Skip to content

The Cookie Policy That Doesn't Match Your Site

Most cookie policies are wrong the day they're published, and the reason is mundane: the marketing team installed a new analytics script last month and nobody told whoever wrote the policy. The banner asks for consent; the policy lists trackers that no longer exist and omits three that do. Regulators notice exactly this mismatch, because it's the easiest finding to prove.

What the rules actually require

Two layers. The ePrivacy Directive requires consent before storing non-essential cookies — analytics, advertising, anything beyond what's strictly necessary to run the site. GDPR supplies the standard for valid consent: informed, specific, freely given, and as easy to withdraw as to give.

The policy is the documentation of that system: which cookies you set, what each one does, how long it lives, and how the visitor controls or withdraws consent. Its job is to make the banner truthful — and that means it has to match the scripts actually running on the site, not the ones that were running when the policy was written.

What happens when it doesn't match

The enforcement record is public and uncomfortable. French regulators fined Google €150 million and Meta €60 million in 2022 for cookie consent violations — not for lacking a policy, but for consent mechanics and documentation that didn't match reality. Smaller businesses face the same logic at smaller scale: complaints, orders, and lost analytics when consent is found invalid and the data has to be treated as unlawfully collected.

There's a second consequence beyond fines. Invalid consent poisons the data it was meant to legalise — the analytics, the ad performance, the remarketing lists. The business doesn't just pay; it loses the measurement it thought it had. We covered the data protection foundation in the GDPR software guide.

The living-page fix

A cookie policy is a description of a moving system. The SaaS trust-center pattern handles this exactly: publish the policy as a dated, versioned page, review it when the marketing stack changes, and update it in place behind the same URL. The banner links to the policy, the policy matches the banner, and the version history shows the record of what was true when.

The same structure holds the whole legal set together — privacy, terms, DPA, accessibility — at one verifiable address, which is the point of the overview post and the Trust Hex approach.

  • A living, dated cookie policy — permanent URL, versioned, updated in place when the cookie stack changes.
  • Matched to your banner — the policy stays truthful to the scripts actually running.
  • Part of your Trust Hex — all legal pages at one verifiable address buyers and regulators can check.

The Banner Lies When the Policy Lags

Keep the policy matched to your actual stack, dated and current. Start with a free draft: no card needed, publish the verifiable version when you are ready.

See Our Cookie Policy, Hosted the Same Way →

Frequently Asked Questions

Do I need a separate cookie policy, or is the privacy policy enough?

Separate. The ePrivacy Directive creates duties the privacy policy alone doesn't document — the tracker inventory, purposes, retention and consent mechanics. Most regulators expect a distinct page.

Which cookies need consent?

Everything that isn't strictly necessary: analytics, advertising, social embeds, personalisation. Necessary cookies — login, basket, security — can run without consent, but they still belong in the policy.

How often should the policy be reviewed?

Whenever the marketing stack changes — new tools, new pixels, new embeds — and at least quarterly. The mismatch between policy and site is the finding regulators prove first.

Last updated: October 2, 2026

Global Digital Trust & Compliance

Sustalium is the digital-first platform for managing complex business certificates and sustainability declarations across global supply chains.

Environment & ESG
  • Digital Product Passport (DPP)
  • Carbon & Water Footprint
  • Circularity & Reuse (ISO 14021)
  • De-Forestation Free
Product & Food Safety
  • FSMA 204 (FDA Traceability)
  • REACH & RoHS Compliance
  • PFAS-Free & VOC Declarations
  • Prop 65 & TSCA Title VI
Social & Ethical
  • ISO 26000 Responsibility
  • Modern Slavery Statements
  • UFLPA Forced Labor Traceability
  • Ethical Labor Declarations
Governance & Trade
  • Swiss Made & Origin Claims
  • GDPR & AI Ethics (EU AI Act)
  • CE Marking & UKCA Conformity
  • Bill S-211 (Canada) Reporting
Start Free

Have questions about a specific standard?
Contact our compliance team at compliance@sustalium.com