Cookie categories

Visitors consent to purposes, not to individual cookies. Cookiesh groups every cookie, storage key and third-party script into one of four categories, and blocks or allows each category according to the visitor’s choice.

The four categories

Category	Consent needed	Examples
necessary	No, always on	Login sessions, shopping carts, load balancing, CSRF tokens, the consent cookie
preferences	Yes	Language, theme, recently viewed items
analytics	Yes	Traffic and product analytics, A/B testing, heatmaps
marketing	Yes	Advertising, retargeting, social media pixels and embeds

The category names are fixed, so your code and tag manager rules never break. You can change the label and description visitors see under Banners → Copy.

Keep necessary truly necessary. Regulators read the exemption narrowly: a cookie qualifies only if the service the visitor asked for cannot work without it. Analytics, even first-party analytics, is not strictly necessary under EU rules.

How scanning classifies cookies

The cookie scanner visits your pages on a schedule (monthly on Hobby, daily on Pro and Enterprise). It records every cookie, localStorage and sessionStorage key and third-party request, and matches each one against our database of more than 20,000 known trackers.

• Known items get their category, provider, purpose and lifetime filled in automatically.
• Unknown items appear under Cookies → Needs review. They are treated as marketing until you classify them, so nothing slips through unblocked.

You can override any classification under Cookies → All cookies. For cookies the scanner cannot reach, such as those set only after login, click Add cookie and declare them yourself. Everything you classify appears in the cookie declaration that visitors see in the preference center.

Blocking scripts

Cookiesh blocks known trackers automatically. To control your own scripts explicitly, change the script type to text/plain and add the category:

<script
  type="text/plain"
  data-cookiesh="analytics"
  src="https://analytics.example.com/script.js"
></script>

When the visitor allows that category, Cookiesh restores the original type and runs the script in its original order. If a script belongs to more than one category, list them all, separated by spaces. It then runs only when every category it lists is allowed:

<script type="text/plain" data-cookiesh="analytics marketing">
  initAttribution();
</script>

Blocking iframes and embeds

Embedded videos, maps and social posts often set cookies as soon as they load. Rename src to data-cookiesh-src and add a category:

<iframe
  data-cookiesh-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cookiesh="marketing"
  width="560"
  height="315"
  title="Product demo"
></iframe>

Until the visitor consents, Cookiesh shows a placeholder with a short explanation and an Allow and load button. That button allows the category only for embeds, not for the whole site.

What Cookiesh stores

Cookiesh stores the visitor’s choice in one first-party cookie, which is itself strictly necessary:

Name	Purpose	Lifetime
cookiesh_consent	Remembers the visitor’s choice, consent ID and banner version	6 months by default, configurable up to 13 months

The cookie contains no personal data beyond a random consent ID. When it expires, Cookiesh asks the visitor again. When a visitor withdraws consent for a category, Cookiesh deletes the first-party cookies it knows belong to that category. Third-party cookies on other domains can only be removed by the visitor’s browser.