What counts as a strictly necessary cookie?

A strictly necessary cookie is one without which your website cannot provide a service the user explicitly asked for, such as keeping them logged in, holding items in a shopping cart, or remembering their cookie choices. Under EU rules, these cookies are exempt from consent. Cookies that mainly serve your business, such as analytics, advertising or A/B testing, generally are not.

What does the law actually say?

The exemption comes from Article 5(3) of the ePrivacy Directive. Storing or accessing information on a user’s device requires consent, except when it is used only to transmit a communication over a network, or when it is strictly necessary to provide a service the user explicitly requested.

Two phrases do most of the work:

• “Strictly necessary” sets a high bar. Useful, efficient or commercially important is not enough. The service must fail, or be impossible to provide, without the cookie.
• “Explicitly requested” means the service is judged from the visitor’s perspective. A visitor requests a page, a login or a checkout. They do not request audience measurement or ad targeting.

The UK’s PECR contains an equivalent exemption, enforced by the ICO. EU member states implement the directive through national laws, so wording and regulator guidance vary slightly between countries. For the categories that surround this one, see types of cookies.

How do I test whether a cookie is strictly necessary?

Ask whether the user’s requested service would break without the cookie, and whether the cookie does anything else. Work through these questions for each one:

1. What service did the user request? Name it concretely: viewing the page, logging in, completing checkout.
2. Would that service fail without this cookie? If the honest answer is “it would work, but we would lose insight,” the cookie is not strictly necessary.
3. Is the cookie used only for that purpose? If the same identifier also feeds analytics or advertising, the exemption does not cover those uses.
4. Is its lifespan proportionate? A session or short-lived cookie is easier to justify than one that lasts for years.
5. Does anyone else reuse the data? If a vendor uses the information for its own purposes, such as building profiles, the exemption is unlikely to hold.

A cookie that passes all five is a strong candidate for the necessary category. If it fails any one, treat it as requiring consent.

Which cookies usually qualify?

Most strictly necessary cookies relate to sessions, security and remembering choices the user made. The table shows common cases, but always apply the test to your own configuration.

Use case	Usually strictly necessary?	Notes
Login and session management	Yes	For areas the user chose to sign in to
Shopping cart	Yes	Holds items the user added
Load balancing	Yes	Routes requests during the session
Security, such as CSRF tokens or login fraud checks	Generally yes	When tied to the service being requested
Storing the user’s consent choice	Yes	Needed to respect that choice
Language or accessibility settings the user selected	Often	When set by an explicit user action and kept for a reasonable time
Analytics and audience measurement	Generally no	See the section on analytics below
A/B testing and personalization	Generally no	Serves your optimization, not the user’s request
Advertising, retargeting and conversion tracking	No	Needs consent in the EU
Social media embeds that track visitors	No	Load them only after consent

What mistakes turn “necessary” into a violation?

The most common problem is putting non-essential cookies in the necessary category so they load before consent. Regulators look for exactly this when they review banners and cookie lists.

Watch out for these patterns:

• Business-necessity reasoning. “We need analytics to run the business” may be true, but the exemption is about the service the user requested, not your operating needs.
• Trusting vendor labels. A vendor describing its cookie as “essential” is a product description, not a legal assessment. Check what the cookie actually does.
• Multi-purpose cookies. A single identifier used for both session handling and ad attribution needs consent for the advertising use. Split the functions into separate cookies where you can.
• Tags riding along with necessary scripts. A tag manager container may load before consent, but the tags inside it must still wait for the visitor’s choice.
• Confusing the exemption with legitimate interest. GDPR’s legitimate interest basis does not replace the ePrivacy consent requirement for storing information on a device. We cover this in can you rely on legitimate interest for cookies?

Do strictly necessary cookies still need to be disclosed?

Yes, in practice. The exemption removes the need for consent, but if the cookie processes personal data, GDPR’s transparency obligations still apply, and regulators expect to see necessary cookies listed alongside the rest.

That means three things. List each necessary cookie in your cookie policy with its purpose and duration, as described in how to write a cookie policy. Show the necessary category in your banner settings as “always active” instead of as a toggle. And review the list whenever you add a vendor, because a cookie that is exempt today can lose that status if its use changes.

Are there any exceptions for analytics?

Generally, no. Under the ePrivacy Directive, analytics cookies need consent in most EU countries. A few national regulators have described narrow conditions under which basic, first-party audience measurement may be exempt, typically requiring a strictly limited purpose, no cross-site tracking and aggregated output.

These positions are national, not EU-wide, and their conditions are strict. The UK has also moved to relax consent rules for some low-risk uses, including certain analytics, but how that applies depends on the legislation and ICO guidance, so check the current position before relying on it. If you want measurement that depends less on consent, cookieless analytics is worth evaluating, although it does not automatically fall outside the rules either.

Bottom line

Strictly necessary is a narrow category: cookies that the user’s requested service cannot work without, used for nothing else, with proportionate lifespans. Test every cookie against that standard, keep everything else behind consent, and disclose the necessary ones anyway. Tools like Cookiesh can automate cookie scanning, which makes it easier to catch new cookies before they land in the wrong category.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.