Cookies fall into four categories: strictly necessary, functional, analytics and marketing. Only strictly necessary cookies can be set without consent everywhere in the EU, and every other category needs the visitor's agreement first, with a few narrow national exceptions for analytics and, in the UK since February 2026, for statistics and site appearance. Some cookies keep the shopping cart working. Others track which adverts a visitor has seen across a dozen unrelated sites. Privacy law treats these two cases very differently, and the difference comes down to category.
Where cookie categories come from
Dividing cookies into categories starts with Article 5(3) of the ePrivacy Directive (2002/58/EC, amended in 2009). That provision draws a line between storage that is strictly necessary to deliver a service the user has requested and everything else. Strictly necessary cookies may be set without consent. All others require it.
Most consent management platforms, including Kukie.io, expand this binary into four categories: strictly necessary, functional, analytics and marketing. The grouping is not defined word for word in legislation, but it reflects the way cookie guidance from the ICO, the CNIL and the Article 29 Working Party (now the EDPB) explains cookie purposes. It also lines up with the storage types in Google Consent Mode, covered below.
Strictly necessary cookies need no consent
Strictly necessary cookies are the only type that do not require consent under EU and UK law. They exist solely to enable a core function the visitor explicitly requested. The classic example is a session cookie like PHPSESSID or JSESSIONID that keeps a user logged in as they move between pages. Without it, the site would not work as expected.
Other common strictly necessary cookies include login cookies such as WordPress's wordpress_logged_in_[hash] for a user who chose to sign in, CSRF tokens (which prevent cross-site request forgery attacks), load-balancer cookies that route traffic to the correct server, and cookies that store a visitor's consent choice, such as Kukie.io's own _cc_consent.
The exemption is narrow. A cookie qualifies only if both of these conditions are met: the user has actively requested a service (loading a web page counts), and the cookie is strictly necessary to provide that service. A language-preference cookie fails this test because remembering a language choice is convenient, not strictly necessary to serve the page.
Common strictly necessary cookies
| Cookie name | Purpose | Typical expiry |
|---|---|---|
PHPSESSID | Server-side session identifier | Session |
wordpress_logged_in_[hash] | Keeps a signed-in WordPress user authenticated | Session, longer with Remember Me |
csrf_token | Cross-site request forgery protection | Session |
cart_id | Shopping cart persistence | 14 days |
_cc_consent | Stores the visitor's consent choice | Set per site (12 months by default) |
Even though consent is not required, transparency is. Article 5(3) asks for "clear and comprehensive information" about storage on a visitor's device, and regulators expect strictly necessary cookies to be explained too, usually in a cookie policy or the second layer of a consent banner.
Functional cookies remember choices
Functional cookies (also called preference cookies) remember choices a visitor has made: language, region, text size, dark mode, or whether they have dismissed a notification. They improve the browsing experience without being essential to it.
A common example is pll_language, set by the Polylang plugin on WordPress sites. It records which language version a visitor selected so the site can serve the same language on later page loads.
In the EU, functional cookies need consent because they are not strictly necessary. The website would still work without them: the visitor would just need to choose their language again.
The UK changed this on 5 February 2026. Schedule A1 of PECR, added by the Data (Use and Access) Act 2025, lets a website store or read information without consent when the sole purpose is to enable or enhance the way the site appears or functions, provided visitors get clear information and a free, simple way to object. Language and display preferences of this kind can now run on notice and opt-out in the UK. The UK cookie exemptions have their own guide.
Analytics cookies measure visits
Analytics cookies measure how visitors interact with a website: which pages they view, how long they stay, what they click and where they drop off. The data helps site owners find problems and improve content.
Google Analytics is the most common source of analytics cookies. Its primary cookie, _ga, assigns each browser a pseudonymous client ID and lasts two years by default. GA4 also sets _ga_[container-id] to keep the state of each data stream. These cookies generate data that counts as personal data under the GDPR (see Recital 30), because the client ID can identify a person when combined with other information.
That means analytics cookies need consent in most of the EU. Pre-ticked boxes, implied consent from scrolling and banners without a visible reject button do not count.
Exceptions for audience measurement in France and the UK
The CNIL exempts audience measurement from consent under conditions set out in its guidance on analytics: visitors are informed and can object, the purpose is limited to audience measurement and A/B testing, the data is not cross-checked with other processing, the tracker is limited to one site or app publisher, the last byte of the IP address is truncated and trackers last no more than 13 months. Matomo can qualify when configured that way. Google Analytics, configured in the usual way, does not.
The CNIL notes that this position may vary between countries, so check your own regulator's guidance before relying on it elsewhere in the EU. In the UK, PECR's Schedule A1 has, since 5 February 2026, let a site collect information for statistical purposes about how its own service is used without consent, if the data is used only to improve the service and visitors are told and can object.
Marketing and advertising cookies always need consent
Marketing cookies track visitors across websites to build behavioural profiles and serve targeted adverts. They are the most privacy-intrusive category and attract the strictest scrutiny.
The Meta Pixel (_fbp, _fbc), Google Ads (_gcl_au, _gcl_aw) and ad-network cookies like __gads all fall into this category. These cookies create persistent identifiers that link a visitor's product page view on your site to an ad slot on a completely different domain. The resulting profiles can reveal sensitive information about health conditions, political views and financial status, the kinds of data Article 9 of the GDPR gives extra protection.
Marketing cookies always require informed, prior consent, and neither the EU rules nor the new UK exceptions cover them. In September 2025, the CNIL fined SHEIN 150 million euros, in part because advertising cookies were placed on visitors' devices before they had made any choice.
Google Consent Mode v2, which Google has required for EEA and UK ad personalisation and measurement since March 2024, ties advertising features to consent status. If a visitor denies ad_storage, Google tags do not set or read advertising cookies.
How to tell which category a cookie belongs to
Classification is not always obvious. A cookie called preferences might sound functional but could be logging behavioural data that feeds a recommendation engine, which makes it analytics or marketing in practice. What matters is not the name but the purpose and the data flow.
Ask three questions about each cookie:
1. What data does it store? A session ID that expires when the browser closes is less invasive than a persistent identifier with a two-year lifespan.
2. Who reads it? A first-party cookie read only by your own server is different from a third-party cookie that an advertising network reads across thousands of domains.
3. What happens if it is removed? If the site breaks for the visitor, the cookie is likely strictly necessary. If the visitor loses a language preference, it is functional. When nothing visible changes but a tracking pixel stops sending, it is analytics or marketing.
Put together, the answers sort a cookie in a fixed order: necessity first, then preferences, then measurement of your own site, and anything left is marketing.
Which category a cookie belongs to
Running a cookie scan is the most reliable way to find every cookie on your site. Automated scanners crawl your pages, detect first-party and third-party cookies, and list each one's name, domain, expiry and likely purpose. Review each cookie against the three questions above, and pay special attention to third-party cookies: they almost never qualify as strictly necessary.
Document your classification decisions. If a regulator asks why you treated a particular cookie as strictly necessary, you need a written reason, not a guess. Your ROPA (Record of Processing Activities) under Article 30 of the GDPR should include your cookie processing. Then scan again on a schedule: third-party scripts change without warning, and a plugin update can add new cookies or change what existing ones do.
Cookies that sit between categories
Some cookies resist neat classification. A chat widget might set a cookie to remember whether a visitor has already seen a chat prompt, which is functional. The same widget might also log page URLs and referring sources for a CRM's lead scoring, which is analytics or even marketing.
The safest approach is to classify by the most privacy-intrusive purpose the cookie serves. If a single cookie supports both a preference and a tracking purpose that feeds a third-party system, classify it as analytics or marketing and ask for consent.
Embedded content deserves particular scrutiny. Cookies from YouTube videos, social sharing buttons, Google Maps and font services should be scanned and classified individually. Embedding a YouTube video can set several cookies from youtube.com and doubleclick.net, and those belong in the marketing category.
Consent rules by category at a glance
| Category | Consent required in the EU? | UK since 5 February 2026 | Example cookies |
|---|---|---|---|
| Strictly necessary | No | No | PHPSESSID, CSRF tokens, consent cookies |
| Functional | Yes | Not for appearance and functionality, with notice and an opt-out | pll_language, theme_preference |
| Analytics | Yes (the CNIL exempts some audience measurement) | Not for first-party statistics, with notice and an opt-out | _ga, _ga_[id] |
| Marketing | Yes, always | Yes, always | _fbp, _gcl_au, __gads |
What misclassification has cost other sites
Misclassifying cookies is not a theoretical risk. Regulators check what a site sets before consent, and treating a tracking cookie as necessary is one of the fastest ways to end up in a decision.
The CNIL's 2025 record shows it. In September 2025 it fined SHEIN 150 million euros for cookies placed before any choice. On 20 November 2025, it fined the publisher of vanityfair.fr 750,000 euros for cookies placed without valid consent. Across the full year, the CNIL issued 83 sanctions worth 486.8 million euros in total, 21 of them against organisations over trackers.
The UK's ICO took a different but equally pointed approach. In January 2025, it reviewed the top 1,000 UK websites and raised concerns with 134 of the first 200 it checked. By 4 December 2025, the ICO reported that 979 of the top 1,000 sites met its checks, 564 of them only after the ICO contacted them, and it had issued 17 preliminary enforcement notices.
A common mistake is treating analytics cookies as strictly necessary. Google Analytics cookies do not meet the ePrivacy Directive's exemption because measuring traffic is not needed to deliver the page the visitor asked for. Labelling _ga as strictly necessary and setting it before consent is exactly the kind of error an automated audit, and a regulator, finds first.
How cookie categories map to Google Consent Mode v2
Google Consent Mode v2 has four consent signals that matter for advertising and measurement in the EEA and the UK: ad_storage, ad_user_data, ad_personalization and analytics_storage. Version 2 added ad_user_data and ad_personalization. Google's consent mode documentation also lists three optional storage types, which map onto the remaining categories:
| Consent Mode parameter | Cookie category | What it controls |
|---|---|---|
ad_storage | Marketing | Storage for advertising, such as conversion tracking |
ad_user_data | Marketing | Sending user data to Google for online advertising |
ad_personalization | Marketing | Personalised advertising, such as remarketing |
analytics_storage | Analytics | Storage for analytics, such as visit duration |
functionality_storage (optional) | Functional | Storage for site functionality, such as language settings |
personalization_storage (optional) | Functional | Storage for personalisation, such as video recommendations |
security_storage (optional) | Strictly necessary | Storage for security, such as authentication and fraud prevention |
When a visitor refuses a category, the matching parameters should be set to denied, and your consent platform sends that state to Google's tags. Without the v2 signals, Google limits advertising features such as remarketing audiences and personalised ads for EEA and UK traffic.
Cookie categories: short answers
Are analytics cookies ever exempt from consent?
Sometimes. In France, the CNIL exempts audience measurement tools that meet strict conditions, such as no cross-checking with other data, a truncated IP address and trackers that last no more than 13 months. In the UK, first-party statistics have been exempt since 5 February 2026 if visitors are told and can object. Google Analytics, configured in the usual way, does not qualify for the CNIL exemption.
Can I use legitimate interest instead of consent for functional cookies?
No. Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device unless the storage is strictly necessary. Legitimate interest under GDPR Article 6(1)(f) does not replace that consent. The UK's appearance and functionality exception is a separate rule in PECR, not legitimate interest.
What happens if I classify a marketing cookie as strictly necessary?
The cookie is set without consent, which breaks the prior-consent rule in Article 5(3) of the ePrivacy Directive. Regulators look for this kind of misclassification when they check a site. Fines for setting marketing cookies before consent have ranged from thousands to hundreds of millions of euros depending on scale.
Do session cookies always count as strictly necessary?
Not automatically. A session cookie that maintains a login state or shopping cart is strictly necessary. A session cookie that logs page views for analytics is an analytics cookie, regardless of its short lifespan. The exemption depends on purpose, not duration.
How often should I re-scan my website for new cookies?
Monthly scans are a sensible minimum. Third-party scripts, plugin updates and CMS changes can add new cookies without notice. Quarterly scans may be enough for static brochure sites, but any site running advertising tags, social widgets or e-commerce integrations should scan more often.
Does the UK still follow EU cookie consent rules after Brexit?
Partly. The UK enforces cookie consent under PECR (the Privacy and Electronic Communications Regulations), which started as a copy of the ePrivacy Directive. Since 5 February 2026, PECR also exempts first-party statistics and storage that adapts a site's appearance or functions, if visitors are told and can object. Marketing cookies still need consent.
How do I handle cookies set by embedded third-party content like YouTube or Google Maps?
Third-party embeds often set several cookies from external domains, and these usually fall into the marketing category because they allow cross-site tracking. Block the embed until the visitor consents to marketing cookies, or use privacy-enhanced embed modes (such as YouTube's youtube-nocookie.com domain) that reduce cookie placement.
Check the categories your cookies are in
Cookie classification is not a one-time task. Every new plugin, widget or script can change what your site stores on visitors' devices. Kukie.io scans your site and sorts the cookies it finds into these four categories for your banner and cookie policy, and you can move any cookie to another category yourself.
