IDC Names Securiti a Worldwide Leader in Data Privacy


Cookie Text: A Comprehensive Guide

Published February 2, 2022 / Updated November 21, 2023

Listen to the content

A decade ago, a user would type in the name of their preferred website and begin their browsing. They would note how the more they browsed the site, the better ads they received that directed them towards the exact goods/services they were looking for. This was possible because of cookies. Cookies are small bits of text stored on your browser by the site that help it collect information on your browsing behavior. Naturally, this results in the website showing the user better goods/services based on what they were searching for.

A decade later, the average user journey on a website hasn't changed much, except for one major thing. Depending on where the user was accessing the site, the first thing they would see on the website would be a dialogue box, asking them to Accept or Manage cookies.

Thanks to GDPR and several other data protection laws, websites cannot store cookies on a user's device by default when catering to EU and UK residents. They need proper and informed consent from the visitor to do so. The text in the dialogue box, where the user will choose to either accept cookies or manage what cookies they want to be stored, is known as Cookie Text.

As surprising as it may seem, this small piece of text is the current standard way a website uses to convince the consumers to accept cookies on their website.

In simple terms, cookie text is the actual text a user will see on the dialogue box when they are presented with the choice to either accept cookies or reject them. While it may not seem like a big deal, a cookie text is essentially the only tool a website has to gain consent from users to store cookies on their site. Given how cookies can help ensure a user sees highly targeted ads that are more likely to convert and help a website identify its users better, it becomes clear just how vital cookie texts are.

The European Data Protection Board's definition states that "valid consent is a freely given, informed, specific and unambiguous indication of a user's wishes. Scrolling and continued browsing on websites is not valid consent, and cookie banners are not allowed to have pre-ticked checkboxes".

Naturally, a website's cookie text should adhere to this definition and seek to elicit consent while guiding users to appropriate resources on the website if they have any further questions on the matter.

Why Websites Use Cookie Texts

Cookie texts are how a website can communicate its exact cookie consent policy. The dialogue box where the cookie text is shown must be precise enough without limiting any information a user must know.

Usually, the cookie text is the first thing a user will see when visiting a website. Unlike the cookie policy statement where a website has to explain what kind of cookies are being used, how the website uses them, what information they store, and how users can manage them, a cookie text is a far more straightforward form of text that greets a user upon arrival to the site and requests their consent to store cookies on their device.

Cookie texts can be thought of as a permission tool as it is the only way a website can make a case for storing cookies on a user's device.

Cookie Text Requirements for GDPR Compliance

The General Data Protection Regulation (GDPR) set the benchmark for data protection laws. The GDPR required all websites using cookies to take robust precautions to ensure their users' data privacy and elicit proper consent before collecting any form of data. This is known as opt-in consent, where a user has to opt-in with express consent to have their data collected.

One of the things that stands out the most about how the GDPR deals with cookies is the fact "cookies" are not mentioned at all within the regulation. Instead, the term used is "personal data identifiers". Most websites use cookies to carry out that exact function, i.e., to store information about a user's age, language, device being used, time zone, country, etc. However, since there are cookies that do not collect personal information but are strictly necessary for a website to function properly, those technologies are exempt from GDPR.

As far as cookie text is concerned, the GDPR deals with how a website is supposed to inform its users about cookies. Any cookie text on any webpage on a website must contain the following information:

  • Information about using cookies and their purpose when users visit the website.
  • How to accept and reject cookies before storing them on a device.
  • Keep cookies (except strictly necessary cookies) blocked until the user gives consent.
  • How users can select what cookies they want the website to store on their device.
  • How users can allow or withdraw cookie consent if necessary.
  • Keep a log of all the user consent.
  • Renew cookie consent every six months (depends on the local data protection authority guidelines).

Cookie Text for CCPA Compliance

The California Consumer Privacy Act (CCPA) has a somewhat different approach towards cookies than the GDPR. While the GDPR follows the opt-in consent model, the CCPA follows the opt-out model. Under the opt-out model, websites have the right to store cookies and collect information on a user by default. A user can only ask a website not to share or sell any data collected on them to a third party. Furthermore, websites are under no obligation to discontinue data collection even after a user requests so.

Under the opt-out model, a website must make it easier for users to opt-out of having their data sold or shared with third parties by making a "Do Not Sell My Personal Information" link clearly available and accessible on every website's webpage. The cookie text for such a Do Not Sell My Personal Information must fulfill the following requirements:

  • Inform the users about cookies, their source, and their purpose.
  • Allow users to opt-out of cookies ("Do Not Sell My Personal Information" link) that sell or share personal information with third parties.
  • Link to privacy or cookie notice that explains what type of cookies the site uses, the source, the data collected, their purpose, and how users can control them.

Cookie Text Examples

Here are some examples of cookie text from various websites from different countries adhering to various data protection laws from across the world:

cookie text
cookie text
cookie text
cookie text

Best Cookie Text Practices

It should be clear by now that there is no "one size fit all" approach when it comes to your cookie text. Owing to the different legal requirements of various data protection laws around the world, it is likely that a website may need to alter its cookie text per country. Or in the case of the US, this alteration in cookie text will be needed on a state level since different states have their own data protection laws.

However, there are some key practices that any website can inculcate in their cookie text wherever they may be operating from to ensure they remain legally compliant without making things more complicated than they need to be.

  • Use simple & easily understandable language
  • Avoid jargon and technical or legal terms
  • Give users an equal opportunity to opt-in or out without restricting their browsing experience
  • Explain exactly what kind of cookies you use
  • Explain what information you share/sell to third parties and how users can opt-out of it

How Securiti Can Help

Cookie consent management has taken an unprecedented level of importance in 2022. Several data protection laws are being enacted worldwide that mandate all websites ensure their users are adequately informed and educated about their digital privacy rights. Businesses have to figure out how they can continue trying to optimize their users' browsing experience without breaching any consent requirements.

A robust and instantly adaptable cookie consent management system is the key to achieving that goal. And such a robust and instantly adaptable cookie consent management system can only be achieved via automation. Owing to the sheer amount of data involved, it makes sense for businesses to automate this vital process to ensure effectiveness and efficiency.

Securiti is a market leader in providing AI and machine-learning-based enterprise solutions to various data compliance-related problems such as cookie consent management.

Request a demo today to see Securiti's tools in action and learn how Securiti can help your business.

Privacy Center
Fully Functional In Minutes

Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.

Anas Baig

Authored by Anas Baig

Anas Baig is a Product Marketing Manager with a proven track record in the cybersecurity industry. He has been a prominent contributor to numerous esteemed publications, including Infosecurity Magazine, CSO Online, Tripwire, Security Affairs, Network Computing, Security Boulevard, and several other renowned cybersecurity blogs.His in-depth knowledge and extensive experience in the industry make him a trusted source for cutting-edge insights and information in the ever-evolving world of cybersecurity.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


More Stories that May Interest You

Take a
Product Tour

See how easy it is to manage privacy compliance with robotic automation.

At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.


Gartner Cool Vendor Award Forrester Badge IAPP Innovation award 2020 IDC Worldwide Leader RSAC Leader CBInsights Forbes Security Forbes Machine Learning G2 Users Most Likely To Recommend