Cookie policy should be linked to the data privacy policy. Please add a section on cookie - please see the Data Privacy Policy document - section 2.3 and 2.4. The cookie policy has to be confirmed and adapted by contractor. This must reflect the actual use of cookies. Please do not use google analytics or google font - as personal data would be processed in the USA.
Matomo for Analytics is ok.