Cookie policy lists each cookie with name, purpose, duration, provider
Why it matters
GDPR Art. 13(1)(c) requires disclosure of 'the purposes of the processing for which the personal data are intended as well as the legal basis for the processing.' For cookie-based tracking, this means naming the specific cookies, their retention periods, and who processes the data — not just stating 'we use analytics cookies.' CNIL enforcement guidelines specifically require per-cookie documentation by name. When a cookie policy lists only category descriptions, users cannot identify individual trackers, compare them against browser developer tools, or make meaningful decisions about specific processing activities.
Severity rationale
Info because the failure is a documentation gap that reduces consent quality and regulatory defensibility rather than causing active unlawful processing — the consent mechanism and enforcement can still function without it.
Remediation
Generate the per-cookie table directly from COOKIE_REGISTRY so the policy stays current automatically without manual maintenance.
// app/cookies/page.tsx
import { COOKIE_REGISTRY } from '@/lib/cookies/registry'
export default function CookiePolicyPage() {
const categories = ['essential', 'analytics', 'marketing', 'preferences'] as const
return (
<main className="max-w-3xl mx-auto px-4 py-12">
<h1 className="text-2xl font-bold mb-2">Cookie Policy</h1>
{categories.map(cat => {
const cookies = COOKIE_REGISTRY.filter(c => c.category === cat)
if (!cookies.length) return null
return (
<section key={cat} className="mt-8">
<h2 className="text-lg font-semibold capitalize mb-3">{cat} Cookies</h2>
<table className="w-full text-sm border-collapse">
<thead>
<tr className="border-b">
<th className="text-left py-2">Name</th>
<th className="text-left py-2">Purpose</th>
<th className="text-left py-2">Duration</th>
<th className="text-left py-2">Provider</th>
</tr>
</thead>
<tbody>
{cookies.map(c => (
<tr key={c.name} className="border-b">
<td className="py-2"><code>{c.name}</code></td>
<td className="py-2">{c.purpose}</td>
<td className="py-2">{c.expiry}</td>
<td className="py-2">{c.provider}</td>
</tr>
))}
</tbody>
</table>
</section>
)
})}
</main>
)
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13(1)(c) — GDPR — purposes and legal basis for each processing activity must be specified
- eprivacy · Art. 5(3) — ePrivacy Directive — granular information about each cookie required
- ccpa · §1798.135 — CCPA — categories of personal information collected must be individually disclosed
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated