Google tells publishers what a privacy policy must say about advertising cookies, then adds that the wording varies by jurisdiction and that it provides no template. In our experience that leaves many small sites with a generic policy that describes a site other than theirs. A short policy that is true beats a long one that is not, and it is also the only kind that survives the day you add something new.
Ours is short because the site is: no accounts, no cookies, no ads today, and server logs deleted after about 14 days. The advertising paragraph is conditional. It says the policy will be updated before the first ad is shown and lists the disclosures that will then apply. That is the pattern we recommend for a site that has not yet applied to AdSense: describe what happens now, and say what will change first.
What Google requires the policy to say
Google’s help page on privacy and ads asks your policy to tell visitors three things:
- Third-party vendors, including Google, use cookies to serve ads based on a visitor’s earlier visits to your site or to other sites.
- Google’s use of advertising cookies allows it and its partners to serve ads based on visits to your site and to other sites on the internet.
- Visitors can turn off personalized advertising in Google’s Ads Settings.
If you leave third-party ad serving switched on, Google adds a fourth duty: identify the vendors involved, link to their sites and say that visitors can opt out there. It names aboutads.info as an alternative opt-out route. Beyond that, Google gives no wording, and says phrasing differs between jurisdictions.
What a review actually checks, Google does not say. Our checker looks for the page, for the advertising-cookie wording and for whether the page can be indexed. We treat that as the floor, because it is the part a tool can verify.
A policy and consent are different jobs
The policy is a document: it tells people what happens to their data. Consent is a mechanism: it asks permission before a cookie is set. Neither replaces the other, and a site that has one without the other has a gap.
For visitors in the EEA and the United Kingdom, and in Switzerland, Google’s EU user consent policy requires legally valid consent for cookies and local storage and for ad personalization. You must keep evidence of that consent and explain how a visitor withdraws it. Since 16 January 2024 for the EEA and the United Kingdom, and 31 July 2024 for Switzerland, serving personalized ads also requires a consent management platform that Google has certified and that works with the IAB’s Transparency and Consent Framework. Without one, you do not get personalized ads.
So the policy should say what consent covers and where to withdraw it, while the banner collects it. The details of the banner are in cookie consent and AdSense.
The GDPR skeleton
Articles 13 and 14 of the GDPR list what a site must tell people, and Article 13 asks for it at the moment data is collected, which on a website means a link visible on every page. The structure below follows that list. The right-hand column shows typical choices for a small content site. We are not lawyers: the legal bases in particular depend on your facts and your country, so have the text reviewed if you sell to consumers or handle sensitive data.
| Section | What it must answer | A small-site example |
|---|---|---|
| Who | Who decides what happens to the data, and how to reach them | Your name or company, and a mailbox you read |
| What | Which data, and how it is collected | IP address and user agent in server logs; an email address if someone writes |
| Why and on what basis | The purpose of each use and its legal ground | Security and error diagnosis (legitimate interest); advertising cookies (consent) |
| Who receives it | Hosts and other processors | Your hosting provider; ad vendors once ads run |
| Transfers | Whether data leaves the EEA | Where your servers are; where your ad vendors process data |
| How long | A retention period for each kind of data | Logs deleted after 14 days |
| Your rights | Access, correction, erasure, restriction, objection, portability, withdrawal of consent, complaint | How to ask, and which authority to complain to |
Treat the IP addresses in your server logs as personal data. Recital 30 of the GDPR lists internet protocol addresses among the online identifiers it has in mind, and a policy that says “we collect no personal data” while a web server logs every visit is wrong on its first line.
3 passages, written plainly
These are for an invented site with no accounts, hosted in the EEA. They are starting points, not legal text: change every fact that is not true for your site. The lines are wrapped to fit the box, and HTML or Markdown joins them back into paragraphs.
The advertising paragraph, for when ads run:
Advertising. We show ads served by Google and other third-party
vendors. These vendors use cookies to serve ads based on your earlier
visits to this site or to other websites. Google's use of advertising
cookies lets it and its partners serve ads to you based on your visit
to this site and to other sites on the internet. If you are in the
European Economic Area, the United Kingdom or Switzerland, we ask for
your consent before any advertising cookie is set, and you can change
or withdraw it at any time through the "Privacy settings" link in the
footer. You can turn off personalized advertising in Google's Ads
Settings (adssettings.google.com), or opt out of some third-party
vendors' use of cookies at www.aboutads.info.The server log paragraph, which almost every site needs:
Server logs. Our web server records every request: your IP address,
the time, the page requested, the response code and your browser's
user agent. We use these logs to keep the site secure, to diagnose
errors and to compile statistics that contain no IP addresses. Our
legal basis is our legitimate interest in running a secure service.
Logs are deleted automatically after 14 days. They are stored by our
hosting provider, [provider name], in [country].The rights paragraph:
Your rights. You can ask us what data we hold about you, ask us to
correct or delete it, ask us to restrict or stop using it, and ask
for a copy in a portable format. Where we rely on your consent, you
can withdraw it at any time. Write to [contact address] and we will
answer within one month. If you are not satisfied, you can complain
to your data protection authority, for example the CNIL in France or
the ICO in the United Kingdom.Replace everything in square brackets with your own details, and delete any sentence that is not true for your site. A passage that you cannot match to something your pages really do is worse than no passage, because the policy is read against the site.
When you add something, update the policy
A policy is accurate on the day it is written and starts drifting the day after. These are the additions that most often make it wrong:
| You add | The policy now has to say |
|---|---|
| Google AdSense or another ad network | The cookie statements above, the vendors, how to opt out, and how consent works for the EEA, the United Kingdom and Switzerland |
| An analytics tool | Which tool, what it records, whether it sets cookies or identifiers, how long data is kept, and the legal basis |
| A newsletter or contact form | What you collect, which provider processes it, how long you keep it and how to unsubscribe |
| Comments | What is stored (name, email, IP address), what is public and how to have a comment removed |
| Embedded videos, maps or social buttons | That the provider may set cookies or receive the visitor’s IP address when the embed loads |
| A new host, CDN or externally hosted fonts | The new processor, and where its servers are |
Move the date at the top whenever you edit, and keep a record of what changed, as we do in our public changelog.
The mistakes we see most
“We use no cookies” on a site that does. Analytics, embedded players and some themes set cookies without announcing it. Before you write the sentence, open your pages in a clean browser profile, look at the cookies and the third-party requests in the developer tools, and list what you find. The list is your policy’s source of truth.
A policy that describes someone else. A copied text names a company you are not, a host you do not use and a country whose law may not apply to you. The mismatch is easy to miss when you paste and hard to defend once a visitor, or a reviewer, spots it.
Promises the ad vendors break. “We never share your data” cannot sit next to Google’s advertising cookies. If ads run, the disclosure above is the honest version.
No way to use the rights. A rights section with no contact address is decoration. Put a working mailbox in it and answer what arrives.
To build the structure from what your site really does, the privacy policy generator turns your ticked options into a policy and the disclosures page, in your browser. For where the page sits among the others a reviewer expects to find, see important pages for AdSense approval.
Quick answers
Where should the privacy policy live?
At a stable address such as /privacy/, linked from the footer of every page and open to indexing. Our AdSense checker tests that the page exists, that it mentions advertising cookies and that Google is allowed to index it.
Can I copy another site's policy and change the name?
We advise against it. A copied policy carries someone else's processors, jurisdiction and promises into your site, and the text may be protected by copyright. Use a template as a skeleton, then rewrite every statement to match what your own site does.
