Cookie Policy

What is a cookie policy?

A cookie policy is a page that explains which cookies and similar trackers a company uses on its websites and apps, why it uses them and how you can turn them off. A cookie is a small file a website stores in your browser so it can recognize you later.

Modern cookie policies cover more than cookies. They also list tracking pixels (tiny invisible images or scripts that report your visit to another company), local storage, device fingerprinting and tools like session replay. The UK regulator says its cookie rules apply to "any technology that stores or accesses information" on a device.

A cookie policy often sorts trackers into groups like these, as Atlassian and Grafana Labs do:

• Strictly necessary: needed for the site to work, such as keeping you logged in.
• Preferences or functional: remember choices like language.
• Analytics or performance: measure how people use the site.
• Advertising or targeting: track browsing to show ads, often on other sites.

The cookie policy often sits apart from the main privacy policy, with a link between them.

What it looks like in a vendor's terms

A typical clause reads like this:

We and our partners use cookies, pixels and similar technologies to operate our sites, understand how they are used and show you relevant ads on our sites and elsewhere. Advertising partners may collect information about your activity across different websites. You can manage your choices in our cookie settings or your browser. Strictly necessary cookies cannot be turned off.

• "We and our partners": other companies place trackers too, not only the vendor.
• "Pixels and similar technologies": the policy reaches past cookies.
• "On our sites and elsewhere": data feeds ads on other websites, which is targeted advertising.
• "Across different websites": partners can link your visits here to visits elsewhere.
• "Cannot be turned off": some trackers run no matter what you choose.

Real policies follow this shape. Atlassian's cookie notice lists targeting and advertising cookies and says it also uses web beacons, known as tracking pixels. Grafana Labs' cookie policy names Google, GitHub, LinkedIn and YouTube as companies that place pixels and SDKs on its sites.

A real change we caught

Venpo flagged that OpenAI's ad pixel now appears in CircleCI's cookie policy. A new name in the advertising section means a new company receives data about visits to that site.

Cookie policies also change what your choices do. Google now says personalized ads may continue after you reject cookies.

Why it matters to you

A change to a cookie policy usually means new tracking. When a vendor adds an ad partner, data about you and your team starts going to one more company.

• Your team's browsing: staff log in to vendor dashboards every day. Ad pixels on those pages can report that activity to ad networks.
• California rules: sharing data for ads across sites can count as "sharing" under the CCPA. The California Attorney General says businesses must honor Global Privacy Control as an opt-out. See Global Privacy Control.
• Your own site: if you embed a vendor's widget or script, its cookies may load on your pages, and your own cookie policy must cover them.
• Legal risk: pixels have their own legal questions in the US, covered in CIPA pixel lawsuits. A vendor that adds pixels to pages your customers see can bring that question to you.

What to check

• Named partners: does the policy name its ad and analytics partners, or only describe them?
• Advertising section: look for new names and for language like "across websites" or "elsewhere."
• Product vs website: check whether the trackers run only on the marketing site or also inside the logged-in app.
• Opt-out signals: check whether the vendor says it honors Global Privacy Control.
• Durations: check whether the policy says how long cookies last.

Third-Party Cookies

A third-party cookie is a cookie set by a company other than the website you are visiting. The UK regulator defines first-party cookies as those "set directly by the website the user is visiting". Third-party cookies come from a different domain, often through embedded ads, social buttons or images.

The difference matters because of what each can do. A first-party cookie usually helps one site remember you, for example to keep you logged in. A third-party cookie can follow you across many sites that carry the same partner's code. That is how ad networks build profiles of browsing habits.

Tracking pixels work in a similar way. The pixel loads from the partner's server, so the partner learns about your visit even if it sets no cookie. European regulators include pixels in the same rules. The EDPB guidelines say tracking pixels fall within the ePrivacy cookie rule.

In a vendor's cookie policy, third-party cookies usually sit in the analytics and advertising groups. Those are the rows to read when the policy changes.

ePrivacy Directive

Read the full page on ePrivacy Directive

The ePrivacy Directive is the EU law behind cookie banners. Its formal name is Directive 2002/58/EC. As the EU Court of Justice explains in Planet49, the original rule only gave users a right to refuse cookies. A 2009 amendment, Directive 2009/136/EC, replaced that with a requirement for consent.

The key rule is Article 5(3). It covers storing information on a person's device, or reading information already there. According to the EDPB guidelines, adopted in October 2024, this covers cookies and also pixels, fingerprinting and similar techniques. Consent is needed unless the storage is only for sending a communication or strictly necessary for a service the user asked for.

In the Planet49 ruling of October 2019, the court also explained what consent means. A pre-ticked box is not valid consent. The rule applies whether or not the stored information is personal data. Users must also be told how long cookies last and whether third parties can access them.

A directive works through each EU country's own law, so details vary by country. The UK has its own cookie rules in PECR, which the ICO enforces.

How Venpo helps

Venpo watches the cookie policies of the vendors you use and emails you a plain-English alert when they change, such as a new ad partner or a new tracking pixel. The Fine Print Scan also answers whether each vendor sells data or uses it for ads.