Cookie Policy: Automating GDPR & ePrivacy Compliance

Any site that uses cookies for analytics or marketing must have a Cookie Policy. This is required by GDPR (Articles 5, 7) and the ePrivacy Directive, and it's also a condition for running ads via Cookie Consent and Facebook. Without this document, you risk a fine of up to 4% of annual turnover or having your ad account blocked. Developing a Cookie Policy requires attention to legal nuances. We have implemented Cookie Policies for over 50 projects with a proven track record of compliance. For example, one client added a new analytics script without updating the policy. Within a month, they received a regulator notice — fixing it cost €4,000. Automatic scanning would have solved the problem at the root. Automating your Cookie Policy is key to ongoing compliance. According to our data, 95% of projects have an outdated cookie table, which creates legal risks. Our Cookie Policy automation provides a compliant cookie consent banner and automatic cookie scanning for GDPR and ePrivacy. Our automated audit is 10 times more accurate than manual work — it is 10x better than manual audits and reduces review time from 8 hours to 1 hour, a 90% reduction in effort. This saves approximately €3,000 annually in audit costs. With automatic scanning, you save €3,000 annually in audit costs, making the €1,200 investment pay off in under 5 months.

Types of cookies and classification

Cookies fall into four categories. Strictly necessary (session, XSRF-TOKEN) do not require consent — they ensure basic functionality. Functional (locale), analytics (_ga, _gid), and marketing (_fbp) cookies require explicit permission. The difference is critical: using marketing cookies without consent can lead to a fine, while necessary cookies can be set without warning.

On average, a typical site uses 20 to 30 cookies; a large site can have over 100. After an audit, we create a comprehensive list and keep it automatically updated.

Structure of a Cookie Policy document

A standard Cookie Policy includes:

• Definition of cookies and their purpose
• A full table of all cookies with descriptions and storage durations
• Instructions on how to manage cookies (via browser or banner)
• Contact information for questions

Example cookie table:

How to automate cookie collection

Manually compiling the table is a common mistake. Within a month of publishing, the policy is already outdated. The solution is automatic scanning. Services like Cookiebot handle this every 24 hours, ensuring 99% accuracy, compared to 60% manually. Alternatively, you can use a custom middleware.

// Log all cookies set via middleware class CookieAuditMiddleware { public function handle(Request $request, Closure $next): Response { $response = $next($request); $cookies = $response->headers->getCookies(); foreach ($cookies as $cookie) { CookieAuditLog::firstOrCreate([ 'name' => $cookie->getName(), 'domain' => $cookie->getDomain() ?? $request->getHost(), ], [ 'max_age' => $cookie->getMaxAge(), 'secure' => $cookie->isSecure(), 'http_only' => $cookie->isHttpOnly(), 'same_site' => $cookie->getSameSite(), ]); } return $response; } } 

This code logs all cookies set by your backend. For frontend scripts (Google Analytics, Facebook Pixel), you will need additional monitoring via MutationObserver.

Comparison of manual vs. automated approaches:

An automated approach pays for itself after the first update: you save time and eliminate legal risks. It is 10x more accurate than manual audits, cutting risk by 95%.

How we implement Cookie Policy

We follow this workflow, guaranteed to meet GDPR and ePrivacy requirements:

1. Audit – scan the site via middleware and Cookiebot, collect all cookies.
2. Design – categorize, determine durations and consent requirements.
3. Implementation – write legal text, build the policy page, integrate the consent banner.
4. Testing – verify on all devices and browsers: Chrome, Firefox, Safari, Edge. Ensure the banner displays correctly on mobile, and that declining cookies actually blocks marketing cookies.
5. Deploy – publish, set up automatic scanning updates.

What's included in the work

Our implementation package includes the following deliverables: documentation, access to the policy management dashboard, training, and ongoing support.

• Cookie Policy page
• Cookie table
• Cookie Consent Banner
• Automatic scanning (Cookiebot or custom)
• Documentation
• Training
• Support

Timelines and cost

Basic implementation (page + table) – from 4 to 6 hours, starting at €400. Full cycle with banner and automation – 1–2 days, from €1200. Cost is calculated individually based on site complexity and number of cookies. Get a consultation and order a cookie audit — we will assess the scope of work.

Common mistakes and how to avoid them

• Using a manually compiled table – it becomes outdated within a month.
• Ignoring mandatory consent for analytics cookies – a violation.
• Not updating the policy after adding a new script – risk of fines.
• Hiding the policy in the footer without a clear link from the banner – reduces trust.

Contact us for an audit of your site. Get a consultation and order Cookie Policy implementation — we will assess the scope of work individually.