Guide for drafting cookie policies compliant with GDPR and the ePrivacy Directive. Includes CNIL 2020 recommendations, a reference template, and best practices. Use when drafting or revising a cookie policy for a website or application.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
A cookie policy informs users about cookies and trackers placed on their device. It is distinct from the privacy policy but can be integrated into it. It must comply with CNIL 2020 guidelines.
| Objective | Requirement |
|---|---|
| Transparency | Inform about cookies used and their purposes |
| Consent | Obtain free, informed, and prior consent |
| Control | Allow users to manage their preferences |
| Compliance | Comply with GDPR + ePrivacy + CNIL recommendations |
| Template | Description |
|---|---|
assets/sample_template_politique_cookies.docx | Default template to use if no private template is provided |
| Internal template provided by lawyer | Use if the lawyer has a more suitable private template |
| PDF File to READ (Read tool) | URL to CONSULT (WebFetch tool) | Topic |
|---|---|---|
assets/CNIL_lignes_directrices_cookies_et_traceurs.pdf | - | Cookie guidelines |
assets/CNIL_recommandation_cookies_et_traceurs.pdf | https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies | Cookie recommendations |
assets/CNIL_faq_cookies_et_traceurs.pdf | https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ | Cookie FAQ |
assets/CNIL_evolution_regles_utilisation_cookies.pdf | https://www.cnil.fr/fr/evolution-des-regles-dutilisation-des-cookies-quels-changements-pour-les-internautes | Rules evolution |
assets/CNIL_transparence.pdf | - | Guide on information and transparency |
assets/CNIL_principes_rgpd.pdf | - | Fundamental GDPR principles |
assets/RGPD_texte_officiel.pdf | - | Full text of EU Regulation 2016/679 |
REQUIREMENT: For ANY information regarding cookies, consent, retention periods, exemptions, or best practices:
- READ the PDF files with the Read tool BEFORE responding on a regulatory point
- CONSULT the online URLs with WebFetch to verify the most current information
- CITE the CNIL URL in your response when mentioning a rule or duration
- NEVER invent a duration or rule without verifying it in the sources
| Document | Content |
|---|---|
| COOKIES.md | Cookie categories, banners, CNIL sanctions, retention periods |
| BASES_LEGALES_COOKIES.md | Cookie-specific legal bases (consent, exemptions) |
| DROITS_PERSONNES.md | Data subject rights |
| DUREES_CONSERVATION.md | Retention periods (6 months recommended by CNIL for consent, 13 months max) |
IMPORTANT: Before drafting the policy, collect the information below.
STRICTLY NECESSARY COOKIES (exempt from consent)
ANALYTICS COOKIES
ADVERTISING / MARKETING COOKIES
SOCIAL MEDIA COOKIES
FUNCTIONALITY COOKIES
READ CNIL SOURCE:
assets/CNIL_recommandation_cookies_et_traceurs.pdf+ https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies IMPORTANT: CNIL recommends 6 months for the consent cookie. Use 6 months as default.
| Cookie | CNIL Recommended Duration | Maximum Duration |
|---|---|---|
| Consent cookie | 6 months | 13 months |
| Analytics cookies | Depending on purpose | 13 months |
| Advertising cookies | Depending on purpose | 13 months |
NEVER DRAFT A POLICY FROM SCRATCH. Always start from a given template for drafting, either:
- the default template in
assets/sample_template_politique_cookies.docx;- another internal template provided by the user.
This template is your base reference. You must:
- Faithfully reproduce the template's structure and wording
- Keep the exact template phrasing (they are validated)
- Only replace placeholders with client information
- Do NOT rewrite sentences even if you think you can phrase them better
- Do NOT add sections that are not in the template
The collected information (cookies used, CMP, etc.) is used to fill in the template, not to rewrite it.
1. FIRST ACTION: Confirm the template to use BEFORE any drafting. Ask the user:
"I will draft the cookie policy starting from the provided default template. Do you have an internal template that would be more suitable as a starting point?"
| Option | Action |
|---|---|
| Default template | Use assets/sample_template_politique_cookies.docx |
| Internal template | Use the document provided by the lawyer |
2. Consider the user's choice and select the starting template.
MAIN OBJECTIVE: Precisely identify all cookies placed by the site.
1. Ask the lawyer for available information:
"To draft a perfectly tailored cookie policy, please provide:
- The website URL
- The list of cookies used (if known)
- The consent management platform (CMP) used
- Third-party tools integrated (analytics, advertising, social media...)
- Any existing documentation about the site's cookies
You may anonymize this information if necessary for confidentiality reasons.
The more information you provide, the better adapted the policy will be. Otherwise, we will conduct our own research but it will be limited to publicly accessible information."
2. Research on the site (if accessible):
3. Summary before drafting:
SITE: [URL]
CMP USED: [Solution name]
STRICTLY NECESSARY COOKIES: [List]
ANALYTICS COOKIES: [List + providers]
ADVERTISING COOKIES: [List + providers]
SOCIAL MEDIA COOKIES: [List + providers]
FUNCTIONALITY COOKIES: [List]
RETENTION PERIODS: [Compliant with 13 months max?]
KEY LAWYER POINTS: [What must absolutely be included]
Once the summary is ready → Proceed to Draft 1.
ABSOLUTE RULE: The reference template is your validated base.
- START from the template: structure, wording, tone → this is your reference
- ADAPT to the client case: integrate the specific cookies identified
- DO NOT rewrite everything: keep the template wording, only adapt what needs to be
In summary: Template + client cookies = Draft 1. Not a complete rewrite.
Complete the template section by section:
Immediate compliance check: Before presenting Draft 1, verify the cookie compliance checklist (CNIL 2020):
- Exhaustive list of cookies with name, provider, duration, purpose
- Distinction between necessary cookies vs cookies requiring consent
- Information that refusing is as easy as accepting
- Retention periods ≤ 13 months
- Clear explanation of how the banner works
- Instructions for managing cookies via browser
- Link to CMP to modify preferences
- Document update date
- Contact for questions
If Draft 1 is compliant → Proceed to Step 3.
1. Deliver Draft 1 with explanation:
"Here is Draft 1 of the cookie policy.
**What I took into account:**
- [List of identified cookies]
- [CMP used]
- [Retention periods]
**Compliance:** The document complies with CNIL 2020 guidelines."
2. Present the benchmark (systematic):
Research 3-5 cookie policies from companies in the same sector, then present:
"**Benchmark conducted:**
I analyzed the cookie policies of:
- [Company 1] - [what we noted]
- [Company 2] - [what we noted]
- [Company 3] - [what we noted]
**Identified possible improvements:**
- [Improvement 1]: [explanation]
- [Improvement 2]: [explanation]
Would you like to incorporate these elements into the provided Draft?"
3. If the lawyer approves improvements → Produce Draft 2
Final review before definitive delivery:
| Company | Amount | Reason |
|---|---|---|
| €150M | Refusing cookies more difficult than accepting | |
| €60M | No visible "reject all" button | |
| Amazon | €35M | Cookies placed without prior consent |
| Microsoft | €60M | Cookies placed without consent |
These sanctions illustrate the importance of a compliant cookie policy and a banner respecting the principle that refusing must be as easy as accepting.
| Mistake | Potential Sanction | Solution |
|---|---|---|
| Cookies placed before consent | Fine | Wait for "Accept" click |
| No visible "Reject" button | Fine | Button at same level as "Accept" |
| Strict cookie wall | Fine | Offer an alternative |
| Duration > 13 months | Formal notice | Respect maximum duration |
| No cookie list | Non-compliance | Detailed table required |
| Dark patterns | Fine | Neutral and clear design |
| Incomplete cookie list | Non-compliance | Complete site audit |
TEMPLATE REMINDER: Never draft from scratch. Always start from the reference template and adapt it. DURATION REMINDER: CNIL recommends 6 months for the consent cookie (13 months max). Always verify in CNIL sources before mentioning a duration.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted or prohibited, when human approval is required, what evidence must be preserved, and how the agent can be suspended, revoked, or escalated.
日本語の概要は準備中です。原文の説明を表示しています。
EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artificial intelligence regulation. Also triggers on German terms: "KI-Gesetz", "KI-Verordnung", "Hochrisiko-KI", "KI-Kompetenz", "Grundrechte-Folgenabschaetzung", "GPAI-Verhaltenskodex". For assessment workflows that produce a classification decision rather than a knowledge answer, offer to run a structured risk-tier classification in-session.
日本語の概要は準備中です。原文の説明を表示しています。
This skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output was verified, and what was ultimately relied upon. It documents the workflow for supervision and later review without ruling on privilege or disclosure, so the record stays accurate rather than self-serving.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with scorecards, findings, owners, remediation actions, and follow-up questions.
日本語の概要は準備中です。原文の説明を表示しています。
Turn an interpretive-ambiguity audit of a legal text — contract, statute, regulation, or judicial opinion — into a polished deliverable. Produces a multi-page website (default), a single-page interactive site, a Microsoft Word document, a PowerPoint deck, or a LaTeX/PDF. Use whenever a user has a stress-test result, ambiguity audit, or "where will this be litigated" scenarios and wants to publish, present, or share them. Triggers on "publish the audit," "make a report from this," "turn this into a website / deck / brief / Word doc," "make a Netlify site," "build slides of these ambiguities," "render the scenarios," "package this stress test," "produce a LaTeX version," and similar. Pairs with the ambiguity-stress-test skill (the underlying analysis) but works on any structured or semi-structured ambiguity analysis. Visual design is opinionated but the user can override colors, fonts, and brand label. Most formats need Python and a writable filesystem; single-file HTML works where the host has neither.
日本語の概要は準備中です。原文の説明を表示しています。
Adversarially stress-tests a legal text — a contract, statute, regulation, or judicial opinion — for interpretive ambiguity: it finds the seams where the people governed by it will later disagree about what it means and turns each into a concrete dispute scenario with both sides' arguments, the likely outcome, and a fix. Use it whenever someone wants to pressure-test, red-team, audit, or find weak spots, loopholes, gaps, ambiguities, or drafting problems in a legal document; whenever a drafter wants to tighten a contract, statute, regulation, or opinion before it issues; whenever a litigator wants to mine an opinion or contract for arguments; or whenever someone hands over a legal text and asks where it will be fought over or for issue-spotting. Trigger it for contract review, statutory-ambiguity analysis, judicial-opinion scope analysis, and drafting QA — even if the user never says "stress-test" or "ambiguity."
日本語の概要は準備中です。原文の説明を表示しています。