Start freeDashboard
Documentation

Documents

Cookiemark can write four documents for your site: a cookie policy, a privacy statement, a page for US privacy choices and an impressum. All are optional. They come from what you already keep in Cookiemark, so they stay up to date each time you publish.

The wizard

Open the site and go to the Documents tab. A short wizard takes you through it:

  1. Your company

    The company behind the site, filled in from the last scan where possible. A name and an email address are needed.

  2. Documents

    Pick the documents you want. Cookiemark recommends the ones that fit your site.

  3. What your site does

    Only with the privacy statement: tick what your site does with personal data. The services the scan found, such as a payment provider or a newsletter tool, tick the matching boxes for you.

  4. Sharing and keeping data

    Only with the privacy statement: your service providers, filled in from the scan, transfers outside the EEA, how long you keep data, and for US visitors whether you sell or share personal information.

  5. Check and place

    A preview of each document in any language, the line to put on your site, the address of each page, and a button to publish.

Each step saves to the draft. Put the line of each document on a page of your site, and publish. To change your answers later, choose Run the wizard again on the last step: it starts at the first step with everything you filled in before.

<div data-cookiemark-document="cookies"></div>
<div data-cookiemark-document="privacy"></div>
<div data-cookiemark-document="choices"></div>
<div data-cookiemark-document="impressum"></div>

On WordPress with our plugin, use the shortcode instead, such as [cookiemark_document type="privacy"], with the same four types. A document you have not switched on stays empty.

Set the address of your cookie policy page under Settings, Links and behaviour, so the banner links to it.

The cookie policy builds on the cookie list for your policy page and adds what the law asks a policy to say. In order, it covers:

  • who is responsible for the cookies on your site: your company;
  • what cookies are, and the legal basis for each kind;
  • the visitor's own choice, with buttons to change or withdraw it, and the record kept of it;
  • a table per category with each cookie's name, provider, purpose, expiry and type;
  • cookies of other companies, and transfers outside the European Economic Area;
  • how to remove cookies in the browser;
  • for sites with US opt-out countries: the right to opt out of the sale or sharing of personal information, with a button;
  • the visitor's rights, how to complain, how the policy changes, and your contact details.

The texts are written against the GDPR, the ePrivacy rules, the guidance of European regulators and the California privacy rules. Use the cookie policy together with your own privacy policy, which covers everything else your site does with personal data.

The privacy statement

The privacy statement covers everything your site does with personal data, not only cookies. In the step What your site does you tick what applies:

  • a contact form, email or phone;
  • accounts that visitors sign in to;
  • a newsletter;
  • orders and payments;
  • job applications;
  • comments and reviews.

Each choice adds a section with the data used, the purpose, the legal basis and how long it is kept. Every statement also covers website visits, cookies, who receives data, security, the visitor's rights and complaints. List your service providers, such as your host and mail service, one per line, and tick whether data leaves the European Economic Area. The statement then names them and the safeguards for transfers.

Two more boxes cover what needs extra care: sensitive data, such as health, and a site aimed at children. Each adds a section, and the wizard advises a legal check.

Some sections write themselves from your cookie list. With statistics cookies the statement names the companies behind them and the consent they need; with marketing cookies it explains the advertising and the profiling that comes with it. For sites with US visitors it adds what US state laws ask, with a link to your Your Privacy Choices page.

Read the statement once it is published. If your site does something the modules do not cover, such as video calls or a loyalty programme, add it in a section of your own.

Your Privacy Choices

For visitors in the United States. The page shows whether this browser has opted out of the sale or sharing of personal information, with a button to opt out and one to change the choice. It notes a Global Privacy Control signal when the browser sends one, explains what selling and sharing mean, and lists the other rights with your contact details.

Link to it from every page, for example in your footer, with the text "Do Not Sell or Share My Personal Information". California only allows the shorter "Your Privacy Choices" when the page also lets visitors limit the use of sensitive personal information, which this page does not cover. Use it together with the opt-out notice.

The impressum

Websites in Germany and Austria must say who runs them. The impressum lists your company, address, email and phone, trade register and number, VAT number and representative. For a licensed activity or a regulated profession it adds the supervisory authority and the professional details. Fields you leave empty stay out.

In German the impressum opens with "Angaben gemäß § 5 DDG". For a company with Austria as its country it says "Angaben gemäß § 5 ECG und Offenlegung gemäß § 25 MedienG" instead.

Company details

The documents name the company behind the site. Every site has its own details, because nearly every site belongs to its own company, also when an agency runs it.

You do not have to type them. Each scan reads the site's own contact, about and legal pages, and its structured data, and the first step of the wizard fills in what it found: the name, address, email, phone, trade register, VAT number and, from a German impressum, the representative. Fields filled in this way are marked. Check them before you save, because a website does not always say it the way your documents should.

The step also asks about a data protection officer, a representative in the EU or UK for a company outside them, and where people send a privacy request when that is not the general email address.

Placing the documents

In the last step you give the address of the page where each document is placed. The banner then links to your cookie policy and privacy statement, and the documents link to each other. The next scan visits those pages and marks each document as found on your site, or not found.

With an AI site builder

Sites made with Lovable, Bolt, v0, Claude Code or Cursor usually keep the legal links in the footer. Under Documents, Place them on your site, copy the prompt and give it to the assistant. It makes a page for each document you switched on, with the empty element Cookiemark fills, puts the links in the footer next to Cookie settings, and lists the addresses to fill in. The pages stay empty in the code: Cookiemark writes the text when the page opens, also when a single-page app shows the page without loading it again.

Without a prompt it comes down to this: one page per document, with an <h1> and the line from the dashboard under it, and in React or another framework the element written without children, such as <div data-cookiemark-document="privacy" />.

Languages

A document shows in the visitor's language, like the banner, in every language Cookiemark has. To show one language to everyone, add data-lang to the line, for example <div data-cookiemark-document="impressum" data-lang="de"></div>. The shortcode takes lang="de". The cookie list on your policy page takes data-lang as well.

Changing the texts

Under Adjust the texts, at the end of the wizard, you can rewrite every paragraph in any of the languages Cookiemark has, also the ones your banner does not use yet. A paragraph you change is marked as changed and no longer follows improvements to our standard text. Tick Back to the standard text to undo it.

You can also add a section of your own at the end, with a heading and text. Leave a blank line between paragraphs. Bold, italic and links work, as in the banner texts.

Proof of consent

A regulator or a client may ask you to show how you asked for consent at a given time. Under Settings, Versions, each published version has a Proof of consent button. It opens a page with that version as visitors got it: the banner texts and buttons, the categories, how long a choice is kept, the scripts held back, Google Consent Mode, the region rules, the cookie list, and how many choices of each kind were logged while it was live. Print it or save it as a PDF from your browser.