Cookie Policy Generator for freelancers
Written for sole traders: client data, a portfolio site, and the processor role you did not know you had.
A freelancer’s site usually runs three or four trackers, which makes an accurate cookie policy genuinely achievable - and makes an inaccurate one hard to excuse. The usual culprits are analytics, a scheduling embed and a font or map loaded from a third party.
Freelancers are subject to the same data protection law as companies. There is no sole-trader exemption in UK GDPR, EU GDPR or most other regimes - the obligations scale with the processing, not with the headcount.
The two things freelancers most often miss are the processor relationship and the portfolio. If you handle a client’s customer data, you are a processor and need a written agreement. And if your portfolio shows client work containing personal data - screenshots with real names, testimonials, case studies - that is publication of personal data needing a basis and usually permission.
For UK freelancers there is also the ICO data protection fee, which applies to most sole traders processing personal data by automated means. It is enforced separately from any other obligation and is checked against a public register.
What a cookie policy for a freelancer or consultant has to cover
Analytics on your portfolio site, named with its provider
Scheduling and enquiry embeds that collect directly into a third-party tool
Remote fonts, maps and video embeds that transmit an IP address on load
Whether anything is gated behind consent today, stated honestly
How a visitor changes their choice after making it
How a freelancer or consultant actually moves personal data
Client contact and project data
Names, emails, briefs and correspondence held in your inbox, project tool and invoicing system.
Client customer data accessed during work
Database exports, CRM access, mailing lists and analytics logins - the processor relationship most freelancers never document.
Portfolio and case study material
Screenshots, testimonials and results data, published on your own site.
Enquiry forms and lead magnets
A contact form or downloadable resource collects personal data with its own purpose and retention.
Invoicing and accounting tools
Client details in Xero, FreeAgent or QuickBooks, retained for statutory periods.
Subcontractors
Passing work to another freelancer makes them a sub-processor, needing a contract and usually the client’s authorisation.
Third parties the draft will ask you about
Google Workspace or Microsoft 365 · Xero, FreeAgent or QuickBooks · Stripe or PayPal · Notion or Trello · Calendly · Mailchimp · Dropbox
The rules that apply
No small-business exemption
UK and EU data protection law applies to sole traders. The Article 30 record-keeping exemption for under-250 staff is narrow and rarely applies in practice.
Processor agreements with clients
Required in writing wherever you handle client personal data on their instructions.
ICO data protection fee
Most UK sole traders processing personal data by automated means must register and pay the annual fee.
Portfolio and case study publication
Publishing client work containing personal data requires a basis and, in most cases, the client’s permission and the individuals’ awareness.
Invoicing and tax retention
Financial records must be kept for a statutory period, which is a lawful reason to retain some client data after a project ends.
What the generated cookie policy contains
What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.
The freelance compliance minimum
Publish a privacy policy on your own site
Covering enquiries, clients, and any newsletter or lead magnet.
Add a processor clause to your standard contract
One reusable schedule, used with every client whose customer data you touch.
Register with the ICO if you are UK-based
Check the fee tier and set an annual reminder.
Get written permission for portfolio use
And redact personal data from screenshots.
Set a client data deletion routine
At project end, keeping only what tax law requires.
Separate business and personal accounts
It makes deletion possible and security statements true.
Where this usually goes wrong
Assuming sole traders are exempt
They are not. The obligations follow the processing.
No processor agreement with clients
Common, and it becomes visible the first time a client runs a compliance review.
Publishing client work without permission
Screenshots containing real customer names and testimonials attributed to identifiable people both need a basis.
Not paying the ICO fee
A separate legal duty in the UK, enforced independently, and checkable on a public register.
Keeping client data indefinitely after a project
Article 28 requires deletion or return at the end, with a carve-out only for what tax law requires.
Using a personal email account for client data
It undermines any security statement and complicates deletion.
Frequently asked questions
Do freelancers need a privacy policy?
Yes, if you collect personal data - and an enquiry form, a newsletter or a client list all count. There is no sole-trader exemption.
Do I need to register with the ICO?
Most UK sole traders processing personal data by automated means do, and must pay the annual data protection fee. The exemptions are narrow.
Can I show client work in my portfolio?
With the client’s permission, and with personal data removed or anonymised. Testimonials naming identifiable people need their awareness and a basis.
Am I a processor for my clients?
Whenever you handle their customer data on their instructions, yes - which means a written agreement is required.
Do I need a cookie policy as well as a privacy policy?
In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.
Do analytics cookies need consent?
In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.
Does a cookie policy need updating when I add a tool?
Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.
What about cookies set by embedded video and maps?
They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.
Cookie Policy Generator for freelancers
Answer a short questionnaire and get a draft written for a freelancer or consultant. Free to start, no card required.
Generate your cookie policyOther documents a freelancer or consultant needs
Each one is written for the same context, not a generic template.
The same document, by business type
Go deeper
PolicifyAI is a technology provider, not a law firm, and this page is not legal advice. Generated documents are a structured starting point that a qualified adviser should review before you publish or rely on them.