How to Write a Cookie Policy and Privacy Notice: Templates and Examples

A cookie policy explains which cookies your site uses, why and for how long. A privacy notice tells visitors what personal data you collect, for what purpose, on what legal basis and who you share it with; in Turkey it is required under Article 10 of the data protection law (KVKK). This guide lists the sections both documents need, shows how to fill in a cookie table and explains how to set up a consent banner. For the broader picture see our data protection compliance guide.

This is not legal advice. Have a lawyer or data protection consultant finalise the texts. What follows is how a web team prepares for that process and builds the technical side.

The rules behind it

• Law No. 6698 (KVKK): Article 10 covers the duty to inform; Article 11 lists data subject rights.
• The 2018 Communiqué on the duty to inform: sets out how notices are written and says they must be kept separate from consent.
• The authority's 2022 Cookie Guidelines: explain which cookies need consent and what a banner should look like.
• 2024 amendments: Law No. 7499 updated the rules on sensitive data and cross-border transfers. Tools that send data to servers abroad, such as Google Analytics, fall under these rules.

Privacy notice template: required sections

Fill in this skeleton with what actually happens on your site, not generic wording.

1. Data controller: company name, address, contact email, trade registry number.
2. Data categories: identity, contact details, security data such as IP address, marketing data from cookies.
3. Purposes: replying to enquiries, managing bookings, meeting legal obligations.
4. Legal bases: for each purpose, the condition you rely on: contract, legal obligation, legitimate interest or explicit consent.
5. Recipients: hosting provider, email service, accountant, payment provider.
6. Transfers abroad: which tools store data outside Turkey and on what basis.
7. How data is collected: forms, cookies, email, phone.
8. Data subject rights and how to submit a request.
9. Last updated date.

Cookie policy template and sample table

A cookie policy has a short introduction, an explanation of cookie types, a cookie table and instructions for withdrawing consent. The table is the core. Example for a typical business site:

To build your own, open your browser's developer tools, go to the Application tab, browse every page of your site and record each cookie. Embedded booking engines, live chat and maps add their own cookies, so check those too.

What a good consent banner looks like

• [ ] Non-essential cookies do not run until consent is given.
• [ ] "Accept" and "Reject" are equally visible.
• [ ] No pre-ticked boxes.
• [ ] Visitors can choose by category.
• [ ] Using the site does not depend on consent (no cookie wall).
• [ ] Choices can be changed later from any page.
• [ ] The banner links to the cookie policy.

Step by step

1. List every form, cookie and third-party tool on the site.
2. Define the purpose and legal basis for each, together with your legal adviser.
3. Publish the privacy notice and cookie policy on separate pages.
4. Use a separate checkbox and text wherever explicit consent is needed.
5. Install the banner and tie analytics and ad tags to consent.
6. Link the privacy notice under every form.
7. Update the table and texts whenever you add a tool.

Common mistakes

• A text copied from another site, sometimes with the other company's name still in it.
• Making visitors tick "I have read and accept" the privacy notice. A notice informs; it does not need approval.
• Asking for consent where the legal basis is contract or legitimate interest.
• Loading analytics before the banner.
• A banner with only an "OK" button.
• Never updating the cookie table after adding plugins.

Situations we see in Antalya

Hotels and tour operators with European guests may need to consider the EU's GDPR alongside Turkish law, and Google Consent Mode v2 if they run Google Ads. Health tourism clinics face stricter rules: if a contact form asks about medical conditions, that is sensitive data. Removing unnecessary fields comes before writing any text.

On our business website projects we build the consent banner, cookie categories and form links, and place the texts your legal adviser prepares on the right pages. To map your current cookies with us, get in touch.