Custom cookie policies and consent notices drafted by lawyers, compliant with the GDPR, the UK GDPR, India’s DPDPA, and California’s CCPA. Drafted alongside your privacy policy and terms as a consistent set. Fixed fees, 24 to 48 hours.
Share what your website or app does, what cookies and trackers it uses, and which jurisdictions your users are in. A contract lawyer from our team will assess which documents you need, cookie policy, consent notice, privacy policy, and respond with a precise quote and timeline.
Most cookie policies are drafted in 24 to 48 hours. A complete data pack (cookie policy, privacy policy, consent) in 3 to 5 days.
Cookies sound trivial, but they are one of the most heavily regulated parts of running a website. Under the GDPR and the UK GDPR, non-essential cookies, analytics, marketing, advertising, require the user’s prior, informed consent, obtained through a compliant consent banner, along with a cookie policy that explains what cookies you use and why. Get this wrong and you carry real regulatory exposure, exactly the kind that data-protection authorities have started enforcing.
My Legal Pal drafts cookie policies and consent notices for websites, mobile apps, SaaS platforms, and digital services that comply with the rules that apply to you: the GDPR, the UK GDPR and PECR, India’s DPDPA, California’s CCPA, and equivalent frameworks. Drafted by a contract lawyer for the cookies and trackers your platform actually uses, not a generic template that lists cookies you may not even set.
A cookie policy does not stand alone. It works with your privacy policy and your consent banner, and the three must align. We draft them as a consistent set so they reference each other correctly and your consent mechanism actually does what the policy says.
From a cookie audit to launch-ready documents, with internal review at every stage.
What cookies and trackers your site actually sets, first-party and third-party, and what each does. The step templates skip.
Which rules bind you, GDPR, UK GDPR and PECR, DPDPA, CCPA, based on where your users are.
A cookie policy that lists your real cookies by category, purpose, and duration, with the consent position for each.
We make sure the policy matches your consent banner and your privacy policy, so the three work together.
Plain-language summary of what you must do, banner behaviour, opt-out, to stay compliant, not just publish.
Adjusted to your feedback and delivered ready to publish and to satisfy app store privacy disclosures.
The platform and the regulation decide what your cookie policy and consent must cover. We draft for each of these.
Cookie policy and consent for a content or business site.
Analytics, marketing, and retargeting cookie disclosure.
Product analytics and functional cookie consent.
SDK and tracker disclosure for app store privacy labels.
Prior opt-in consent banner and policy for EU and UK.
India’s consent and notice requirements for trackers.
Do-not-sell and Global Privacy Control handling.
The wording and structure of a compliant banner.
Cookie policy, privacy policy, and consent as one set.
A generated template lists generic cookie categories. A compliant policy documents the cookies your site really sets and implements the consent rules that apply to you. At minimum, ours address the following.
A real inventory: the specific cookies and trackers your site sets, first-party and third-party, listed by name, provider, category, purpose, and duration. Regulators expect specifics, not a generic list of cookies you may not even use.
Strictly necessary, functional, analytics, and marketing cookies, and crucially, which run without consent (necessary only) and which require prior opt-in consent (everything else). Mislabelling an analytics cookie as necessary is a common and serious error.
Which cookies you set and which are set by third parties (Google Analytics, ad networks, chat tools, embeds). This affects who controls the data and how users exercise their rights, and templates rarely get it right.
How consent is obtained, recorded, and withdrawn. Under the GDPR and UK GDPR, consent must be prior, informed, freely given, and as easy to withdraw as to give. The policy must describe a banner that actually does this, not a “by using this site you agree” notice, which is not valid consent.
Analytics, advertising pixels, social embeds, and SDKs each set their own cookies and often transfer data internationally. The policy must disclose them and, for apps, feed the app store privacy labels correctly.
Clear instructions for managing, blocking, and deleting cookies through the consent tool and the browser, plus how to opt out of analytics and honour Do Not Track and Global Privacy Control signals where they apply.
The cookie policy handles the on-device technologies; the privacy policy handles personal data more broadly. The two must reference each other and never contradict. We draft them as a consistent set.
If your site uses non-essential cookies, effectively any site with analytics, marketing, or embedded third-party content, then yes. Under the GDPR, the UK GDPR and PECR, and equivalent laws, you must both obtain prior consent for non-essential cookies through a compliant banner and provide a cookie policy explaining what cookies you use. A site with only strictly necessary cookies has lighter obligations, but almost no commercial site is in that category.
A cookie policy explains the specific technologies that store and read data on a user’s device: what cookies you set, their purpose, duration, and how to control them. A privacy policy is the broader document covering all personal data you handle, the lawful basis, rights, sharing, and retention. They are separate but linked, and most sites need both. We draft them together.
No. A banner without a policy behind it, or a banner that only offers “accept” with no easy way to decline, is not compliant consent under the GDPR and UK GDPR. Consent must be prior (before non-essential cookies fire), informed (the policy explains what they are), and freely given (declining is as easy as accepting). The banner and the cookie policy have to work together, which is exactly what we draft.
A generator produces a generic list of cookies that may bear no relation to what your site actually sets, and it cannot align with your specific consent banner. For a simple site it may be tolerable; for any platform running analytics, advertising, or third-party embeds, a generated policy that misstates your cookies or mislabels their consent status is a compliance gap a regulator or a customer’s privacy team will find.
In the EU and the UK, yes. Analytics cookies are non-essential, so under the GDPR and UK GDPR they require prior opt-in consent before they fire. This is why a compliant setup blocks Analytics until the user accepts, rather than loading it on arrival. We draft the policy and describe the consent behaviour that makes this compliant.
Yes. Apps use SDKs and trackers that behave like cookies, and both Apple and Google require you to disclose them accurately in your privacy labels and Data Safety form. A cookie and tracker policy that matches your actual SDKs supports those disclosures and reduces the risk of app store rejection.
Cookie rules differ by region. The regulation that binds you depends on where your users are, and most platforms with any reach need to satisfy more than one.
The EU sets the strictest standard. The ePrivacy Directive requires prior consent for non-essential cookies, and the GDPR governs the personal data they collect. Consent must be opt-in, granular, never pre-ticked, and as easy to withdraw as to give. We draft policies and consent copy to this standard.
The UK applies the UK GDPR alongside the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner’s Office (ICO). The requirements closely track the EU but with UK-specific guidance. We draft UK-facing cookie policies to this framework.
India’s Digital Personal Data Protection Act, 2023 is consent-centric. As the rules take shape, cookies that collect personal data engage the notice-and-consent framework, and we draft DPDPA-aware cookie notices for businesses serving users in India.
California focuses on the right to opt out of the sale or sharing of personal information, which reaches many advertising and analytics cookies, and requires honouring the Global Privacy Control signal. We draft cookie policies and opt-out mechanisms for California and the broader US state landscape.
The documents most digital businesses need alongside their cookie policy.
The broader data-disclosure document.
The contract every user agrees to.
Protect confidential information you share.
Enterprise, vendor, and DPA agreements.
Prakhar Rai | Founder and Advocate
Prakhar Rai is an advocate enrolled with the Bar Council of India and the founder of My Legal Pal. An alumnus of the National Law School of India University (NLSIU), Bangalore, with a Master of Business Laws, Prakhar has 10+ years of experience advising startups, technology companies, SMEs, and individual entrepreneurs across India, the UAE, the UK, and Southeast Asia.
His practice focuses on technology and data-protection law, with particular depth in privacy and cookie compliance across the GDPR, the UK GDPR, India’s DPDPA, and the US state-privacy landscape. My Legal Pal’s cookie and privacy documentation is led by Prakhar and delivered by a team of qualified lawyers experienced in data protection and platform law.
GDPR, UK GDPR, DPDPA, and CCPA aware. For websites, apps, and platforms. Drafted with a compliant consent banner and paired with your privacy policy. Fixed fees, 24 to 48 hours for standard policies.
Call +91 8004800100