---
name: prompt-pack-cookie-policy
description: Use when a company needs to draft or update a Cookie Policy for its website or app, explaining the types of cookies used (essential, analytics, marketing), their purposes and durations, third-party cookies, and how users manage preferences. Must comply with the jurisdiction's applicable law — GDPR and ePrivacy Directive for EU; UAE PDPL and TDRA guidance; KSA NDMO regulations; DIFC/ADGM DP Law; Lebanon Law No. 81 of 2018 (where applicable). Requires a cookie consent mechanism to be implemented alongside the policy.
license: MIT
metadata:
  id: prompt-pack.cookie-policy
  category: prompt-pack
  practice_area: privacy-data-protection
  priority: P2
  intent: [drafting, cookie-policy, privacy, consent-management, data-protection]
  related: [prompt-pack-data-processing-agreement, prompt-pack-data-retention-policy, prompt-pack-privacy-policy, prompt-pack-cross-border-data-transfer-assessment]
  source: Louis — HAQQ Legal AI (github.com/sboghossian/mini-claude-for-legal)
  version: "1.0"
---

# Cookie Policy

A Cookie Policy is a disclosure document, but it is also a legal instrument: in GDPR jurisdictions, an inadequate cookie notice can constitute a violation of the consent requirement, exposing companies to regulatory fines and private claims. In MENA jurisdictions, the law is evolving — but the direction of travel is consistent with the EU framework.

## When to use this

- A website or app is being launched and requires a Cookie Policy to comply with applicable privacy law.
- The company has changed its cookie practices (new analytics tools, new advertising networks, new consent management platform) and needs to update its policy.
- A regulatory audit or data protection review has identified the cookie notice as non-compliant.
- A company is expanding from a MENA-only operation to serving EU or UK users and must upgrade its cookie compliance to meet GDPR/UK GDPR standards.
- A company is implementing a Consent Management Platform (CMP) and needs the policy to align with the consent categories the CMP will manage.

## Required inputs

| Input | Why it matters | Sensible default |
|---|---|---|
| Company name | The policy identifies the controller | Ask the user |
| Website or app name and URL | The policy is specific to a digital property | Ask the user |
| Jurisdiction(s) of users | The applicable legal standard (GDPR / UAE PDPL / KSA / other) | Ask the user — different standards apply |
| Types of cookies in use | Policy must describe cookies actually used; cannot be generic | Ask the user to provide their cookie audit or list of tools |
| Whether a consent mechanism exists | If no CMP exists, the policy must refer to alternative opt-out methods | Ask the user |

## Optional inputs

- Names of specific third-party cookies (Google Analytics, Meta Pixel, LinkedIn Insight Tag, etc.) — enhances transparency and regulatory compliance.
- Whether the site targets children under 13/16 (higher consent standards apply).
- Whether an existing Privacy Policy should be cross-referenced.
- Language requirements (Arabic version for MENA onshore users).

## Document structure

### 1. Introduction
- Identifies the company as the data controller.
- States the purpose of the policy (explain what cookies are and how the company uses them).
- States the effective date and when the policy was last updated.
- Provides a link to the company's Privacy Policy.

### 2. What are cookies?
Plain-language explanation:
- Cookies are small text files placed on the user's device by the website.
- They serve different purposes — from making the website function (essential) to tracking user behavior for analytics or advertising (non-essential).
- Distinguish between first-party cookies (set by the website itself) and third-party cookies (set by external services embedded in the website).
- Distinguish between session cookies (deleted when the browser closes) and persistent cookies (remain on the device for a set period).

### 3. Categories of cookies used

Present in a table:

| Category | Purpose | Examples | Duration | Can users opt out? |
|---|---|---|---|---|
| **Strictly necessary / essential** | Required for the website to function; cannot be disabled without breaking the site | Session tokens, login state, security cookies | Session or short-term persistent | No (essential function) |
| **Analytics / performance** | Measure how users interact with the site; help improve performance | Google Analytics, Hotjar, Amplitude | 30 days – 2 years typically | Yes (via CMP or opt-out tools) |
| **Functionality / preferences** | Remember user preferences (language, region, display settings) | Locale cookies, preference tokens | 30 days – 1 year typically | Yes |
| **Marketing / advertising** | Track users across sites to serve targeted advertising | Meta Pixel, Google Ads, LinkedIn Insight Tag | 90 days – 2 years typically | Yes (via CMP and opt-out) |

For each named third-party cookie, include the name of the provider and a link to their own privacy/cookie policy.

### 4. How we use cookies
Narrative description of the purposes for which each category is used, mapped to the company's specific use case.

### 5. Legal basis for cookies
State the legal basis per jurisdiction:

**GDPR (EU/UK) and DIFC/ADGM DP Law:**
- Essential cookies: legitimate interests (Art. 6(1)(f) GDPR) or contractual necessity. No prior consent required.
- Non-essential cookies: prior, freely given, specific, informed, and unambiguous consent (Art. 6(1)(a) GDPR and ePrivacy Directive). Consent must be obtained before non-essential cookies are placed.

**UAE PDPL (Federal Decree-Law No. 45 of 2021):**
- Consent is required for personal data processing unless another lawful basis applies.
- The TDRA has not yet issued detailed cookie-specific guidance as of 2026; align with GDPR best practice.

**KSA PDPL (Personal Data Protection Law, Royal Decree M/19, 2021):**
- Consent is the primary lawful basis for processing; NDMO guidance should be monitored.
- As of 2026, cookie-specific guidance is not yet published; GDPR-aligned consent is the conservative approach.

**Lebanon:**
- Law No. 81 of 2018 (Electronic Transactions) and access to information principles apply.
- GDPR alignment is recommended for companies also serving EU users.

### 6. Third-party cookies
- List each third party by name and describe the type of data collected.
- State that the company is not responsible for third-party cookie practices and link to each provider's policy.
- Note that some third parties may use the data for their own purposes (cross-context behavioral advertising) subject to their own policies.

### 7. How to manage cookie preferences
Describe all available mechanisms:
- **Consent Management Platform (CMP):** If the site has a CMP, describe how users access and change their consent preferences (banner, preference center, link in the footer).
- **Browser settings:** Most browsers allow users to block or delete cookies; provide links to the instructions for major browsers.
- **Opt-out tools:** For specific third parties (e.g., Google Analytics opt-out browser add-on, NAI opt-out, DAA opt-out).
- **Effect of opting out:** Be clear that opting out of non-essential cookies may affect site functionality.

### 8. Data transfers
If cookies cause personal data to be transferred to servers outside the jurisdiction (e.g., Google Analytics data transferred to the US, Meta Pixel data transferred to the US):
- Disclose the transfer.
- State the safeguard: adequacy decision (for EU to certain countries), Standard Contractual Clauses, or equivalent mechanism.
- In DIFC context: transfers outside DIFC require adequate protection per DIFC Data Protection Law.
- In UAE PDPL context: cross-border transfers require compliance with Chapter 6 of the PDPL.

### 9. Updates to this policy
- The company may update this policy to reflect changes in cookies or law.
- Users will be notified of material changes.
- The "last updated" date at the top of the policy reflects the most recent revision.

### 10. Contact information
- Data Protection Officer name or role (if a DPO is appointed).
- Email address for cookie-related queries.
- Postal address.
- How to exercise data subject rights (link to DSR procedure or Privacy Policy).

## Jurisdictional compliance notes

| Jurisdiction | Key requirement |
|---|---|
| EU / GDPR + ePrivacy | Prior opt-in consent for all non-essential cookies; "cookie walls" (no access without consent) are prohibited in most EU member state guidance; cookie banner must not use dark patterns |
| UK GDPR + PECR | Same as EU; ICO guidance published; similar prohibition on dark patterns |
| DIFC / ADGM | DIFC DP Law 2020 / ADGM DP Regulations 2021; equivalent to GDPR; consent required for non-essential processing |
| UAE PDPL | Consent required; TDRA and DIFC/ADGM-registered entities should align with GDPR pending specific guidance |
| KSA | NDMO implementing regulations; consent required; Arabic-language policy recommended |
| Lebanon | Law No. 81 of 2018; GDPR alignment recommended |

## Common mistakes

- Publishing a Cookie Policy without implementing a working Consent Management Platform — the policy is then legally meaningless because consent cannot be obtained before cookies are placed.
- Cookie Policy that lists generic categories but does not name the specific cookies and third parties in use — regulators and DPAs increasingly require specific disclosure.
- "Cookie walls" — blocking site access unless the user accepts all cookies — are likely non-compliant under GDPR and leading MENA frameworks.
- Not updating the policy when new tracking tools are added. Each new tool that places a cookie must be disclosed.
- Combining the Cookie Policy with the Privacy Policy in a way that makes neither readable — keep them as separate documents with cross-links.

## Related skills

- [[prompt-pack-data-processing-agreement]]
- [[prompt-pack-data-retention-policy]]
- [[prompt-pack-privacy-policy]]
- [[prompt-pack-cross-border-data-transfer-assessment]]
- [[prompt-pack-data-subject-access-request-procedure]]