What's the difference between the GDPR and CCPA cookie banners?

GDPR is opt-in: non-essential scripts must be blocked until the visitor clicks Accept, and the banner needs an equally prominent Reject All button. CCPA is opt-out: scripts may load, but you must show a notice and a 'Do Not Sell or Share My Personal Information' control and honor Global Privacy Control. Choosing 'Both' uses the stricter opt-in flow and adds the CCPA opt-out link.

Does the generated banner actually block tracking before consent?

Yes, but only if you re-tag your tracking scripts. The banner gates any script written as type='text/plain' with a data-cookiecategory attribute and only activates it once that category is consented. If you paste the banner but leave Google Analytics hard-coded and firing, the site is still non-compliant in the EU. The integration instructions show exactly how to re-tag your tags.

How long does the consent choice last before re-asking?

You set a re-prompt interval (commonly 6–12 months). The banner stores the choice in a SameSite=Lax cookie with that max-age and re-appears when it expires. Storing consent forever is treated as non-compliant under EU guidance, so this tool caps the interval at 12 months.

Is this cookie policy legal advice?

No. It generates a compliance-oriented starting point — policy text plus a working snippet — for informational purposes only. It is not legal advice and not a guarantee of compliance. Have a lawyer or DPO review it, especially the marketing / 'sale of data' classifications, before relying on it.

Cookie Consent Policy & Banner Generator

Q: Do I need a cookie banner if I only use Google Analytics?

In the EU/UK, yes. Google Analytics sets cookies (_ga, _gid) and is not strictly necessary, so under GDPR/ePrivacy you must obtain prior consent before it loads. In California (CCPA) you can load it but must give visitors a notice and an opt-out plus honor the Global Privacy Control signal. This generator produces the right banner for whichever applies.

Q: Does it honor Global Privacy Control (GPC)?

Yes. The generated banner reads navigator.globalPrivacyControl and, when it is true, forces marketing off and treats it as a valid Do-Not-Sell/Share opt-out without requiring a banner click — which is mandatory under California's CCPA/CPRA rules. Server-side suppression of any actual data 'sale' remains the site owner's responsibility.

Q: Does it support Google Consent Mode v2?

Yes, when you select Google Analytics or Google Ads. The generated banner outputs a Consent Mode v2 default block to paste in your above the Google tag, and sends a gtag('consent','update') signal when the visitor chooses — mapping the Analytics toggle to analytics_storage and the Marketing toggle to ad_storage, ad_user_data and ad_personalization. Google has required Consent Mode v2 since 2024 for its products serving EU/EEA users.

Cookie policy & consent banner generator — guide

What it does

This free tool produces two things at once: a paste-ready cookie policy page (with an auto-filled cookie table — provider, cookie names, category, purpose, retention, first/third-party) and a self-contained consent banner snippet (HTML + CSS + JS, no dependencies, no network calls). It is a rules engine: the consent model, the buttons, the cookie rows, and the cookie max-age are all derived from your answers, not pasted from a template.

The two consent models

EU / GDPR → opt-in. Non-essential scripts are blocked until the visitor clicks. The banner shows Accept all, Reject all, and Customize with equal visual prominence (regulators fine banners that bury Reject). Nothing is written until the user chooses.
US-California / CCPA → opt-out. Scripts may load; the banner is a notice with a "Do Not Sell or Share My Personal Information" control, and the browser's Global Privacy Control signal is honored automatically.
Both uses the stricter opt-in flow and adds the CCPA opt-out link.

Worked example

Say you run example.com, you use Google Analytics and a YouTube embed, you serve EU + California visitors, and you set the re-prompt interval to 12 months. The tool:

Selects the opt-in model (EU is in scope) and adds the CCPA "Do Not Sell or Share" link (California is in scope).
Builds a cookie table with a Necessary row (your consent cookie), an Analytics row for Google Analytics (_ga 2 years, _gid 24 hours), and a Marketing row for the YouTube embed.
Computes the consent cookie max-age: 12 × 30 × 24 × 60 × 60 = 31,104,000 seconds.
Emits a banner with equal-prominence Accept all / Reject all / Customize, a preferences modal (Necessary locked on, Analytics + Marketing default off), and a loader that only activates scripts tagged type="text/plain" data-cookiecategory="analytics" once Analytics is granted.

Headline verdict: "Generated for EU + California (GDPR opt-in + CCPA opt-out). Covers Necessary, Analytics and Marketing categories."

How to use it

Enter your site name, domain, and a working privacy email (required).
Pick your jurisdiction and tick the analytics, ad and embed tools you actually use.
Set the re-prompt interval (6–12 months is typical).
Click Generate. Copy Output 1 into a /cookie-policy-generator/ page, paste Output 2 before </body>, and follow Output 3 to re-tag your existing scripts.

What's still on you (the snippet alone isn't compliance)

Re-tag your scripts. The banner only blocks tracking if you change your analytics/ad tags to type="text/plain" data-cookiecategory="...". Leave Google Analytics hard-coded and firing and the site is still non-compliant in the EU. This dependency is the most-missed step.
Verify cookie names & retention. Values shown (e.g. GA _ga = 2 years, _gid = 24 hours, Meta _fbp = 90 days) are provider defaults as of 2026 and can change.
Replace the contact email if it is still a placeholder — an unreachable rights contact is itself a compliance gap.
Add the links. Put a footer link to the policy on every page; under CCPA also add a homepage "Do Not Sell or Share My Personal Information" link.
Server-side "sale" suppression. Honoring GPC client-side is not enough under CCPA — you must also stop forwarding data to ad partners server-side.
Get it reviewed. This is a starting point, not legal certification, and does not evaluate whether the laws even apply to you (revenue/data-volume thresholds).

Google Consent Mode v2 (if you use Google Analytics or Google Ads)

Since 2024, Google requires sites that run Google Analytics 4 or Google Ads for EU/EEA visitors to send Consent Mode v2 signals — simply blocking the Google tag is no longer enough on its own. When you tick Google Analytics or Google Ads above, the generated banner automatically:

Emits a "Consent Mode DEFAULTS" block at the top of Output 2. Move it into your <head> above your Google tag — it sets ad_storage, ad_user_data, ad_personalization and analytics_storage to denied (opt-in markets) before Google loads.
Sends a gtag("consent","update",…) the moment the visitor chooses, mapping your Analytics toggle to analytics_storage and your Marketing toggle to the three ad signals.
Honors GPC and a returning visitor's saved choice by re-sending the matching update on load.

This wires the consent signals for you, but you still install your Google tag yourself and should confirm in Google Tag Assistant that the default/update events fire. It is a starting point, not a compliance guarantee.

Accuracy & honesty notes

This is a static, client-side tool: it does not store, log, or transmit your inputs, and the generated banner makes no network calls of its own.
EU "Accept all" and "Reject all" must have equal visual prominence; the generated CSS enforces this — don't restyle it to de-emphasize Reject.
Under the 2026 CCPA rules, closing or scrolling past the banner is not consent; the banner requires an affirmative click and never treats dismissal as acceptance.
Non-necessary toggles default OFF — pre-ticked consent is invalid under GDPR.
"Cookieless" tools like Plausible are disclosed but footnoted as setting no cookies; no fake cookie names are invented.

How to embed this tool on your website

No account, no coding. Grab the one-line embed snippet from the "Put this cookie banner generator on your site" box below this guide and paste it where you want the tool to appear — it works on any site, including WordPress, Squarespace, and Webflow.

Frequently asked questions

Do I need a cookie banner if I only use Google Analytics?

In the EU/UK, yes — GA sets cookies and isn't strictly necessary, so consent must come first. In California you can load it but must offer a notice + opt-out and honor GPC. This tool builds the right banner for whichever applies.

What's the difference between the GDPR and CCPA banners?

GDPR is opt-in (block scripts until Accept, with an equally prominent Reject All). CCPA is opt-out (notice + "Do Not Sell or Share" + honor GPC). "Both" uses the opt-in flow and adds the opt-out link.

Does the banner actually block tracking before consent?

Yes — but only if you re-tag your scripts as type="text/plain" data-cookiecategory="...". Pasting the banner while leaving GA hard-coded leaves you non-compliant in the EU. Output 3 shows exactly how.

How long does the consent choice last?

As long as your re-prompt interval (6–12 months is typical). It's stored in a SameSite=Lax cookie and the banner reappears when it expires. "Forever" consent is non-compliant, so the interval is capped at 12 months.

Does it honor Global Privacy Control (GPC)?

Yes. The banner reads navigator.globalPrivacyControl and, when true, forces marketing off and treats it as a valid opt-out without a click — mandatory in California. Server-side data-sale suppression is still on you.

Does it support Google Consent Mode v2?

Yes — when you tick Google Analytics or Google Ads. The banner outputs a Consent Mode v2 default block (paste it in <head> above your Google tag) and sends a gtag("consent","update") when the visitor chooses, mapping Analytics to analytics_storage and Marketing to the three ad signals. Google has required this since 2024 for its products in the EU/EEA.

Is this legal advice?

No. It's an automated starting point for informational purposes only — not legal advice and not a compliance guarantee. Have a lawyer or DPO review it before relying on it.

Related tools

Built in your browser and saved only there. We don't store or sell your data. Not legal advice.