Table of Contents
Why You Actually Need One
Under GDPR (EU) and similar laws in the UK, California, and elsewhere, any site that sets non-essential cookies — analytics, advertising pixels, embedded YouTube videos, font loaders, chat widgets — needs both a cookie policy disclosing what's collected and a consent mechanism that blocks those scripts until a visitor agrees. A privacy policy alone isn't enough; regulators specifically look for documented, timestamped consent.
Almost every site with Google Analytics needs this
If you've ever pasted a Google Analytics or Google Ads tracking snippet into your site without a consent banner in front of it, you're technically out of compliance the moment an EU visitor lands on the page.
Generating a Free Cookie Policy
iubenda offers a free plan specifically for smaller sites — no credit card required to generate your first policy.
- Sign up and answer a short questionnaire about what your site collects (analytics, ads, embeds, forms)
- iubenda auto-detects common third-party services (Google Analytics, Facebook Pixel, YouTube embeds) and lists them in the policy
- Review the generated policy — on the free plan, it covers up to 3 third-party services in a single language
- Publish and grab the embed snippet
Embedding It on Your Site
iubenda gives you a small JavaScript snippet that renders your policy as a linked page and keeps it updated automatically when you add new services — no manual re-editing every time you add a new analytics tool.
Footer link is the standard, expected location
Most compliance frameworks expect a "Privacy & Cookie Policy" link in the site footer, visible on every page — not buried in a menu.
Adding a Consent Banner
A policy alone doesn't satisfy GDPR — you also need a banner that actually blocks non-essential scripts until the visitor consents. iubenda's Cookie Consent Solution (CMP) handles this: it scans your site for trackers, blocks them by default, and only fires them after explicit opt-in. It also supports Google Consent Mode out of the box, which matters if you run Google Ads or Analytics, since Google increasingly requires Consent Mode signals to keep reporting accurate conversion data.
Free Plan Limits — and When to Upgrade
The free plan is genuinely usable for a small site, but it's capped:
- Under 1,000 monthly pageviews — cross this and the banner stops rendering until you upgrade
- Up to 3 third-party services listed — a typical site with Analytics + Ads + one embed already hits this
- Single language only — no multi-language policy on free
- Twice-yearly automatic scans — paid plans scan and update more frequently as you add new tools
Pricing 2026
| Plan | Price | Services/Clauses |
|---|---|---|
| Free | $0 | Up to 3, 1 language |
| Essentials | From ~$5.99/mo | Up to 20 |
| Advanced | Higher tier | Up to 30 + Terms & Conditions generator |
| Ultimate | Highest tier | Unlimited, no iubenda branding |
Google Consent Mode is included on every tier, including free. See iubenda's current pricing for exact rates by plan.
Common Mistakes
- Publishing a policy without a blocking consent banner. A policy page that discloses cookies but doesn't actually stop them from loading before consent isn't compliant — the policy and the banner have to work together.
- Forgetting embeds count as third parties. A single embedded YouTube video or Google Font counts toward your service list — sites blow past the free plan's limit of 3 faster than expected.
- Not re-scanning after adding new tools. Adding a new ad network or chat widget without updating the policy is a common, easily-missed compliance gap.