kostja94/cookie-policy-page-generator
skills/pages/legal/cookie-policy/SKILL.md
When the user wants to create or optimize a cookie policy page. Also use when the user mentions "cookie policy," "cookies," "cookie consent," "GDPR cookies," "cookie banner," "cookie notice," "tracking cookies," or "cookie settings." For legal overview, use legal-page-generator.
$ install --global
skillsauthnpx skillsauth add kostja94/marketing-skills cookie-policy-page-generatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 3, 2026, 4:12 AM74.0s1 file scanned
SKILL.md
- name:
- cookie-policy-page-generator
- description:
- When the user wants to create or optimize a cookie policy page. Also use when the user mentions "cookie policy," "cookies," "cookie consent," "GDPR cookies," "cookie banner," "cookie notice," "tracking cookies," or "cookie settings." For legal overview, use legal-page-generator.
- version:
- 1.1.0
Pages: Cookie Policy
Guides cookie policy page content for transparency and regulatory compliance. Often presented as a standalone page or as part of the Privacy Policy.
When invoking: On first use, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On subsequent use or when the user asks to skip, go directly to the main output.
Initial Assessment
Identify:
- Cookie inventory: List every cookie the site actually sets — check
_ga,_ga_*, session cookies, CSRF tokens, preference cookies, ad cookies - Consent requirement: Does the site need a notice or a consent banner? See §Notice vs Consent
- Jurisdiction: GDPR/ePrivacy (EU), CCPA (California), other regions
- Product category: Free anonymous, freemium, SaaS, e-commerce — affects which cookies exist
Cookie Inventory: Common Patterns
Google Analytics 4 (GA4)
| Cookie | Type | Purpose | Duration | How to Opt Out |
|--------|------|---------|----------|----------------|
| _ga | Analytics | Distinguishes users; used for aggregate usage measurement | 2 years | GA opt-out browser add-on, block third-party cookies, or enable Do Not Track |
| _ga_<container-id> | Analytics | Persists session state; used with _ga for session-level metrics | 2 years | Same as _ga |
Disclosure requirement: If the site uses Google Analytics, the cookie policy MUST list these cookies. GA ToS §7 requires posted privacy/cookie notice.
Functional / Session Cookies
| Cookie | Type | Purpose | Duration | How to Opt Out | |--------|------|---------|----------|----------------| | Session ID | Essential | Maintains user session across page loads | Session (deleted on browser close) | Required for service; cannot be disabled | | CSRF Token | Essential | Prevents cross-site request forgery attacks | Session | Required for security; cannot be disabled | | Fair-use quota | Functional | Counts daily usage for rate limiting | 24 hours | Clear browser data; resets on next visit | | Language preference | Functional | Remembers user's language choice | 30 days – 1 year | Clear browser data | | Dark mode / theme | Functional | Remembers display preference | 30 days – 1 year | Clear browser data |
Advertising / Tracking Cookies (If Applicable)
| Cookie | Type | Purpose | Duration | How to Opt Out |
|--------|------|---------|----------|----------------|
| _fbp | Marketing | Meta/Facebook pixel — tracks ad conversions | 90 days | Meta ad preferences or block third-party cookies |
| _gcl_au | Marketing | Google Ads conversion linker | 90 days | Block third-party cookies |
| _rdt_uuid | Marketing | Reddit Ads conversion tracking | 90 days | Block third-party cookies |
Notice vs Consent — Critical Distinction
This is the most common compliance confusion. Determining which mechanism is needed depends on cookie type:
Cookie Notice (Informational)
When to use: Site uses only strictly necessary and analytics cookies (no advertising, no tracking, no third-party marketing cookies).
What it is: A banner or page section stating "We use cookies for [analytics/functionality]. By continuing, you accept this." No accept/reject toggle needed.
Sufficient for: GA4 analytics only, session cookies, CSRF tokens, functional preference cookies.
Cookie Consent Banner (Interactive)
When to use: Site uses any of: advertising cookies, third-party tracking cookies, social media pixels, or cookies that share data with ad networks.
What it is: An interactive banner with accept/reject/customize options. Must allow granular consent by cookie category. Must be as easy to reject as to accept. Must not use dark patterns (pre-checked boxes, confusing language, "accept all" only).
Required for: Meta pixel, Google Ads conversion tracking, retargeting cookies, any cross-site tracking.
Do Not Track (DNT)
State whether the site responds to browser DNT signals. Most sites do not, which is acceptable as long as disclosed. Example: "[Product] does not currently respond to Do Not Track signals because no uniform standard exists."
Essential Elements
1. What Are Cookies
Brief, plain-language explanation: "Cookies are small text files stored on your device by websites you visit. They help sites remember your preferences and understand how you use them."
2. Cookie Types Used
Categorize by function:
- Essential / Strictly Necessary: Required for the site to work (session, CSRF)
- Functional: Remember preferences (language, theme, fair-use quota)
- Analytics / Performance: Measure usage in aggregate (GA4)
- Marketing / Advertising: Track ad effectiveness, retargeting (if applicable)
3. Full Cookie Table
Table format for every cookie:
| Cookie Name | Type | Purpose | Duration | How to Opt Out | |-------------|------|---------|----------|----------------| | [name] | [essential/functional/analytics/marketing] | [1-sentence purpose] | [duration] | [specific actionable instruction] |
The "How to Opt Out" column is critical — don't just list cookies, tell users how to control them. This builds trust and satisfies regulatory expectations.
4. Third-Party Cookies
- Which third parties set cookies through the site (GA4, Meta, Stripe, etc.)
- Link to each third party's own privacy/cookie policy
- Whether those third parties use cookies for their own purposes
5. How to Manage Cookies
- Browser settings: link to instructions for Chrome, Firefox, Safari, Edge
- GA4-specific: link to GA opt-out browser add-on
- Mobile: how to manage cookies in iOS/Android settings
- Effect of disabling: note that disabling essential cookies may break functionality
6. Updates
- When the cookie policy was last updated
- How users will be notified of changes
Content Principles
- Be exhaustive: List every cookie the site sets — missing one is worse than having no cookie policy
- Actionable opt-out: Every cookie should have a clear "how to opt out" instruction
- Categorize clearly: Essential / Functional / Analytics / Marketing — users understand these categories
- Notice-vs-consent clarity: Be explicit about which mechanism the site needs and why
- Plain language: "This cookie counts your daily usage" > "This cookie is used for rate-limiting enforcement"
- Placement: Footer; cookie banner links here; Privacy Policy links here
Output Format
- Cookie inventory: Complete table of all cookies the site sets
- Consent mechanism recommendation: Notice or consent banner, with rationale
- Opt-out instructions: Browser-level and cookie-specific
- Third-party cookie disclosure: If applicable, with links to third-party policies
- Do Not Track disclosure: Whether the site responds to DNT
- Disclaimer: Recommend legal review for jurisdiction-specific compliance
Related Skills
- privacy-page-generator: Cookie policy often embedded in or linked from Privacy Policy
- legal-page-generator: Cookie policy is a legal page type; platform readiness
- indexing: Often noindex for cookie policy
Related Skills
kostja94/xml-sitemap
testing
VerifiedTrustedCommunity
When the user wants to create, audit, or optimize sitemap.xml. Also use when the user mentions "sitemap," "sitemap.xml," "sitemap index," "lastmod," "changefreq," "priority," "URL discovery," "URL discovery for search engines," "single source of truth," "URL config," "unify sitemap IndexNow," or "reduce duplicate maintenance." For IndexNow, use indexnow.
588SKILL.mdUpdated Apr 24, 2026
kostja94/robots-txt
development
VerifiedTrustedCommunity
When the user wants to configure, audit, or optimize robots.txt. Also use when the user mentions "robots.txt," "crawler rules," "block crawlers," "AI crawlers," "GPTBot," "allow/disallow," "disallow path," "crawl directives," "user-agent," "block Googlebot," "fix robots.txt," "robots.txt blocking," or "search engine crawling." For indexing, use indexing.
588SKILL.mdUpdated Apr 24, 2026
kostja94/programmatic-seo
testing
VerifiedTrustedCommunity
When the user wants to create SEO pages at scale using templates and data—including AI-assisted, grounded copy for per-URL differentiation (vs rigid mail-merge templates). Also use when the user mentions "programmatic SEO," "programmatic SEO pages," "template pages," "scale content," "location pages," "city pages," "comparison pages at scale," "X vs Y pages," "integration pages," "pages from data," "automated landing pages," or "programmatic landing pages." Uses a playbook matrix aligned to skills under skills/pages. For user-facing template galleries or marketplaces (browse → use), use template-page-generator.
588SKILL.mdUpdated Apr 24, 2026
kostja94/twitter-cards
data-ai
VerifiedTrustedCommunity
When the user wants to add or optimize Twitter Card metadata for X (Twitter) link previews. Also use when the user mentions "Twitter Card," "twitter:card," "twitter:image," "twitter:title," "X preview," or "tweet preview." For Facebook/LinkedIn previews, use open-graph.
571SKILL.mdUpdated Apr 24, 2026