What is the difference between a privacy notice and a cookie consent setup?

A privacy notice is the public statement of how an organisation handles personal data. Under the GDPR, Article 13 sets out what a controller gives the person at the time the data is obtained from them. That includes the purposes and legal basis of the processing, the recipients, the retention period and, where the processing relies on consent, the right to withdraw it. Article 14 covers data obtained from someone else. Article 12(1) asks for the information in a concise, transparent, intelligible and easily accessible form [1].

In California, section 1798.100(a) of the Civil Code requires a business that controls the collection of personal information to tell consumers certain things at or before the point of collection. These are the categories collected, the purposes, whether that information is sold or shared, and how long each category is kept [2]. The regulations turn that into a notice at collection with a fixed list of contents in section 7012(e). The list includes a link to the notice of right to opt out where the business sells or shares, and a link to the privacy policy [3].

In Nigeria, section 27(1) of the Nigeria Data Protection Act 2023 lists what a controller tells the data subject before collecting personal data. Section 27(3) requires that information to be contained in a privacy policy [4]. Our guide to what each regime requires in a notice takes the three lists line by line.

None of those provisions asks the visitor to agree to anything. A privacy notice informs; reading it is not consent to the cookies a site sets.

In the EU the cookie rule comes from a different instrument: Article 5(3) of the ePrivacy Directive 2002/58/EC, as replaced by Directive 2009/136/EC. It requires Member States to ensure that storing information, or gaining access to information already stored, in a user's terminal equipment is only allowed once the user has given consent. Consent must be given after the user has been given clear and comprehensive information about the purposes [5].

The same paragraph exempts two cases: technical storage or access for the sole purpose of carrying out the transmission of a communication, and storage or access strictly necessary for a service the user has explicitly requested [5]. Because it is a directive, it reaches a business through the law each Member State passes to implement it.

The rule is not limited to cookies. The European Data Protection Board's guidelines on the technical scope of Article 5(3), adopted on 7 October 2024, conclude that tracking pixels and tracking links fall within it, because distributing them to the user's device is storage and collecting the identifier they carry is gaining access [6].

The consent Article 5(3) asks for is GDPR consent. The directive refers to Directive 95/46/EC, and Article 94(2) of the GDPR reads references to that repealed directive as references to the GDPR. Article 4(11) defines consent as freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action. Article 7 adds that the controller must be able to demonstrate it, that a consent request is clearly distinguishable from other matters, and that withdrawing consent is as easy as giving it [1].

Recital 32 says silence, pre-ticked boxes or inactivity do not constitute consent. The Board's consent guidelines draw two practical conclusions:

• Scrolling or swiping through a page does not satisfy the requirement of a clear affirmative action [7].
• Access to a service may not be made conditional on accepting cookies, the practice known as a cookie wall [7].

That is the gap. A privacy notice meets an information duty. The cookie rule adds a permission duty: before a non-essential cookie or tracker runs, the visitor has said yes, on terms that meet the consent standard, and can later say no as easily.

A consent tool, whether a commercial platform or code your developer writes, presents the banner, offers the categories, and holds back every script in a non-essential category until the visitor accepts it. It stores the choice, offers a way back in so consent can be withdrawn, and keeps a record of what was agreed.

The law sets the outcome rather than the method. Article 7(1) of the GDPR requires the controller to be able to demonstrate consent, and Article 5(3) of the ePrivacy Directive requires that nothing non-essential is stored or read before it is given [1] [5]. How the record is kept, with a timestamp, the version of the notice shown and the categories accepted, is good practice that makes the demonstration possible. A customer's privacy reviewer may ask to see that record, and evidence that tags do not fire before consent.

The tool also has to keep step with the site: a new pixel or a chat widget that sets its own cookies reaches neither the banner nor the cookie notice unless someone updates them.

The privacy policy pack delivers the external privacy notice, the cookie notice, the internal data protection policy, the data subject request procedure and the records of processing template, quoted at $1,200 to $2,500. The cookie notice is the text and the cookie categories, written to sit inside a consent banner that you or your developer configure. PolicyDrafters does not supply or configure the banner software. The intake asks which cookies and trackers your site sets, so the notice describes the inventory you bring, and our legal team reviews the draft before it reaches you.

A SaaS or technology company with visitors in Europe and California is the usual buyer, and the pack is drafted against each regime that applies to it. A healthcare organisation buys the same pack for the administrative side of its privacy notices, for patients and the regulator; clinical procedures and clinical SOPs are out of scope.

Under the maintenance plan the pack is reissued with the changes marked when a regime it was drafted against changes. A new tag changes your facts rather than the rule, so keeping the inventory current, and the banner matched to it, stays with you and your developer.