Marketing cookies, sometimes labelled advertising or targeting cookies, are cookies that record a visitor's browsing so ad platforms can target ads, run retargeting campaigns and measure conversions. They are never strictly necessary, so in the EU and the UK they need the visitor's consent before they are set, and in California visitors can opt out of the data sharing behind them.
What marketing cookies actually do
A typical marketing cookie holds an identifier that lets an advertising platform recognise the browser. The platform's script then reports which pages a visitor views, which products they click on and whether they complete a purchase or abandon a cart. Ad platforms combine that data with what they see elsewhere so they can show relevant ads as the visitor moves across the web.
The distinction matters because cookie categories decide which consent rules apply. Strictly necessary cookies can load without asking. Marketing cookies cannot.
Common marketing cookies and what sets them
Marketing cookies come from both your own domain (first-party) and external advertising networks (third-party). Here are the most common ones:
| Cookie name | Set by | Purpose | Typical duration |
|---|---|---|---|
_fbp | Meta Pixel | Identifies browsers for ad delivery and retargeting | 90 days |
_gcl_au | Google Ads | Stores conversion data from Google ad clicks | 90 days |
fr | Delivers, measures and targets advertising | 90 days | |
IDE | Google DoubleClick | Serves targeted ads across non-Google sites | 13 months |
_uetvid | Microsoft Advertising | Identifies visitors for Microsoft Ads conversion tracking and remarketing | 13 months |
personalization_id | X (Twitter) | Enables targeted ads on X | 2 years |
bcookie | Identifies browsers for LinkedIn ad targeting | 1 year |
These cookies are typically set through tracking pixels, small snippets of JavaScript embedded in your pages. When a visitor loads a page containing the Meta Pixel, for example, the Pixel saves an identifier in the _fbp cookie on your own domain and sends it with each event to Meta. Because _fbp is first-party, its value differs from site to site. Meta links that activity to what it sees on other sites through its own fr cookie on facebook.com and through matching on its side, which is how a cross-site profile for ad targeting and conversion attribution builds up. You can look up names like _gcl_au in the cookie database.
Social media widgets, embedded videos and share buttons also set marketing cookies, often without the site owner realising it.
How retargeting works through marketing cookies
Retargeting is the reason visitors see ads for a product they browsed days ago on an entirely different website. When someone visits your site and views a product, the advertising pixel records that interaction against an identifier. Later, when the same visitor browses a news site or social media platform in the same ad network, the identifier is recognised, matched to the recorded behaviour and a relevant ad is served, often showing the exact product they viewed.
Dynamic product ads, cart abandonment reminders and lookalike audience modelling all depend on this data flow.
The legal framework: GDPR, ePrivacy and beyond
Marketing cookies sit squarely in the category of tracking technologies that need prior consent under EU law. Two laws work together here.
Article 5(3) of the ePrivacy Directive sets the rule: storing or accessing information on a user's device requires consent, unless it is strictly necessary to deliver a service the user requested. Marketing cookies do not qualify for that exemption. The ePrivacy Directive has its own guide.
The GDPR then defines what valid consent looks like. Under Article 7, consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count. Bundling all cookies into a single "Accept" button without category-level controls does not count either. Visitors must be able to accept non-essential cookies like analytics while rejecting marketing cookies, or the other way round.
Enforcement is not theoretical. In September 2025, France's data protection authority, the CNIL, fined SHEIN 150 million euros, in part because advertising cookies were placed before visitors had any chance to interact with the banner. The same month, it fined Google 325 million euros, partly because consent to advertising cookies at Google account creation was not valid. According to the CNIL's review of its 2025 actions, its 83 sanctions that year totalled 486.8 million euros, most of it from those two cookie decisions, and 21 organisations were sanctioned over trackers.
CCPA and the opt-out model
The California Consumer Privacy Act (CCPA), as amended by the CPRA, takes a different approach. Rather than requiring opt-in consent before setting marketing cookies, California law requires websites to disclose data collection practices and provide a clear "Do Not Sell or Share My Personal Information" link. If a visitor opts out, marketing cookies that share data with third parties for cross-context behavioural advertising must stop.
Websites must also honour Global Privacy Control (GPC) browser signals as valid opt-out requests. Ignoring a GPC signal is treated as a violation.
Other jurisdictions
Brazil's LGPD generally means consent for marketing cookies. South Africa's POPIA requires processing to be justified under a lawful condition, which for marketing cookies typically means consent. Canada's PIPEDA requires meaningful consent, and the Privacy Commissioner's guidance on online behavioural advertising accepts opt-out consent only under conditions: clear purposes, notice at or before collection, an easy opt-out that takes effect immediately and persists, and no sensitive information. The UK GDPR and PECR mirror the EU framework. The consent exceptions PECR gained on 5 February 2026 cover first-party statistics and the site's appearance, not advertising, so marketing cookies still need prior consent in the UK.
Third-party cookies, browser changes and the shift to first-party data
Marketing cookies have traditionally been third-party cookies, set by domains other than the website the visitor is browsing. Safari blocks third-party cookies through Intelligent Tracking Prevention (ITP). Firefox's Total Cookie Protection, on by default, confines every cookie to the site where it was created, so it cannot follow a visitor across sites.
Google Chrome took a different path. After years of announcing and postponing plans to deprecate third-party cookies, Google dropped the plan in July 2024, said in April 2025 that it would not introduce a user-facing prompt either, and in October 2025 retired most of the Privacy Sandbox APIs it had built as replacements, citing low adoption. Chrome still supports third-party cookies, but their legal status under privacy law has not changed.
This browser split is pushing the advertising industry towards first-party data. Meta's Conversions API, Google's server-side tagging and LinkedIn's Conversions API all route tracking data through the website's own server rather than relying on browser-set cookies. These cookieless advertising methods still process personal data and still need a lawful basis under the GDPR: the legal obligation follows the data, not the technology.
The EU's Digital Omnibus proposal
In November 2025, the European Commission published the Digital Omnibus proposal, which would bring cookie consent rules under the GDPR through a new Article 88a, taking over the ePrivacy Directive's role. The proposal also included an Article 88b on machine-readable browser signals for consent preferences. As of October 2026, nothing in it applies yet: the Council's compromise text of 18 June 2026 dropped Article 88b, and the European Parliament has not adopted its position. Under the proposal, marketing cookies would still require consent.
How to handle marketing cookies on your website
Handling marketing cookies properly takes both technical and legal steps. It starts with knowing exactly which marketing cookies your site sets.
Audit your cookies
Run a cookie scan to find every cookie and tracking pixel active on your site. Pay attention to third-party scripts loaded through tag managers, embedded social widgets and video players. Many sites set marketing cookies through a YouTube embed or a Facebook Like button without knowing it.
Block before consent
Marketing cookie scripts must not run until the visitor actively opts in. A consent banner that shows while scripts are already firing in the background is exactly the behaviour that earned SHEIN its 150-million-euro fine. Your consent management platform should block marketing scripts by default and release them only after the visitor grants consent for that category.
Provide granular choice
Visitors must be able to accept or reject marketing cookies independently of analytics or functional categories. A prominent "Accept all" button paired with a barely visible "Reject" link is a dark pattern that regulators penalise. Both options should have equal visual prominence.
Keep consent records
Under Article 7(1) of the GDPR, the controller must be able to demonstrate that the visitor consented. You need timestamped records showing when each visitor consented, what information they were shown and which categories they accepted. Keep them for as long as you rely on the consent, plus the period in which a complaint or claim could still be brought where you operate.
Respect withdrawal
Withdrawing consent must be as easy as giving it. When a visitor changes their mind, marketing cookies must stop being set and existing ones should be deleted where technically possible.
Marketing cookies compared with analytics cookies
Both marketing and analytics cookies track visitor behaviour, but their purposes differ. Analytics cookies like _ga (set by Google Analytics) measure traffic patterns: page views, session duration, engagement. Marketing cookies like _fbp identify individual browsers so ads can be personalised across different websites.
The legal treatment is similar under the GDPR, since both need consent, but some regulators allow limited analytics exemptions. The CNIL, for example, exempts audience measurement tools such as a suitably configured Matomo from consent when they meet its conditions, and the UK has exempted first-party statistics since February 2026. No such exemption exists for marketing cookies.
Google Consent Mode v2 does not change that. When a visitor declines, Google's tags in the advanced setup send cookieless pings instead of setting cookies, and Google uses those pings to model conversions it cannot observe. That keeps some measurement without individual-level tracking, but it does not remove the consent requirement for the underlying cookies.
Marketing cookies: short answers
Do marketing cookies require consent under GDPR?
Yes. Marketing cookies are non-essential under the ePrivacy Directive, and the GDPR sets the standard for the consent they need. They must be blocked until the visitor gives informed, category-specific consent. Pre-ticked checkboxes or implied consent through continued browsing are not valid.
What happens if my site sets marketing cookies before consent?
Setting marketing cookies before consent breaks the prior-consent rule in Article 5(3) of the ePrivacy Directive. In 2025, the CNIL fined SHEIN 150 million euros in part because advertising cookies loaded before visitors could interact with the consent banner. Other EU authorities have taken similar action.
Can I use legitimate interest instead of consent for marketing cookies?
No. Under the ePrivacy Directive, legitimate interest cannot replace consent for placing marketing or advertising cookies. Consent is the only basis for non-essential cookies that track visitors for advertising.
Are first-party marketing cookies treated differently from third-party ones?
Not from a legal perspective. Whether a marketing cookie is set on your domain or by a third-party advertising network, the consent requirement is the same. The shift from third-party to first-party cookies, as with the Meta Pixel and Google Ads, does not change the obligation to obtain prior consent.
How do marketing cookies differ from analytics cookies?
Analytics cookies like _ga measure site traffic: page views, session counts, referral sources. Marketing cookies like _fbp or _gcl_au identify individual browsers to build advertising profiles and enable retargeting across websites. Both need consent under EU law, though some regulators exempt limited analytics.
Does blocking marketing cookies break my ad tracking?
If a visitor declines marketing cookies, tracking pixels from Meta, Google Ads and other platforms will not fire for that visitor. Google Consent Mode v2 can send cookieless pings that Google uses to model conversions, but individual-level attribution is lost. Server-side APIs like Meta's Conversions API still need a lawful basis for processing.
How long should I keep cookie consent records?
The GDPR does not set a fixed retention period for consent records. Keep them for as long as you rely on the consent, plus the period in which a complaint or claim could be brought in your country. Records should include a timestamp, the consent text shown, the categories accepted or rejected and an identifier for the consent event.
Find the marketing cookies on your site
If you run advertising campaigns, social media pixels or retargeting scripts, your website almost certainly sets marketing cookies. Kukie.io scans your site, sorts the cookies it finds into categories and blocks known advertising scripts until your visitors give clear consent.
