Functional cookies, also called functionality cookies or preference cookies, store your preferences so a website can remember them between pages or visits. They handle things like your chosen language, your region, dark mode and similar choices that make the site feel personalised. Without them, every page load starts from scratch. In the EU most of them need consent unless they last only for the session, and in the UK, since 5 February 2026, cookies that only adapt how a site looks or works can be set without consent if visitors are told and can object.
They sit between strictly necessary cookies, which the site cannot work without, and tracking cookies, which monitor behaviour for analytics or advertising. That distinction matters because it decides whether you need consent to set them.
How functional cookies work
When your browser loads a page, the server can include a Set-Cookie header in its response, or a script on the page can write the cookie. The browser stores it and sends it back with every later request to the same domain. That round trip is the whole mechanism: a small text file going back and forth.
Functional cookies are almost always first-party, meaning they are set by the domain you are actually visiting. A cookie set by example.com is only sent back to example.com, not to any other site. This is what separates them from third-party tracking cookies that follow you around the web.
They come in two kinds:
- Session cookies: deleted when you close the browser. Useful for temporary state like a media player's volume level.
- Persistent cookies: stored until their expiry date, which might be 30 days, a year or longer. Language preferences usually use persistent cookies so the site remembers your choice across visits.
How many a site sets depends entirely on its features. A shop with language, currency and wishlist features sets several, and a simple brochure site might set none at all.
Common examples of functional cookies
Language and region preferences
Multilingual sites rely heavily on functional cookies. WordPress sites using Polylang store your language selection in pll_language, and WPML uses wp-wpml_current_language. Without these, a French-speaking visitor would see the default language on every new page.
Region cookies work the same way. An international retailer might store your country so it can show local pricing, VAT rates and shipping options without asking each time. Shopify, for example, uses a localization cookie to localise the cart to the right country.
Login and authentication state
This is where the line between "necessary" and "functional" gets blurry. A session cookie like PHPSESSID or Laravel's laravel_session is strictly necessary: the application cannot process signed-in requests without it. But a "remember me" token (remember_web_* in Laravel, wordpress_logged_in_* in WordPress) is a convenience feature. It keeps you signed in for days or weeks so you do not have to re-enter your password.
EU regulators' working party drew this line in 2012: persistent login cookies that store an authentication token across browser sessions are not exempt, and a "remember me (uses cookies)" checkbox next to the login form is a suitable way to get consent. Session login cookies need no consent.
User interface customisation
Dark mode preferences, font size, the collapsed or expanded state of a sidebar and accessibility settings are all stored in functional cookies. Some sites use a single preferences cookie containing a JSON string with several settings. Others set one cookie per choice.
A flag that remembers a visitor closed an ordinary notice bar is functional. The cookie that stores a visitor's answer to your cookie banner is different: it is strictly necessary, and regulators such as the CNIL list it among the cookies that need no consent.
Media player and form preferences
Video players remember your volume and quality settings between pages. YouTube embeds store some of these in cookies, though YouTube also sets marketing cookies alongside them. Live chat widgets remember whether the chat window is open or minimised, and may store your name if you entered it before.
Partly filled forms are another case. Some checkouts save your progress in a cookie so you do not lose your shipping details if you navigate away and come back.
Shopping cart and wishlist persistence
For visitors who are not signed in, the shopping cart often lives in a cookie or is referenced by a cookie ID that points to server-side storage. "Recently viewed items" and wishlist features work the same way.
Note the distinction: a cart cookie that exists only during the visit is usually classed as necessary, because the visitor asked for the checkout service. A persistent cart that remembers items for days is functional: a convenience, not a requirement.
Functional cookies compared with other cookie types
| Type | Purpose | Consent required? | Example |
|---|---|---|---|
| Necessary | Core site operation | No (exempt under Article 5(3) of the ePrivacy Directive) | Session ID, CSRF token |
| Functional | User preferences and convenience | Usually yes in the EU. In the UK, not if visitors are told and can object. | Language, dark mode |
| Analytics | Usage measurement and reporting | Yes, with narrow exemptions | _ga, _ga_<container-id> |
| Marketing | Ad targeting and tracking | Yes | _fbp, _gcl_au |
The boundaries are not always clean. A cookie that stores your selected currency could be necessary (the checkout breaks without it) or functional (the site has a sensible default). Classification depends on actual behaviour, not the cookie's name or what the developer intended. When in doubt, ask: "Would the specific feature the user requested still work without this cookie?" If yes, it is probably functional rather than necessary.
Are functional cookies strictly necessary?
Usually not, and the answer depends on how long the cookie lasts. Article 5(3) of the ePrivacy Directive exempts a cookie only if it is strictly necessary for a service the user explicitly requested. In Opinion 04/2012 on cookie consent exemption, the EU's Article 29 Working Party said that language and similar interface customisation cookies are exempt only as session or short-term cookies, lasting no more than a few additional hours. Remembering the choice for weeks or months needs consent, which a clear "uses cookies" note next to the language selector can provide.
So a language choice kept for the session is exempt, while one remembered for months generally needs consent in the EU.
Do functional cookies need consent?
GDPR and the ePrivacy Directive
Under the ePrivacy Directive, most persistent functional cookies need informed, prior consent in the EU, for the reasons above. The GDPR adds requirements about how that consent must be obtained: freely given, specific, informed and unambiguous. Pre-ticked boxes do not count, and a banner should let visitors accept or reject functional cookies separately from analytics and marketing.
CCPA and CPRA (California)
California uses an opt-out model rather than opt-in. Functional cookies are generally fine unless they involve "selling" or "sharing" personal information with third parties. In practice, first-party functional cookies rarely trigger CCPA obligations because the data stays with the site operator. If a third-party service sets a functional cookie that also enables cross-site profiling, you are back in regulated territory.
UK GDPR and PECR
The UK moved away from the EU approach on 5 February 2026. Under the changes made by the Data (Use and Access) Act 2025, paragraph 6 of Schedule A1 to PECR lets a website store or read information without consent when the sole purpose is to adapt how the site looks or works to the visitor's preferences, or otherwise to improve its appearance or functionality. Visitors must get clear and comprehensive information about the purpose and a simple, free way to object.
Language, dark mode and font size cookies fit that description. A cookie that also feeds analytics or advertising does not. The ICO published its final guidance on storage and access technologies, reflecting these changes, on 29 April 2026.
Other jurisdictions
Brazil's LGPD, Canada's PIPEDA and South Africa's POPIA all require some legal basis for processing personal data through cookies. The mechanisms vary: the LGPD allows legitimate interest as a basis in some cases, and PIPEDA uses a "reasonable person" standard. The trend is consistent, though: non-essential cookies need either consent or a strong justification.
How to manage functional cookies on your website
Step 1: Scan your website for cookies
You cannot manage what you have not measured. A cookie scan loads your pages in a real browser and records every cookie that gets set, including HttpOnly cookies that JavaScript cannot see and third-party cookies from embedded services. Many site owners find cookies they did not know existed, set by plugins, tag managers or embedded widgets.
Step 2: Categorise each cookie accurately
Do not put everything into "functional" to avoid consent requirements. Regulators look for analytics and advertising cookies filed under the wrong category. Each cookie needs individual review: what data does it store, who sets it, and what happens if the visitor opts out?
A consent management platform will suggest categories from known cookie databases, but always check. A cookie named _prefs could store language preferences (functional) or could track page views (analytics). Only the actual behaviour matters.
Step 3: Configure your consent banner
Your banner should offer a choice per category. Visitors should be able to accept functional cookies while rejecting analytics and marketing, or the other way round. A single "Accept all" button with no equal way to refuse does not give a free choice.
The banner also needs to explain what each category does in plain language, not legal boilerplate.
Step 4: Block functional cookie scripts until consent
Setting the cookie after consent is not enough if the script that sets it has already run and sent data somewhere. Proper consent management blocks the script until the visitor makes a choice. For functional cookies, this means features like live chat widgets, language selectors powered by third-party services, or embedded media players should not load until the visitor allows them.
Kukie.io's automatic script blocking recognises known third-party scripts and holds them until the visitor accepts the matching category.
Step 5: Keep your cookie audit up to date
Cookies change every time you update a plugin, switch themes, add an embed or change your tag manager. A scan from six months ago may miss cookies your site sets today. Scan again on a schedule: monthly for active sites, and after every significant change.
Short answers on functional cookies
Are functional cookies the same as necessary cookies?
No. Necessary cookies (also called strictly necessary or essential cookies) are required for a website to work at all, such as session management and security tokens. Functional cookies remember preferences like language or region, and the site still works without them.
Do functional cookies require consent under GDPR?
In the EU, most persistent ones do. A preference kept only for the session can be exempt as strictly necessary, but a language or font size cookie that lasts weeks or months needs consent under the ePrivacy Directive. In the UK, since 5 February 2026, they can be set without consent if visitors are told and can object.
Can functional cookies track users across websites?
Functional cookies set by the website you are visiting (first-party) do not track you across other sites. Some third-party services embedded on a site may set cookies labelled as functional that have broader tracking capabilities, which is why each cookie needs to be categorised by what it actually does.
What happens if a visitor rejects functional cookies?
The website still works, but personalised features may reset on every visit. The visitor might need to choose their language each time, see default region settings instead of local content, or lose the contents of a saved shopping cart.
How do I identify functional cookies on my website?
Run a cookie scan to detect the cookies your site and its third-party scripts set. Cookies that store preferences, interface settings or session choices, without analytics or advertising functions, usually belong in the functional category.
Do functional cookies expire?
Yes. Functional cookies can be session cookies, deleted when the browser closes, or persistent cookies, stored until a set expiry date. A language preference cookie might last 30 days or a year, while a session cookie for a media player's volume disappears when the browser closes.
Know exactly what your website stores
Most sites set more cookies than their owners expect. A scan shows every cookie your pages set and which category each belongs to, so you can decide which functional cookies need to wait for consent.
