By business type

Cookie Policy Generator for crypto

Written for wallet addresses as personal data, on-chain permanence and the KYC that erasure cannot touch.

Generate your cookie policy Read the cookie policy guide

A Web3 front end has an unusual tracking surface: ordinary web analytics on one side, and a wallet connection on the other that exposes an address and its entire history. Treating the second as merely a technical event rather than a collection is the mistake worth avoiding.

The foundational problem in crypto privacy documentation is that a wallet address is usually personal data. Once an address is linked to an identity - through KYC, an exchange deposit, or on-chain analysis - every transaction that address ever made becomes attributable, permanently and publicly.

That collides directly with erasure. On-chain data cannot be deleted, and a privacy policy that promises deletion of everything on request is describing something the technology cannot do. The honest position explains what can be deleted off-chain and what cannot be touched on-chain, and why.

Regulated activity adds the opposite pressure. Where you perform KYC under anti-money-laundering rules, retention is mandatory, the Travel Rule requires transmitting originator and beneficiary information with transfers, and sanctions screening runs continuously against identity data you are obliged to keep.

What a cookie policy for a crypto or Web3 product has to cover

Wallet connection as a collection event, and what the interface learns from it
RPC endpoints that observe the address and the connecting IP on every call
Ordinary web analytics on the front end, and whether it can capture an address
Advertising and attribution tags, where the product runs acquisition campaigns
How refusing consent affects the interface and what remains functional

How a crypto or Web3 product actually moves personal data

Wallet connection

Connecting a wallet exposes the address and its full history to the application, which is a collection event most interfaces do not describe.

KYC and identity verification

Documents, selfies and liveness checks through a specialist vendor, retained under AML rules.

On-chain analytics

Chainalysis, TRM and similar services cluster addresses and attribute them, which is profiling of an identifiable person.

RPC providers and node infrastructure

Every read and write passes through an RPC endpoint that sees the address and the IP behind it.

Off-chain user accounts

Email, preferences and support history held conventionally alongside on-chain identity.

Airdrops and eligibility snapshots

Eligibility analysis links addresses to behaviour and often to identity, and the snapshot persists.

Third parties the draft will ask you about

Alchemy or Infura · Chainalysis or TRM Labs · Sumsub or Persona · Fireblocks · AWS · Intercom · Stripe for fiat on-ramps

The rules that apply

Wallet addresses as personal data

An address linked or linkable to an individual is personal data, which brings the whole transaction history it anchors into scope.

On-chain immutability versus erasure

Data written to a public chain cannot be deleted. The policy has to explain the boundary rather than promising deletion it cannot deliver.

AML and KYC retention

Where you are a regulated entity, identity and transaction records must be retained for statutory periods regardless of an erasure request.

Travel Rule obligations

Transfers above thresholds require originator and beneficiary information to travel with the transaction between providers.

Sanctions screening

Continuous screening against identity and address data, with restrictions on what may be disclosed to the customer.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Crypto compliance essentials

State plainly that wallet addresses are personal data
And explain what that means for the transaction history behind them.
Draw the on-chain and off-chain boundary
What you can delete, what you cannot, and why.
Disclose the infrastructure chain
RPC providers, analytics vendors, custody partners and KYC processors.
Document AML retention as a legal obligation
With the period, so erasure refusals can be explained.
Explain on-chain analytics and any Article 22 position
Where screening outcomes restrict or freeze accounts automatically.
Identify who the controller actually is
Even where the protocol is decentralised, the front end and the accounts are not.

Where this usually goes wrong

Claiming wallet addresses are anonymous

Pseudonymous is not anonymous, and once linked the whole history is attributable. Regulators have said so directly.

Promising erasure of on-chain data

It is technically impossible, and promising it is a misrepresentation as well as a compliance failure.

Not disclosing RPC providers

They see the address and the connecting IP on every interaction.

Silence on on-chain analytics

Clustering and attribution services are profiling, and users are entitled to know they are used.

KYC deletion promises that AML law forbids

Retention is mandatory for regulated entities, and the policy should explain why rather than promise otherwise.

Treating a DAO or protocol as having no controller

Someone determines the purposes of the front end, the analytics and the user accounts, and that party is the controller.

Frequently asked questions

Is a wallet address personal data?

Usually yes. It is pseudonymous rather than anonymous, and once linked to an identity - through KYC, an exchange, or chain analysis - it and the transaction history behind it are personal data.

How does the right to erasure work with a blockchain?

It does not reach the chain. You can delete off-chain records, close accounts and stop processing, but on-chain data is immutable. The policy should explain that boundary honestly rather than promise deletion it cannot deliver.

Can I delete KYC records on request?

Where you are a regulated entity, no - anti-money-laundering law requires retention for a statutory period. That is a legal obligation basis that overrides erasure, and the refusal needs explaining.

Does a decentralised protocol need a privacy policy?

The protocol may not, but the front end, the analytics, the RPC relationship and the user accounts have a controller - and that party does.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.