A cookie policy is a legal document disclosing the cookies and tracking technologies a website uses — their purpose, duration, and whether they are first-party or third-party. Under GDPR and the ePrivacy Directive, it is a mandatory disclosure that must be provided before or at the point of consent. A cookie policy is distinct from a privacy policy, which covers all personal data processing; the cookie policy focuses specifically on cookie-based tracking. A compliant cookie policy names each cookie, states its type, purpose, lifespan, and explains how visitors can withdraw consent. It must be updated whenever new tracking tools are added to the site.