Set up cookies and consent
Configure your site's cookie policy, purposes, and applications, and keep the cookie list accurate.
Your site's cookie banner is not a loose piece of text. It reads a configuration: a pointer to your cookie policy, a list of purposes, a list of applications, and an inventory of the cookies themselves. You find it under Cookies & GDPR in the Settings menu.
What each field means is covered in Cookies and consent. This page is about the order you fill them in and what breaks when you skip a step.
The labels below are the Dutch ones you see on screen, with the English meaning in brackets.
Work top to bottom
The four parts build on each other. An application points to a purpose, and a cookie points to an application. Start at the bottom and you have nothing to point at.
- Fix the cookie policy first.
- Then create the purposes.
- Then create the applications and link each to a purpose.
- Finally, walk through the cookie list.
The cookie policy
Link naar… (link to) sets the kind of destination. The demo site points at a page on the site itself, and then you also pick which page. You can point at an address outside the site instead.
That page has to exist and be published before you select it here. Point at a draft page and a visitor who clicks the link hits nothing.
Purposes
A purpose is the reason the site collects data. The demo site has three, and that is a sensible starting point for most sites:
functionalfor basic website operationanalyticsfor tracking statisticscontentfor content from external sources
The name uses lowercase letters, digits and _ only. Visitors read the description in the banner, so write it for them, not for a colleague.
Adding a purpose takes little effort, but every extra purpose is another choice your visitor has to make. Three or four works; ten does not.
Applications
An application is something concrete on your site that collects data. The demo site has four: functional (titled Necessary), nimbu_analytics, google_analytics, and external for third-party content such as YouTube videos.
For each one you fill in a name, a title for the visitor, one or more purposes, and a description.
Two buttons next to Toepassing toevoegen (add application) fill in a ready-made configuration: Matomo standaardinstellingen toevoegen and YouTube standaardinstellingen toevoegen. If you use either service, start there and adjust the texts afterwards.
Required means required
One application should be required: the one covering basic site operation. On the demo site that is functional. Mark other applications required too and you hand visitors a choice that is not a choice. That is exactly what a consent banner should avoid.
Applications that load outside content get two extra texts. For external, the demo site shows "Inhoud van derden wordt hier geblokkeerd. Om weer te geven," (third party content is blocked here, to display) followed by the clickable "klik hier om uw instellingen te wijzigen" (click here to change your settings). Together they form the message that sits where the video would have been.
The cookie list
The inventory sits at the bottom: which cookies the site sets, on which domain, and which application they belong to. The demo site has eleven, including _nimbu_session, _nimbu_consent, and the Google Analytics cookies __utma through __utmz.
Not every cookie belongs to an application. _nimbu_session and _nimbu_consent are listed without one: the first keeps the site working, the second remembers the choice the visitor just made.
A service's cookies usually sit on that service's domain. In the example, the Analytics cookies are on .demo.nimbu.io and the site's own on demo.nimbu.io.
Assume you keep this list up to date yourself. When your developer adds a script that sets a new cookie, add it here. A cookie the site sets but the list does not mention is also a cookie you cannot explain to a visitor who asks about it.
Fill in every language
Every title, description, and placeholder text exists per language. The demo site has Dutch, English, and French filled in. The language selector sits in the top right.
Skip a translation for an application and that text is empty for visitors in that language. So walk through all your site's languages afterwards, even though it feels like duplicate work.
Before you publish
Ask the site owner or whoever handles privacy to read your configuration before it goes live. What you set here is the promise you make visitors about their data. If it involves a connected service, involve the developer who built that connection too.
Then test it yourself in a fresh browser session: clear your cookies, reload the site, and check that the banner shows the purposes and texts you expect.