As of 13 August 2026, AI can only partly write a cookie policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your website's cookie-consent settings and current cookie scan, then export or copy the full inventory of cookies and similar technologies, including provider, purpose, duration and category.
   2. Gather your business name, website address, contact email, trading address, embedded services, analytics tools, advertising tools and consent-management platform settings.
   3. Paste the inventory and business details into the prompt, replacing each bracketed slot and leaving unknown facts marked as [CONFIRM].
   4. Ask the chatbot to produce the policy and its separate table of missing facts, inconsistencies and points needing professional checking.
   5. Compare every cookie and technology in the draft with the current scan, and correct names, providers, purposes, durations and categories before publishing.
   6. Open the ICO guidance relevant to cookies and electronic marketing, check the consent description against your actual banner and withdrawal process, then ask a UK data-protection solicitor or suitably qualified privacy professional to check the final policy for a serious or complex business.

   Prompt

   Write a draft cookie policy for a UK business using the information below. This is not professional advice. Apply UK GDPR and the Privacy and Electronic Communications Regulations as understood from current ICO guidance, but flag every point that needs confirmation rather than inventing an answer. Use plain British English and structure the result with: what cookies and similar technologies are, the categories used, each cookie or technology with its name, provider, purpose, duration, type and whether it is essential, how users can manage consent, how to withdraw consent, contact details, and a short change-log section. Separate strictly necessary technologies from analytics, advertising, personalisation and other non-essential technologies. Do not state that consent is obtained unless the supplied information confirms how and when it is obtained. Do not invent cookie names, vendors, durations, purposes, legal bases, international transfers, contact details or retention periods. Mark missing information as [CONFIRM]. After the draft, provide a table of missing facts, inconsistencies and claims that need checking by a UK data-protection solicitor or suitably qualified privacy professional. Business details: [business name, company number if relevant, trading address, website address, contact email]. Website and services: [what the website does, account or payment functions, embedded services, advertising and analytics tools]. Cookie or tracking inventory: [paste the output of a current cookie scan, including name, provider, purpose, duration and category]. Consent setup: [consent management platform, categories shown, default settings, record-keeping, withdrawal method]. Other information: [relevant suppliers, international transfers, privacy contact, last reviewed date].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.