Three documents, three names that people use interchangeably: cookie notice, cookie banner, cookie policy. Add the privacy policy and most site owners are no longer sure which one the law actually asks for. This article sorts them out: what each one is, what it must contain, how they link to each other and which mistakes regulators keep pointing at. For the full picture on the banner itself (design, buttons, consent storage), see our GDPR cookie banner compliance guide.
What is a cookie notice?
A cookie notice is any message that informs visitors that a website stores or reads cookies and similar trackers on their device. In practice the term covers two different things.
Meaning 1: the banner on the first visit
For most people, the cookie notice is the bar or pop-up that appears when they land on a site. This is how CookieYes, Cookiebot and most WordPress plugins (one of them is literally called "Cookie Notice") use the word. In this sense, cookie notice and cookie banner are synonyms.
Meaning 2: the cookie document
Some organizations use "Cookie Notice" as the title of their full cookie page, the one that lists each cookie, its purpose and its duration. In this sense, a cookie notice is a cookie policy under another name.
Both uses are fine. What matters is not the label but the job each element does. Legally, there are two jobs: informing people (in layers) and collecting their choice.
Cookie notice vs cookie banner
When "cookie notice" means the first-visit message, the useful distinction is between a notice that only informs and a banner that collects consent.
- Information-only notice: "This website uses cookies to improve your experience. OK." It informs, but offers no real choice. Clicking "OK" is not consent, because there was no alternative.
- Consent banner: it explains the purposes, offers "Accept all" and "Reject all" with equal weight, gives access to per-category settings and blocks non-essential cookies until the visitor decides.
In the EU, Article 5(3) of the ePrivacy Directive requires prior consent before storing or reading non-essential information on a device. Consent must meet the GDPR standard: freely given, specific, informed and unambiguous. An information-only notice meets none of these conditions as soon as analytics or advertising cookies are set. The CNIL, the ICO and the EDPB all say that continuing to browse is not consent.
An information-only notice is only acceptable when the site sets strictly necessary cookies alone (session, cart, load balancing, security). Even then, many sites keep a short notice with a link to the cookie policy, which is good practice rather than a legal requirement.
Cookie notice vs cookie policy
The cookie policy is the second layer of information. The banner says what kinds of cookies the site uses and why, in two or three sentences. The cookie policy gives the details that do not fit in a banner.
The difference comes down to three points:
- Length and place. The banner is short and appears on every first visit. The cookie policy is a full page, reached through a link in the banner, in the footer and in the privacy settings.
- Purpose. The banner collects a choice. The cookie policy documents what the visitor is choosing about, and is where they come back to understand or change that choice.
- Detail. The banner names categories (analytics, marketing, preferences). The cookie policy lists each cookie with its name, provider, purpose, duration and whether it is first-party or third-party.
The level of detail is not optional. In the Planet49 judgment (C-673/17, 2019), the Court of Justice of the EU ruled that the information given to users must include how long cookies stay on the device and whether third parties can access them. A banner cannot hold that, so the cookie policy does. Our cookie policy guide gives the full list of what to include and a template structure.
FlowConsent is a concrete example of how the two layers connect: the banner's settings panel shows the cookie list generated from the services you enable, so the visitor sees the same names and durations as the cookie policy without leaving the page.
Where the privacy policy fits
The privacy policy is wider than both. Articles 13 and 14 of the GDPR require you to tell people about every processing of their personal data: who you are, why you process data, the legal basis, retention periods, recipients, transfers outside the EU and their rights. Cookies are only one source of personal data among others (contact forms, orders, newsletters, customer accounts).
That gives a simple hierarchy:
- Privacy policy: all personal data, all processing, all rights.
- Cookie policy: cookies and similar trackers only, cookie by cookie.
- Cookie banner: the first layer, a summary plus the choice.
You can publish the cookie policy as a section of the privacy policy rather than as a separate page. Both approaches are accepted. A separate page is usually easier to keep up to date and easier to link from the banner, which is why most CMPs generate one.
What each one must contain
The cookie banner (first layer)
- The purposes of the cookies, in plain words (measuring traffic, showing ads, remembering preferences).
- The identity of the main third parties, or a link to the list.
- "Accept all" and "Reject all" buttons with the same visual weight, plus access to settings.
- A link to the cookie policy.
- A way to change the choice later (a floating icon or a footer link).
For wording you can adapt, see our cookie banner text templates.
The cookie policy (second layer)
- What cookies and similar trackers are, in a few lines.
- The list of cookies by category, with name, provider, purpose, duration and type (first-party or third-party).
- Which categories need consent and which are exempt. Our guide to GDPR cookie categories explains how to sort them.
- How to withdraw or change consent, and how to manage cookies in the browser.
- The date of the last update.
The privacy policy
- The data controller and contact details (and the DPO if you have one).
- Each purpose with its legal basis, retention periods, recipients and transfers.
- The rights of data subjects and the right to complain to the supervisory authority.
- A link to the cookie policy.
Before writing any of this, you need to know which cookies your site really sets, not the ones you think it sets. Check in 30 seconds which cookies your site drops with the free cookie scanner, then compare the result with your current cookie policy.
Is an information-only cookie notice enough?
It depends on where your visitors are.
- EU and EEA: no, as soon as non-essential cookies are set. Prior consent is required, and the CNIL also requires that refusing be as easy as accepting.
- United Kingdom: no. Regulation 6 of PECR requires clear and comprehensive information and consent for non-essential cookies. The ICO's guidance is close to the EU position.
- United States (California): the CCPA works differently. It does not require consent before cookies are set, but it requires a notice at collection and, if you sell or share personal information (which many advertising cookies do), a "Do Not Sell or Share My Personal Information" link and respect for Global Privacy Control signals. An information notice can be enough there, provided the opt-out works. See our page on the CCPA and CPRA.
If your audience is international, the safest approach is a consent banner for EU and UK visitors and an opt-out notice for US visitors, which is what most CMPs do with geolocation.
Another tempting shortcut is the cookie wall, where visitors must accept to access the site. Regulators generally consider that it prevents consent from being freely given; our article on cookie walls and their legal alternatives explains the nuances.
Common mistakes
- Calling an "OK" button consent. A single button that only acknowledges is information, not consent.
- A cookie policy that does not match reality. The policy lists five cookies, the site sets twenty. This is one of the most frequent findings during audits. Rescan after every new tag or plugin.
- No link between the layers. The banner should link to the cookie policy, and the cookie policy should offer a way to reopen the banner.
- Copying a generic template. A template gives the structure, not the content. The cookie names, durations and providers must be yours.
- Forgetting the update date. Without it, neither you nor a regulator can tell whether the policy reflects the current site.
- Mixing the privacy policy and the cookie policy without structure. If you merge them, give cookies their own clearly titled section.
How FlowConsent handles cookie notices and cookie policies
FlowConsent combines the first and second layers. The banner shows purposes by category, "Accept all" and "Reject all" buttons, and a settings panel, and it blocks scripts before consent. The cookie list behind it is generated from the services you enable, with each cookie's name, purpose, provider, duration and type, and you add your own first-party cookies by hand. An automatic scan compares the cookies actually observed on your site with that list and flags any cookie you have not declared, so the information you give visitors stays accurate. Consent records can be exported as proof. FlowConsent is free up to 25,000 sessions per month and is hosted in Europe. See how the cookie declaration works.