Yes. "Section 10" of the AdSense's agreement requires you to have a Privacy Policy (bold words are mine):
You will ensure that at all times you use the Services, the Properties have a clearly labeled and easily accessible privacy policy that provides end users with clear and comprehensive information about cookies, device-specific information, location information and other information stored on, accessed on, or collected from end users' devices in connection with the Services, including, as applicable, information about end users' options for cookie management. You will use commercially reasonable efforts to ensure that an end user gives consent to the storing and accessing of cookies, device-specific information, location information, or other information on the end user's device in connection with the Services where such consent is required by law.
This requirement is also detailed in the "Required Content" help page:
My privacy policy
Your privacy policy should include the following information:
Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.
Users may opt out of personalized advertising by visiting Ads Settings. (Alternatively, you can direct users to opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.)
What you need to do:
Create a Privacy Policy to detail your use of Google AdSense and how users can opt-out
Use a "cookie consent" solution to get consent from users. For example, our own solution can be of help, but you can find other solutions as well.
