Can I use only a privacy statement instead of a cookie policy