Cookie Banner Text Generator

Cookie consent banners are notices that disclose tracking and (under GDPR/ePrivacy) request opt-in before non-essential cookies fire. The text must explain what cookies are used, name the categories, link to a full policy, and provide accept/reject controls of equivalent prominence.

The generator takes site name, cookie categories used (essential, analytics, marketing, functional), and jurisdiction (GDPR, CCPA, generic) and produces compliant banner copy. It does not produce the JavaScript that conditionally loads scripts — copy alone is not compliance.

The regulatory backdrop. GDPR (EU) and the ePrivacy Directive together require opt-in consent before non-essential cookies fire. Consent must be specific, granular, freely given, and as easy to withdraw as to grant. The CNIL (France's data protection authority) has fined sites where 'reject' was harder to access than 'accept'. CCPA (California) takes a different approach: cookies can fire by default, but users must be able to opt out via a 'Do Not Sell or Share My Personal Information' link. UK GDPR mirrors EU GDPR with minor modifications. Brazil's LGPD, Canada's PIPEDA, and various other jurisdictions add their own variations. The generator picks a baseline that satisfies the strictest applicable regime and adjusts text per jurisdiction.

A worked example. A site uses essential cookies (session, CSRF), analytics (Google Analytics 4 with consent mode), and marketing (Meta Pixel, conversion tracking). For an EU audience the banner should: state the site name and that cookies are used, list the categories with one-line descriptions, link to a fuller cookie policy, present 'Accept all' and 'Reject all' as equally prominent buttons (both single-click), offer a 'Customize' or 'Manage preferences' option for granular control, and persist the choice for at least 6 to 12 months without re-prompting. Pre-ticked checkboxes or 'continuing to use the site implies consent' messaging are explicitly non-compliant under GDPR. The generated text follows this structure; production deployment requires the complementary JavaScript that actually conditionally loads scripts based on the choice.

Limitations to be honest about. The text is the easy part; the technical enforcement is harder. Compliance requires the analytics and marketing scripts to not fire until consent is granted — most consent management platforms (OneTrust, Cookiebot, Klaro) handle this. A banner that says 'we use analytics with your consent' but loads Google Analytics regardless is still non-compliant. Cookie wall (must accept to continue) is generally not allowed under GDPR because consent must be freely given; some narrow exceptions for paid alternatives exist. The generator produces a starting template, not legal advice. Sites operating in regulated industries, multiple jurisdictions, or with significant cross-border data flows need professional review. The fines under GDPR are real and substantial — Meta has paid over €1B across multiple cases — and disproportionate enforcement against small sites is rare but not zero.