---
title: Cookie Policy
description: Generate and render a cookie policy from your policystack.ts config
---

> **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support).

See the [Quick Start](https://policystack.dev/docs/policy/policies/quick-start) to add a cookie policy page to your app.

Add cookie fields to your config — the cookie policy is auto-detected from the presence of the `cookies` field:

```ts
// policystack.ts
import { defineConfig, LegalBases } from "@policystack/sdk";

effectiveDate: "2026-01-01",
jurisdictions: ["eea", "us-ca"],
cookies: {
  used: {
    essential: true,
    analytics: true,
    functional: false,
    marketing: false,
  },
  context: {
    essential: { lawfulBasis: LegalBases.LegalObligation },
    analytics: {
      lawfulBasis: LegalBases.Consent,
      label: "Analytics",
      description: "Helps us understand how the site is used.",
      respectGPC: true,
    },
    functional: { lawfulBasis: LegalBases.Consent },
    marketing: { lawfulBasis: LegalBases.Consent },
  },
},
thirdParties: [
  {
    name: "Google Analytics",
    purpose: "Website analytics and performance monitoring",
    policyUrl: "https://policies.google.com/privacy",
  },
],
```

The consent mechanism (banner / preference panel / withdrawal) is **derived** from this cookie posture — any consent-gated category yields all three — so it is no longer authored. It surfaces in the cookie policy's consent section automatically.

`cookies.used` always requires `essential: true`; other keys are `boolean` and act as additional categories. Every key in `cookies.used` must have a matching Article 6 basis in `cookies.context[key].lawfulBasis` — `defineConfig` enforces this at type-check time, and the rendered "Cookies and Tracking" section appends the basis to each enabled category.

Each context entry may also set `label`, `description`, and `respectGPC` for the derived consent category. Missing copy falls back field-by-field to the built-in cookie-type dictionary for `locale` (English by default), so a preference panel can render `useConsent().categories` directly. Set `respectGPC: false` only for a category that should remain available when a GPC signal is active.

`defineConfig` also computes a `cookieVersion` — an 8-char hash of the cookie slice of your config — which is printed in the intro paragraph next to the effective date. See [Policy versions](https://policystack.dev/docs/policy/configuration#policy-versions).

Then render it:

```tsx
import { PolicyStack } from "@policystack/react/provider";
import { CookiePolicy } from "@policystack/react/policy";
import policy from "@/policy";

export function CookiePolicyPage() {
	return (
		<PolicyStack config={policy}>
			<CookiePolicy />
		</PolicyStack>
	);
}
```

Looking to add a consent banner? The same `cookies` config drives it — see the [Consent docs →](https://policystack.dev/docs/consent).