A cookies privacy policy is an inventory rather than a statement of principle. It lists what your site stores on a visitor's device, who put it there, what it does and how long it lasts. That makes it the fastest of your published documents to go out of date, because a single tag added for a campaign changes it and nobody thinks of the page.
What a row has to carry
Four fields per entry: the name of the cookie or storage item, who sets it, what it is for in words a visitor can use, and how long it lasts. Group the rows by purpose rather than by vendor, because a reader is deciding whether to allow a category. Strictly necessary, preferences, analytics and advertising is the usual grouping and it maps onto the choices a consent interface offers.
Count them from the browser, not from memory
Open the site in a clean browser profile, load a few pages, and read the storage panel. Nearly every site finds more than expected, because embedded video, chat widgets, maps, social buttons and tag managers all set their own, and some of them load before any interaction. Counting from the tag manager alone misses whatever a plugin or a theme installs directly.
Why it lives on its own page
Because it is the only one of your documents that changes when marketing changes something. Keeping it separate lets you update the list without reissuing the privacy notice, keeps the notice readable, and gives the consent banner a stable link to point at. It also makes the review cheap enough to actually do: recounting a table is a twenty minute job, rereading a long policy is not.
The policy is not the consent mechanism
Listing a cookie is a disclosure, not a permission. Where consent is required before non-essential storage, a banner or preference interface does that work, and the policy describes it and links to it. A site with a detailed cookie list and tags that fire on page load has documented precisely what it does without asking, which is a clearer record against itself than saying nothing would have been.
Questions people ask about cookies privacy policy
Can the cookie list go inside the privacy policy?
It can, and the two then change on the same cycle, which is the wrong cycle for an inventory. A separate page is easier to keep true and easier for a reader to check.
Do US sites need a cookie banner?
There is no general federal consent requirement. What California does require is an opt-out of sale or sharing and honouring the browser opt-out preference signal, which reaches advertising cookies by a different route.
How often should the list be recounted?
Whenever a tag, plugin or embed is added, and on a fixed quarterly review to catch the ones nobody mentioned.