A cookie notice is the information you owe a visitor about what you are storing on their device and why. It is not the banner, which is the interface that collects a choice, and it is not the cookie policy, which is the standing document a visitor can return to. Most small sites have one artefact doing all three jobs badly, and separating them is usually the quickest way to make the whole thing defensible.
The three artefacts and what each is for
The notice is the disclosure: what is set, by whom, for what purpose and for how long. The banner is the mechanism that offers a choice and records it. The policy is the standing page a visitor can come back to and read. Putting the notice inside the banner is fine and normal, but the notice still has to carry enough for a real decision rather than a summary that defers to a page nobody opens.
What has to be in it
Name the categories rather than every cookie if you prefer, but name them honestly, and say who else receives what. A notice that says we use cookies to improve your experience has disclosed nothing, because every possible purpose fits inside it. The parts most often missing are the third parties by name, the purposes stated as purposes rather than as benefits, and the fact that refusing is as easy as agreeing.
Keeping it true after the site changes
A cookie notice ages badly. A new tag, a new embed, an agency adding a pixel for a campaign, and the notice describes a site that no longer exists. The fix is procedural rather than legal: re-scan on a schedule, compare what you find to what the notice claims, and treat a difference as a defect to be fixed rather than a discrepancy to be explained.
Questions people ask about cookie notice
Is a cookie notice the same as a privacy policy?
No. The privacy policy covers personal data generally; the cookie notice covers what is stored on and read from the device, which is a separate obligation in the EU and often a separate section in a US policy.
Do I need one if I only use analytics?
Yes in the EU, because analytics storage is not strictly necessary. In the US it depends on the state and on whether what the analytics feeds counts as a sale or a share.
Can the notice just list the cookie names?
A list of names with no purposes is not a disclosure. The purpose and the recipient are the parts that let someone decide, which is what the notice exists for.
Who is responsible when a vendor's tag sets a cookie?
You are, as far as the visitor is concerned. It is your page. The vendor's own obligations exist as well, but they do not move the disclosure duty off the site the visitor is on.