Every cookie consent banner on the web groups cookies into categories. Visitors see toggles labelled "Necessary", "Analytics", "Marketing" and sometimes "Functional" or "Preferences". Behind those labels sits a classification decision that has real legal weight. Place a tracking cookie in the wrong category and you risk firing it without valid consent - exactly the kind of mistake that drew a €150 million fine from France's CNIL against Shein in September 2025.
To categorise a cookie, find out what it is for, then test what changes when it is removed. A cookie the site breaks without is strictly necessary. Losing only a setting the visitor chose points to a preference cookie, losing only your usage data points to analytics, and a change in ads elsewhere means marketing. The steps below cover the audit, the test and the grey areas.
The four standard cookie categories
The ICC UK Cookie Guide, first published in 2012 and endorsed by the UK's Information Commissioner's Office (ICO), established four categories based on cookie purpose. Most consent management platforms still use this framework, sometimes with minor label variations.
| Category | Purpose | Consent required? | Examples |
|---|---|---|---|
| Strictly necessary | Core site functionality the user explicitly requested | No (but must be disclosed) | PHPSESSID, csrf_token, cart cookies |
| Functional or preferences | Remembers choices the visitor made, such as language or layout | Often no, when the visitor chose the setting. Yes if reused for analytics or ads | A language cookie, theme selectors, live chat state |
| Analytics or performance | Measures how visitors use the site in aggregated or pseudonymous form | Yes in most EU countries, with narrow exemptions | _ga, _ga_<container-id>, _hjSessionUser |
| Marketing or targeting | Tracks behaviour across sites for advertising | Yes | _fbp, _gcl_au, IDE |
Under Article 5(3) of the ePrivacy Directive, only cookies that are strictly necessary for a service the visitor explicitly requested are exempt from consent, and the guide to essential and non-essential cookies goes deeper. A shopping basket cookie qualifies. A cookie that stores a language the visitor chose usually does too: the CNIL lists interface personalisation such as a language choice among the trackers that need no consent, when it is an expected part of the service.
Step 1: run a full cookie scan
You cannot categorise what you have not found. Start by scanning every page and user flow on your site - including logged-in states, checkout funnels, and any page that loads third-party widgets. A cookie scanner will crawl the site, trigger scripts, and produce a list of every cookie set during the session along with its name, domain, expiry, and the script that created it.
Manual checking with Chrome DevTools is useful as a supplement, but it misses cookies set by scripts that fire only under specific conditions (such as a clicked consent button or a particular referrer). Automated scanning catches more.
Record each cookie's name, domain (first-party or third-party), lifespan (session or persistent, and for how long), and the HTTP response or JavaScript call that sets it. This raw inventory is what you will classify in the next step.
Step 2: classify each cookie by purpose
Work through your inventory cookie by cookie. For each one, ask a single question: what happens to the site if this cookie is removed?
If the site breaks - pages fail to load, login stops working, the cart empties on navigation - the cookie is strictly necessary. If the site still works but loses a setting the visitor chose, like a language, it is functional (a preference cookie). If removing it has no visible effect on the visitor but the site owner loses usage data, it is analytics. If removing it stops personalised ads from appearing elsewhere, it is marketing.
Remove the cookie and see what changes
Use the cookie name and domain as clues
Well-known cookies can often be identified by name. The Kukie.io Cookie database and the Open Cookie Database both maintain searchable indexes. A cookie named _ga, which Google Analytics sets on your own domain, is analytics. One named _fbp, which the Meta Pixel sets on your own domain, is marketing. Both appear as first-party cookies in a scan. A cookie named wp_woocommerce_session on your own domain is strictly necessary for WooCommerce cart functionality.
Unknown or custom cookies require more investigation. Check the script source, read the vendor's documentation, or remove the cookie in a staging environment and observe what changes.
Check the vendor, not just the cookie name
A third-party embedded service may set cookies that technically support its own analytics, but because those cookies operate across multiple sites, they can be used for cross-site profiling. A safe rule: cookies set by third-party services for purposes you cannot confirm should be categorised by their most privacy-intrusive possible use, not their most benign one. A social sharing widget that sets a cookie tracking logged-in users across the web belongs in marketing, even though the button itself looks functional.
Step 3: handle the grey areas
Not every cookie fits neatly into one box. In a study of 29,398 websites presented at USENIX Security 2022, Bollinger and colleagues at ETH Zurich found that 8.2% assigned an incorrect purpose to Google Analytics cookies such as _ga, and 2.7% declared at least one of them as necessary.
Common edge cases worth flagging:
Google Analytics with IP anonymisation - some CMPs classify this as necessary, but anonymisation does not make it exempt (GA4 does not store IP addresses anyway). The CNIL's exemption covers only tightly limited first-party audience measurement, which a standard GA4 set-up does not meet. Classify as analytics.
Live chat widgets - the chat functionality itself may feel necessary, but the cookies a chat service sets often track returning visitors across sessions for the vendor's own purposes. Check whether the cookie supports the chat session (functional) or the vendor's analytics and ad targeting (marketing).
Social sharing buttons - if the button sets cookies or loads the network's script before the visitor clicks it, those cookies are marketing or targeting. A plain link that loads nothing until the click sets no cookies on your site.
A/B testing cookies - a cookie that assigns a visitor to test variant A or B for your own UX experiment is functional. If the A/B tool also feeds data into a third-party analytics or advertising profile, classify as analytics or marketing, depending on the data flow.
Content delivery network (CDN) cookies - load-balancing cookies from a CDN like Cloudflare (
__cflb) are strictly necessary. They exist only to route requests correctly.
When genuinely unsure, apply the conservative rule: classify the cookie in the category that requires consent. Placing a marketing cookie into the functional bucket fires it before the visitor opts in. Placing a functional cookie into the marketing bucket only delays it until consent is given: an inconvenience, not a breach.
Step 4: document everything in your cookie policy
A cookie policy must list every cookie by name, state its category, describe its purpose in plain language, and note its lifespan. Group cookies by category so visitors can see at a glance what each toggle in the banner controls.
Vague labels do not count. Writing "This cookie is used to improve your experience" tells the visitor nothing. Writing "_ga: set by Google Analytics, counts page views and traffic sources, expires after 2 years, category: analytics" gives the visitor enough to make an informed choice. The GDPR requires consent to be informed, and informed consent demands specifics.
Step 5: map categories to your consent banner
Your cookie banner should present one switch per cookie category (excluding strictly necessary cookies, which remain always on). When a visitor switches off "Analytics", every cookie you classified as analytics must be blocked - not just most of them. This is where accurate categorisation pays off. A missed cookie that fires despite a visitor's refusal is exactly what regulators test for.
The ICO's 2025 review of the UK's 1,000 most-visited websites looked at whether sites set advertising cookies before visitors chose. Regulators now test sites directly, loading pages with consent denied and inspecting which cookies appear regardless. The CNIL follows the same approach: in 2025 it sanctioned 21 organisations over trackers.
Keep categories in sync after launch
Cookies change. A plugin update can introduce new cookies. A marketing tag added by a colleague can slip in without review. Scheduled scans, weekly or monthly, catch drift early. Each new cookie found needs to be classified and added to the policy and the CMP configuration before it fires on a live page.
Three mistakes that keep appearing
Three errors appear repeatedly in audits. The first is over-claiming "strictly necessary" status. If your site would still function without the cookie, it is not strictly necessary. Regulators in France and the UK have been explicit: the bar is high, and convenience is not necessity.
The second mistake is ignoring third-party cookies. A tag manager, a font service, an embedded map, or an analytics platform can all set cookies on your visitors' devices. You are responsible for those cookies even though a third party created them.
The third is setting categories once and never revisiting them. Websites evolve. The cookie inventory from six months ago is probably already out of date. Treat categorisation as a recurring task, not a one-off project.
Questions about categorising cookies
How many cookie categories should a consent banner have?
Most banners use four categories: strictly necessary, functional (or preferences), analytics, and marketing. Some CMPs merge functional and analytics into one group, but keeping them separate gives visitors more granular control - which regulators prefer.
Can I classify Google Analytics cookies as strictly necessary?
No. Analytics is never strictly necessary, and IP anonymisation does not change that. A few countries allow narrow first-party measurement without consent, such as the CNIL's audience-measurement exemption, but a standard Google Analytics set-up does not meet those conditions.
What happens if I put a cookie in the wrong category?
If a non-essential cookie is labelled strictly necessary, it fires without consent - a direct violation of Article 5(3) of the ePrivacy Directive. In 2025, the CNIL sanctioned 21 organisations over trackers, including Shein (€150 million) for cookies set before any choice.
How often should I re-audit my cookie categories?
At least quarterly, or whenever you add a new plugin, script, or third-party integration. Automated scheduled scans can flag new or changed cookies between full audits.
Do functional cookies always need consent?
Not always. A cookie that stores a setting the visitor chose, such as a language, is usually exempt: the CNIL lists interface personalisation among the trackers that need no consent. A functional cookie that also feeds analytics or advertising needs consent.
How do I categorise cookies set by social media share buttons?
It depends on what the cookie does. If the button sets a cookie that tracks the visitor across other sites for ad targeting - even without a click - classify it as marketing. If nothing loads until the visitor clicks, there is no cookie on your site to categorise. Check the vendor's documentation for what its button sets.
Start your cookie inventory from a fresh scan
If your current cookie inventory is a spreadsheet last updated a year ago, a fresh scan is the fastest way to close the gap. Kukie.io scans your site, lists the cookies it finds and suggests a category for each one, which you can confirm or change, so your banner, your policy and your cookies tell the same story.
