Non-essential cookies are any cookies that a website does not strictly need in order to work. Remove them, and the site still loads, pages still render, forms still submit, and users can still complete their transactions. That test, whether the site breaks without the cookie, is the dividing line that privacy regulators care about most, and it separates them from essential, strictly necessary cookies.
The distinction matters because Article 5(3) of the ePrivacy Directive requires prior consent before any information is stored on or read from a visitor's device, with only two narrow exemptions: cookies used solely to transmit a communication over a network, and cookies strictly necessary to provide a service the visitor explicitly requested. Everything else, from analytics and advertising to social media widgets and personalisation, falls outside those exemptions and needs opt-in consent in the EU before it runs. Since 5 February 2026 the UK lets some analytics and preference cookies run without opt-in if visitors are told and can object.
What makes a cookie non-essential
The label "non-essential" is not a technical property of the cookie itself. What decides its legal classification is its purpose.
A session cookie that keeps a user signed in while they browse an online shop is essential: it provides a service the user actively requested. The same technology, set by Google Analytics to assign a unique visitor identifier in _ga, is non-essential because the visitor never asked to be tracked. The distinction applies equally to first-party and third-party cookies, and to technologies beyond traditional cookies such as tracking pixels, local storage and device fingerprinting.
A cookie can only escape consent if every purpose it serves is exempt. The Article 29 Working Party, whose role the EDPB has since taken over, said so in Opinion 04/2012 on the cookie consent exemption: a multipurpose cookie is exempt only if all its distinct purposes are individually exempt.
Is this cookie non-essential?
The three main categories
Most cookie classification frameworks sort non-essential cookies into three groups.
| Category | Purpose | Common examples | Typical lifespan |
|---|---|---|---|
| Analytics and performance | Measure how visitors use the site: page views, session duration, traffic sources | _ga, _ga_<container-id> (Google Analytics), _hjid (Hotjar) | Up to 2 years |
| Advertising and marketing | Track browsing behaviour to serve targeted ads and measure conversions | _fbp (Meta Pixel), _gcl_au (Google Ads), IDE (DoubleClick) | 90 days to 2 years |
| Functional and preference | Remember user choices beyond strict necessity: language, region, display settings | pll_language (Polylang for WordPress), chat widget cookies | Session to 1 year |
The functional category is the grey area. A language preference cookie could be argued to be strictly necessary if the site cannot serve content without it, but Opinion 04/2012 exempts interface preferences only as session or short-term cookies. Remembering a preference for weeks or months needs consent in the EU.
Why non-essential cookies require consent
The ePrivacy Directive sets the consent-first rule for storing or accessing information on a user's device. This applies whether or not the cookie collects personal data: even a cookie that stores a random hash needs consent if it is non-essential, because the Directive protects the device itself, not just personal data.
The GDPR comes in when cookies process personal data, which most non-essential cookies do, since unique identifiers like _ga or _fbp can identify individuals when combined with other data. Under the GDPR, consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count, and neither does one "Accept all" with no way to refuse.
Outside the EU, similar requirements apply in different forms. The UK used to mirror the EU. Since 5 February 2026, changes made by the Data (Use and Access) Act 2025 let UK sites use some analytics and preference cookies without opt-in consent, if they are used only for statistics to improve the site or to adapt how it looks or works, and visitors are told and given a simple way to object. Advertising cookies still need consent in the UK. Brazil's LGPD expects consent for tracking cookies, and PIPEDA in Canada requires meaningful consent. The CCPA and CPRA in California take an opt-out approach instead of opt-in, with a "Do Not Sell or Share My Personal Information" mechanism.
Enforcement is escalating
Regulators do not treat non-essential cookie violations as paperwork. On 1 September 2025 the CNIL fined Google EUR 325 million and SHEIN EUR 150 million, in particular for breaking the rules on cookies, according to the CNIL's announcement. SHEIN set advertising cookies before visitors made any choice and kept placing them after visitors refused. Google placed cookies without valid consent when people created a Google account, and showed ads between Gmail emails without consent.
Across 2025 the CNIL issued 83 sanctions totalling EUR 486,839,500, and 21 entities were sanctioned for breaking the rules on trackers, including storing them without consent and not respecting refusal, according to its review of 2025 sanctions. Making refusal harder than acceptance is treated as a dark pattern.
In the UK, the ICO reviewed the top 1,000 websites. By its December 2025 update, 979 met its checks, 564 of them only after the ICO contacted them. The EDPB's Guidelines 2/2023 have also confirmed that Article 5(3) covers tracking pixels, URL-based tracking and other non-cookie technologies.
How to handle non-essential cookies correctly
Block before consent
Non-essential cookies must not be set until the visitor actively consents. The scripts that set them, such as Google Analytics tags, Meta Pixel snippets and advertising scripts, need to be blocked from executing on page load. A consent management platform does this by holding back known tracking scripts and scripts you tag by category, and releasing them only once the visitor opts in for that category.
Present granular choices
Visitors must be able to accept or reject cookies by category. A banner offering only "Accept all" with no reject option, or hiding the reject button on a second screen, fails the consent conditions in Article 7 of the GDPR. Accepting and rejecting must be equally easy: same screen, same visual prominence, same number of clicks.
Classify every cookie
You cannot ask for informed consent if you do not know what cookies your site sets. Run a cookie scan to identify every cookie and tracker, then classify each one. Pay attention to third-party scripts: embedding a YouTube video, a Google Maps widget or a social sharing button may set cookies you did not expect.
Respect withdrawal
Consent must be as easy to withdraw as it was to give. If a visitor withdraws consent for analytics cookies, stop the scripts and delete the cookies they set, rather than leaving them in place. A cookie is removed by setting it again with an expiry date in the past.
What "reject non-essential cookies" means for visitors
When a banner offers "Reject non-essential cookies" or "Reject all", choosing it tells the site to set only the strictly necessary cookies it needs to work. Analytics, advertising and preference cookies should not be set, and the scripts behind them should not run. Choosing "Accept non-essential cookies" allows all of them. The choice itself is stored in a strictly necessary consent cookie, so the banner does not ask again on every page. The details are in the guide to what happens when you reject all cookies.
Legitimate interest does not apply to cookies
A persistent misconception is that legitimate interest under Article 6(1)(f) of the GDPR can justify non-essential cookies without consent. It cannot. The ePrivacy Directive is lex specialis, a more specific law that takes precedence over the GDPR's general rules for this question. Article 5(3) requires consent for storing or accessing information on a user's device, and legitimate interest is not one of its exemptions.
Google Consent Mode and non-essential cookies
Google Consent Mode v2 changes what Google's tags do after a visitor chooses. When analytics consent is denied, GA4 does not write _ga to the browser, and in advanced mode it sends cookieless pings that Google uses for modelling. The data is less detailed, but basic traffic and conversion figures can be estimated while the visitor's choice is respected.
Consent Mode does not remove the need for a consent banner. The consent signal still has to come from a consent tool that asks the visitor first.
Non-essential cookies: quick answers
Are analytics cookies always non-essential?
In the EU, almost always. Analytics cookies such as _ga are not strictly necessary to deliver the service the visitor requested, so they need consent. France exempts audience measurement that meets the CNIL's strict conditions, and since 5 February 2026 the UK exempts first-party statistics if visitors are told and can object.
Can I use legitimate interest instead of consent for non-essential cookies?
No. Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device, and legitimate interest is not among its exemptions. This applies whether or not the cookie processes personal data.
What happens if non-essential cookies load before consent is given?
That breaches the ePrivacy Directive, or its national version, and possibly the GDPR. The CNIL's EUR 150 million fine against SHEIN in September 2025 was partly because advertising cookies were placed before visitors made any choice.
Do non-essential cookies on US-only websites need consent?
If the website has no EU, UK or Brazilian visitors, the GDPR and ePrivacy rules do not apply. Under the CCPA and CPRA the approach is opt-out rather than opt-in. If your site receives traffic from the EU or UK, the stricter rules apply to those visitors.
How do I know which cookies on my site are non-essential?
Run an automated cookie scan to list every cookie and tracker. For each one, ask whether the site would still work without it. If yes, the cookie is non-essential and needs consent.
Is a cookie wall that blocks content until the visitor accepts cookies legal?
Usually not in the EU. The EDPB's guidelines on consent state that consent is not freely given if access to a service depends on accepting non-essential cookies. Models that offer a paid alternative are a separate question, and their legality varies by country.
How often should I re-scan my website for new non-essential cookies?
Whenever you add third-party integrations, update plugins or deploy new marketing tags, and on a schedule, weekly or monthly for active sites. Third-party scripts can add new cookies without your knowledge.
Find the non-essential cookies on your site
If you are unsure which cookies your site sets, or whether they load before consent, start with a scan. Kukie.io lists the cookies your pages set, suggests a category for each one and blocks known trackers until visitors choose.
