explicit that transparency obligations are ongoing rather than a one-off publication. That applies to both documents, but it bites harder on the cookie policy, because trackers change faster than processing purposes do. A new embed, a new A/B tool, or a new chat widget has to land in the cookie policy the same week it lands on the site.
Link the two documents to each other and keep them consistent. When the banner's cookie list changes, the policy changes in the same deploy. A policy that lists cookies the site no longer sets is stale. A policy that omits cookies the site does set is a finding.
Keep reading: The Banner That Asks Twice: Reprompt Rules After a Cookie Clear, The Banner After a Redesign: Why a New Layout Means a New Consent Decision, The Thank-You Page: Post-Purchase Tracking and the Consent It Forgot cover the nearby cases in this series.
Frequently asked questions
Do I need both a privacy policy and a cookie policy?
Yes, if your site sets cookies. The privacy policy covers all personal-data processing. The cookie policy names each cookie and similar technology with six fields. The ePrivacy Directive requires clear and comprehensive information about cookies as a precondition for valid consent.
What goes in the cookie policy that is not in the privacy policy?
The per-cookie list: name, provider, purpose, duration, type, and legal basis for every cookie, plus local storage, pixels, and fingerprinting. The privacy policy states principles; the cookie policy states instances.
Can the cookie policy live inside the privacy policy?
It can, as a clearly identifiable section, but it still has to name every cookie with its six fields. Most teams keep it separate because the cookie list changes far more often than the processing purposes, and a merged document goes stale faster.
How often should the cookie policy be updated?
Whenever a tracker changes, and quarterly at minimum. The ICO's 2026 guidance treats transparency as ongoing. Trackers arrive through marketing changes as well as code changes, so check the policy against the live site, not the repo.