Cookie Policy
Template — South Africa
An attorney-drafted Cookie Policy template designed specifically for South African websites and applications. This comprehensive, legally compliant document discloses how your website uses cookies, tracking pixels, web beacons, local storage, and similar technologies to collect visitor information — covering cookie categorisation, consent mechanisms, opt-out procedures, POPIA compliance for personal information collected through tracking technologies, ECTA transparency requirements, and GDPR obligations for South African businesses with European Union visitors. Built for e-commerce platforms, SaaS applications, content publishers, and any South African business with an online presence.
Drafted by qualified South African attorneys
Reviewed for compliance with current legislation · Last updated April 2026
Why Your Business Needs This Agreement
Loading Third-Party Cookies Before Consent — Regulatory Exposure
Many South African websites load Google Analytics, Facebook Pixel, LinkedIn Insight Tag, and other third-party tracking scripts on page load — before the visitor has interacted with the cookie consent banner or been given any opportunity to consent. Under POPIA, this means personal information (IP addresses, device data, browsing behaviour) is being processed without a lawful basis. Under GDPR, this is a clear violation for EU visitors. Automated compliance scanning tools (used by regulators and privacy advocacy groups) can detect this non-compliance in seconds. A Cookie Policy without a properly implemented consent management platform that blocks non-essential cookies until consent is given is a disclosure document without enforcement — transparency without compliance.
Cookie Policy That Does Not Match Actual Cookie Usage
Websites frequently use a generic Cookie Policy template that does not reflect their actual cookie inventory — listing cookies they do not use and failing to disclose cookies they do use. Marketing teams add new tracking tools without updating the policy. Third-party embeds (YouTube videos, social media widgets) set cookies that are not disclosed. The result is a Cookie Policy that provides neither the transparency required by POPIA nor the informed basis for consent required by GDPR. The Information Regulator and EU data protection authorities specifically look for discrepancies between disclosed and actual cookie usage during compliance assessments.
No Mechanism to Withdraw Cookie Consent
Some websites implement a cookie consent banner that appears once, records consent, and never appears again — providing no way for visitors to change their preferences or withdraw consent. Under POPIA, consent can be withdrawn at any time (Section 11(2)(b)), and the responsible party must have a mechanism for this. Under GDPR, it must be as easy to withdraw consent as it was to give it. Without a persistent cookie preference centre accessible from every page (typically linked from the footer), the website fails to provide the ongoing consent management that both POPIA and GDPR require.
Cross-Border Cookie Data Transfers Without Safeguards
Almost every website that uses Google Analytics, Facebook Pixel, or other US-based services transfers personal information collected through cookies to countries outside South Africa. Under POPIA Section 72, cross-border transfers require the recipient country to have adequate data protection, or the data subject's consent, or another enumerated ground. Under GDPR, the Schrems II judgment invalidated the EU-US Privacy Shield, requiring businesses to implement alternative transfer mechanisms such as Standard Contractual Clauses. Without disclosing these cross-border transfers and the safeguards in place, the Cookie Policy fails to provide the transparency that both POPIA and GDPR demand.
Treating All Cookies as "Essential" to Avoid Consent Requirements
Some businesses miscategorise analytics and marketing cookies as "essential" or "strictly necessary" to avoid the consent requirement — arguing that Google Analytics is essential for website improvement or that Facebook Pixel is essential for marketing. Regulators have consistently rejected this approach. Essential cookies are those without which the specific service requested by the user cannot be provided — authentication, security, shopping cart, and load balancing cookies. Analytics and marketing cookies serve the website operator's purposes, not the user's requested service, and therefore require consent. Miscategorisation exposes the business to enforcement action for obtaining consent through deception.
What is a Cookie Policy?
Cookies and tracking technologies are embedded in virtually every modern website, collecting data that ranges from essential session management to detailed behavioural profiling for targeted advertising. For South African businesses, the legal landscape governing these technologies is shaped by three overlapping regulatory frameworks: the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and — for websites that serve European Union visitors — the General Data Protection Regulation (EU) 2016/679 (GDPR) and the ePrivacy Directive 2002/58/EC.
POPIA defines "personal information" broadly to include any information relating to an identifiable, living, natural person — and this explicitly encompasses unique identifiers. Cookies that collect IP addresses, device fingerprints, browsing history, location data, or any information that can be linked to an individual are processing personal information under POPIA. This triggers the full set of POPIA obligations: there must be a lawful basis for processing (Section 11), the data subject must be informed of the processing (Section 18), the processing must be for a specified, explicitly defined, and lawful purpose (Section 13), and appropriate security measures must be in place (Section 19). For non-essential cookies — analytics, marketing, and advertising cookies that are not strictly necessary for the website to function — consent is the most appropriate lawful basis under POPIA, and that consent must be voluntary, specific, and informed.
ECTA does not contain cookie-specific provisions equivalent to the EU's ePrivacy Directive, but it establishes important transparency requirements for electronic transactions. Section 11 requires that data messages (which include cookie-set information) be accessible and usable by the recipient. Section 43 requires e-commerce websites to provide accessible policies about their data practices. Section 45 restricts unsolicited electronic communications and requires opt-out mechanisms. While these provisions do not mandate a cookie consent banner in the same way the GDPR does, they create a best-practice framework that effectively requires South African websites to disclose their cookie practices transparently and provide users with meaningful control.
For South African websites that attract visitors from the European Union — which includes any website accessible globally, and certainly any website that actively targets EU customers through marketing, language options, or EUR pricing — the GDPR and ePrivacy Directive impose the strictest cookie consent requirements in the world. Under these regulations, non-essential cookies may not be set until the user has given explicit, informed, opt-in consent. Pre-ticked consent boxes are invalid. Cookie walls (blocking access unless all cookies are accepted) are considered non-compliant. The consent must be granular (allowing users to accept some categories while rejecting others), freely given (not bundled with terms of service acceptance), and as easy to withdraw as it was to give. South African businesses that process EU residents' data without GDPR-compliant consent face potential fines of up to EUR 20 million or 4% of global annual turnover.
This attorney-drafted Cookie Policy template provides a comprehensive, plain-language disclosure of your website's cookie practices that meets the requirements of POPIA, ECTA, and the GDPR. It covers every category of tracking technology (session and persistent cookies, first-party and third-party cookies, tracking pixels, web beacons, local storage, and device fingerprinting), provides the detailed cookie inventory disclosures required by regulators, establishes the consent framework and opt-out mechanisms, and explains data subject rights in accessible language. The policy is designed to work alongside a cookie consent management platform (CMP), providing the detailed information that the consent banner summarises.
Who Needs This
Want early access to the Cookie Policy template?
We'll email you the moment early access opens
POPIA defines personal information to include unique identifiers — cookies that collect IP addresses, device IDs, or browsing behaviour linked to individuals are processing personal information requiring a lawful basis
Non-compliance with POPIA can result in fines of up to R10 million and imprisonment for up to 10 years under Section 107 — the Information Regulator has signalled increasing enforcement activity
GDPR applies to South African websites that monitor EU visitors' behaviour (which analytics cookies do) — with fines of up to EUR 20 million or 4% of global annual turnover
Strictly necessary cookies (authentication, security, shopping cart) do not require consent — but analytics and marketing cookies always do under both POPIA and GDPR
Cookie walls that block website access unless all cookies are accepted are considered non-compliant under GDPR and are legally risky under POPIA's voluntary consent requirement
Key Clauses Included
This Cookie Policy template covers 10 essential sections, each drafted by South African attorneys.
What Are Cookies & Tracking Technologies
A plain-language explanation accessible to non-technical users, covering: what cookies are (small text files stored on the visitor's device), the difference between session cookies (deleted when the browser closes) and persistent cookies (remain until they expire or are deleted), first-party cookies (set by the website itself) versus third-party cookies (set by external services like Google, Facebook, or LinkedIn), and other tracking technologies covered by the policy — including tracking pixels, web beacons, local storage (HTML5), ETags, and device fingerprinting techniques. This foundational section ensures informed consent by explaining the technology before asking for permission.
Categories of Cookies We Use
Categorised disclosure of cookie types following the internationally recognised classification: strictly necessary cookies (authentication, security tokens, load balancing, shopping cart — no consent required), functional cookies (language preferences, display settings, user preferences), analytics and performance cookies (Google Analytics, Hotjar, Matomo — measuring website usage and performance), and marketing and advertising cookies (Facebook Pixel, Google Ads, LinkedIn Insight Tag — retargeting and conversion tracking). Each category includes a clear explanation of its purpose and whether consent is required.
Detailed Cookie Inventory
A comprehensive table listing every cookie used on the website — including the cookie name, provider (first-party or specific third-party service), purpose, data collected, type (session or persistent), and expiry period. This granular disclosure is required for GDPR compliance and represents best practice under POPIA. The inventory must be maintained and updated whenever new cookies are added or existing cookies are modified, ensuring the policy remains accurate and current.
How We Obtain Your Consent
Describes the consent mechanism — the cookie consent banner or cookie management platform (CMP), how it works on first visit, the default state of non-essential cookies (not loaded until consent is given — required for GDPR compliance and recommended for POPIA), granular category selection (allowing visitors to accept analytics but reject marketing cookies), how consent is recorded and stored (typically via a consent cookie with a unique identifier), and how the website handles visitors who do not interact with the banner. This section also addresses the requirement that consent be as easy to withdraw as it was to give.
Managing & Deleting Cookies
Practical instructions for visitors who want to manage or delete cookies — including step-by-step browser settings instructions for Chrome, Firefox, Safari, Edge, and mobile browsers; links to browser-specific help pages; how to access the website's cookie preference centre to change consent choices; and a clear warning about the functional impact of disabling certain cookies (for example, disabling authentication cookies will prevent login). The section also addresses the Global Privacy Control (GPC) signal and Do Not Track (DNT) browser settings, and whether the website honours these signals.
Third-Party Cookies & External Services
Identifies every third-party service that sets cookies on the website — including Google Analytics, Google Ads, Facebook/Meta Pixel, LinkedIn Insight Tag, Hotjar, YouTube, Vimeo, social media widgets, and any other embedded content or advertising networks. For each service, the section provides the provider's name, the purpose of their cookies, a link to their privacy and cookie policies, and instructions for opting out of their tracking directly. This transparency is essential because the website operator does not control third-party cookies — the third party's own policies govern their data collection practices.
Data Transfers & International Processing
Discloses whether cookie data is transferred outside South Africa — which it almost certainly is if the website uses Google Analytics (data processed in the US and other countries), Facebook Pixel (data processed by Meta in the US and EU), or other international services. Under POPIA Section 72, cross-border transfers of personal information are permitted only if the recipient country provides adequate protection, or if the data subject consents, or if the transfer is necessary for the performance of a contract. For EU visitors, GDPR Article 44 requires appropriate safeguards for transfers outside the EEA. The section identifies the countries and safeguards involved.
Children's Privacy & Cookie Consent
Addresses the processing of personal information of children through cookies. Under POPIA Section 35, processing of children's personal information is prohibited unless specific grounds are met — including the consent of a competent person (parent or guardian). The GDPR requires parental consent for children under 16 (or under 13, depending on the member state). If the website does not target or knowingly collect data from children, this section states so explicitly. If the website does have child users, it addresses the additional consent requirements for cookie-based tracking.
Data Subject Rights & Contact Information
Explains visitors' rights regarding their personal information collected through cookies — including the right to access (POPIA Section 23), the right to correction (Section 24), the right to deletion (Section 24), the right to object to processing (Section 11(3)), and the right to lodge a complaint with the Information Regulator. Provides the contact details of the website's Information Officer or Data Protection Officer, the process for submitting data subject requests, and the expected response timeline (POPIA allows a reasonable period, typically 30 days).
Policy Updates & Version Control
Explains how visitors will be notified of material changes to the Cookie Policy — whether through an updated notice on the website, a notification banner, or email communication for registered users. Includes the effective date of the current version and a version history or changelog for transparency. Addresses whether material changes require renewed consent for previously accepted cookies (best practice under GDPR, recommended under POPIA) and the process for obtaining fresh consent when the cookie inventory changes significantly.
South African Law Compliance
Protection of Personal Information Act 4 of 2013
POPIA is the primary South African legislation governing the processing of personal information collected through cookies and tracking technologies. Section 1 defines personal information broadly to include unique identifiers — meaning cookies that collect IP addresses, device IDs, browsing behaviour, or location data are processing personal information. Section 11 requires a lawful basis for processing — for non-essential cookies, consent is the most appropriate basis. Section 13 requires processing for a specific, explicitly defined, and lawful purpose. Section 18 requires the responsible party to notify data subjects of the processing — which the Cookie Policy fulfils. Section 19 requires appropriate security measures. Section 22 requires notification of data breaches. Section 72 restricts cross-border transfers of personal information. Non-compliance can result in fines of up to R10 million, imprisonment for up to 10 years under Section 107, and civil damages claims from affected data subjects.
Electronic Communications and Transactions Act 25 of 2002
ECTA establishes transparency and consent requirements for electronic transactions that are directly relevant to cookie practices. Section 11 provides that electronic communications must be accessible and usable by recipients. Section 43 requires e-commerce websites to make available specified information — including the website owner's full name, legal status, contact details, and privacy practices — providing the legal basis for requiring a Cookie Policy as part of the website's overall transparency obligations. Section 45 restricts unsolicited electronic communications and requires opt-out mechanisms, which is relevant to marketing cookies and email remarketing triggered by cookie data. Section 51 addresses the protection of personal information collected through electronic transactions.
General Data Protection Regulation (EU) 2016/679
The GDPR applies to South African websites that offer goods or services to EU residents (Article 3(2)(a)) or that monitor the behaviour of EU residents (Article 3(2)(b)) — which analytics and marketing cookies explicitly do. Under the GDPR and the ePrivacy Directive (2002/58/EC), non-essential cookies may not be set until the user has given explicit, informed, opt-in consent. Pre-ticked boxes and implied consent are invalid. Cookie consent must be granular (per category), freely given (not bundled with terms acceptance), and as easy to withdraw as to give. Non-compliance can result in fines of up to EUR 20 million or 4% of global annual turnover, whichever is higher. South African businesses with any EU traffic should implement GDPR-compliant cookie consent to avoid this extraterritorial exposure.
Consumer Protection Act 68 of 2008
The CPA requires that terms and policies presented to consumers be in plain and understandable language (Section 22). This applies to the Cookie Policy, which must be written in language that non-technical users can understand — avoiding legal jargon and technical terminology without explanation. Section 49 requires attention to be drawn to provisions that limit the supplier's risk or constitute an assumption of risk by the consumer. The CPA's emphasis on transparency and plain language shapes how the Cookie Policy must be presented to South African consumers.
Cybercrimes Act 19 of 2020
The Cybercrimes Act is relevant to the security obligations surrounding cookie data. Section 14 criminalises the unlawful acquisition of data, and Section 16 criminalises the unlawful interference with data. These provisions reinforce the obligation to secure cookie data — including consent records, cookie identifiers, and any personal information collected through tracking technologies — against unauthorised access and manipulation. The Act also imposes obligations on electronic communications service providers to report certain offences, which is relevant if cookie data is compromised in a security breach.
South African businesses are lining up for My-Contracts — be first in when we launch
Create Your Cookie Policy in Minutes
Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.
Audit your website's current cookie usage
Before completing the template, conduct a comprehensive audit of every cookie and tracking technology used on your website. Use a cookie scanning tool (such as Cookiebot, OneTrust, or a browser extension like EditThisCookie) to identify all cookies set on page load and during user interaction. Document each cookie's name, provider, purpose, data collected, type (session/persistent), and expiry period. Check embedded content (YouTube, Google Maps), social media widgets, advertising networks, and analytics tools — each of these typically sets multiple cookies.
Categorise cookies and determine consent requirements
Categorise every cookie into one of the four standard categories: strictly necessary (no consent required), functional (consent recommended), analytics (consent required), and marketing/advertising (consent required). Be honest in categorisation — analytics and marketing cookies are not "essential" regardless of how important they are to your business. For each category, determine the lawful basis under POPIA (consent for non-essential cookies, legitimate interest or contractual necessity for essential cookies).
Complete the Cookie Policy template with your audit results
Work through the template, inserting your specific cookie inventory, third-party service details, consent mechanism description, data transfer disclosures, and Information Officer contact details. Ensure the cookie inventory table is complete and accurate — listing every cookie identified in the audit. Complete the third-party services section with links to each provider's privacy and cookie policies. If your website serves EU visitors, ensure the GDPR compliance sections are completed.
Implement a cookie consent management platform
The Cookie Policy is a disclosure document — it requires a technical implementation to enforce consent. Implement a cookie consent management platform (CMP) that: displays a consent banner on first visit, allows granular category-level consent, blocks non-essential cookies until consent is given, records consent with a timestamped audit trail, provides a persistent preference centre for changing consent, and respects GPC/DNT signals if you choose to honour them. Popular options include Cookiebot, OneTrust, and CookieYes.
Publish, link, and establish ongoing maintenance
Publish the Cookie Policy on a dedicated page accessible from the website footer and from the cookie consent banner. Link it from your Privacy Policy. Establish a maintenance process: conduct quarterly cookie audits to detect new or changed cookies, update the policy whenever new tracking tools are added, review third-party services annually to ensure their policies have not materially changed, and re-prompt consent when the cookie inventory changes significantly.
Frequently Asked Questions
A Cookie Policy is a transparency document that explains how your website uses cookies and similar tracking technologies to collect visitor information. It discloses what cookies are placed on visitors' devices, what data they collect, why they are used, who has access to the data, how long the data is retained, and how visitors can manage their cookie preferences. Under POPIA, any South African website that collects personal information through cookies — which includes IP addresses, device identifiers, browsing behaviour, and location data — must be transparent about its data practices. POPIA Section 18 requires you to notify data subjects of the processing of their personal information, and a Cookie Policy is the standard mechanism for fulfilling this obligation. Additionally, ECTA Section 43 requires e-commerce websites to have accessible privacy and data practices policies. Without a Cookie Policy, your website is non-compliant with South African data protection law, exposing your business to Information Regulator enforcement action, fines of up to R10 million, and reputational damage.
What You Get With This Template
Drafted specifically for South African law — compliant with POPIA, ECTA, CPA plain language requirements, and the Cybercrimes Act data security obligations
GDPR-ready for South African businesses with EU visitors — covers explicit opt-in consent, granular category controls, and cross-border transfer disclosures
Comprehensive cookie inventory template that lists every cookie by name, provider, purpose, data collected, and expiry — meeting regulator expectations for transparency
Consent framework designed to work with major consent management platforms (Cookiebot, OneTrust, CookieYes) — the policy describes what the CMP implements
Plain-language explanations of tracking technologies accessible to non-technical users — meeting CPA Section 22 plain language requirements
Cross-border data transfer disclosures for common third-party services (Google, Facebook, LinkedIn) with applicable safeguards under POPIA Section 72
Data subject rights section covering POPIA access, correction, deletion, and objection rights with clear exercise procedures
Customisable template with clearly marked fields for your specific cookies, third-party services, Information Officer details, and consent mechanism description