Understanding GDPR cookie categories is not a technicality — it determines your entire consent architecture. Use the wrong category and you are either collecting data illegally (no consent obtained for a non-necessary cookie) or creating unnecessary friction (requiring consent for a cookie that is genuinely exempt). Supervisory authorities across the EU have made it clear that cookie classification is a substantive legal question, not an administrative formality.
The Four GDPR Cookie Categories
Most consent management platforms (CMPs) and GDPR guidance documents converge on four standard categories, each with a distinct consent requirement.
| Category | Consent Required? | Examples | Legal Basis |
|---|---|---|---|
| Strictly Necessary | No | Session ID, CSRF token, load balancer cookie, shopping cart, Stripe payment session | ePrivacy Directive Art. 5(3) exemption |
| Functional | Yes (soft standard) | Language preference, dark mode setting, saved username, video player settings | Consent (Art. 6(1)(a) GDPR) |
| Analytics | Yes | Google Analytics, Hotjar, Matomo (with cookies), Microsoft Clarity, Heap | Consent (Art. 6(1)(a) GDPR) |
| Marketing / Advertising | Yes | Meta Pixel, Google Ads, LinkedIn Insight Tag, Criteo, TikTok Pixel, DoubleClick | Consent (Art. 6(1)(a) GDPR) |
Strictly Necessary Cookies
Strictly necessary cookies are those without which the user-requested service cannot be delivered. The operative phrase is "user-requested" — the service must be something the user has explicitly asked for, not something the website operator wants to provide.
What qualifies:
- Session authentication cookies (keeping a user logged in during a session)
- Shopping cart persistence cookies on an e-commerce site
- Security tokens: CSRF (Cross-Site Request Forgery) tokens, anti-bot cookies
- Load balancer affinity cookies that route traffic to the right server
- Cookies that store the user's own consent choice (so the banner does not re-appear)
- Stripe, PayPal, and other payment processor cookies during a checkout transaction
What does not qualify:
- Analytics that help you understand your users (beneficial to you, not necessary for the user)
- A "remember me" feature the user did not explicitly activate
- Fraud-prevention tools used site-wide rather than at the point of a specific transaction
- Google Fonts loaded via a Google CDN (set a cookie in some configurations — use self-hosting instead)
The ICO's guidance uses the test: "Would the website be unable to provide a service that the user has specifically requested if this cookie were not placed?" If yes, it is strictly necessary. If no, it requires consent.
Functional Cookies
Functional cookies (also called "preferences" cookies in some CMP frameworks) improve the user experience without being essential to core service delivery. They remember choices the user has made, but the site would still work without them — the user would just need to re-select their preferences each visit.
Examples:
- Language or region preference (e.g., remembering that a user selected "English (UK)" over "English (US)")
- Accessibility settings: font size, high-contrast mode, screen reader optimisations
- Video player volume and subtitle preferences
- Whether a user has dismissed a notification or promotional banner
Consent position: Functional cookies technically require consent under GDPR. The ePrivacy Directive exempts only strictly necessary cookies. However, the practical enforcement risk for functional cookies is lower than for analytics or marketing cookies, and some national guidance (notably from the Danish Datatilsynet) treats user-initiated preference cookies more leniently. The compliant approach is to include them as an opt-in toggle in your banner, pre-unchecked, and activate them only after consent.
Analytics Cookies
Analytics cookies measure how users interact with your website — pages visited, time on site, bounce rate, click paths, form abandonment, and similar behavioural metrics. Because they process behavioural data tied to a device or user, they require explicit prior consent.
Common analytics cookies and what they do:
- Google Analytics (GA4):
_ga,_ga_XXXXXXXX— tracks user sessions, page views, events, and conversion paths. Data transmitted to Google servers in the US. Consent required. - Hotjar:
_hjSessionUser_*,_hjSession_*— records screen sessions, heatmaps, and scrollmaps. Consent required. - Microsoft Clarity:
_clck,_clsk— session recordings and heatmaps. Consent required. - Matomo (self-hosted with cookies):
_pk_id.*,_pk_ses.*— analytics similar to GA4 but processed on your own server. Consent required for cookie-based tracking; consent may not be required if configured to use cookieless, anonymised tracking only. - Heap:
_hp2_*— auto-captures all user interactions. Consent required.
Why analytics require consent even if "anonymised": The CJEU and supervisory authorities have consistently held that IP addresses, device fingerprints, and persistent cookie IDs are personal data even when aggregated. The fact that you do not see individual names in your dashboard does not mean the underlying data collection is anonymous at the point of collection.
Marketing and Advertising Cookies
Marketing cookies are the highest-risk category from a GDPR enforcement perspective. They track users across websites, build profiles, and enable targeted advertising. They almost always involve data sharing with third parties (ad networks, data brokers, demand-side platforms), which compounds the consent obligation.
Common marketing cookies:
- Meta Pixel (
_fbp,_fbc): Tracks conversions and page views for Facebook and Instagram advertising. Sets a persistent cookie on your site that links the visitor's browser to their Facebook identity. Consent required. - Google Ads (
_gcl_au,IDE,test_cookie): Conversion tracking and remarketing. Consent required. - LinkedIn Insight Tag (
bcookie,lidc,li_gc): Tracks professional profile data for LinkedIn advertising audiences. Consent required. - TikTok Pixel (
_ttp): Tracks conversions for TikTok ads. Consent required. - Criteo (
uid,accs): Retargeting network cookie that tracks users across thousands of sites to serve behavioural ads. Consent required. - DoubleClick / Google Campaign Manager (
IDE): Cross-site advertising profile cookie managed by Google's ad infrastructure. Consent required.
Marketing cookies must not fire until the user has explicitly accepted the marketing category in your banner. Loading the Meta Pixel script before consent — even via Google Tag Manager — constitutes unauthorised processing of personal data.
Why Category Boundaries Matter Legally
The distinction between categories is not semantic. Your cookie banner must present separate opt-in controls for each non-necessary category. A user who accepts analytics should be able to reject marketing without losing analytics functionality, and vice versa. Bundling categories into a single "Accept" toggle violates the "specific" requirement of GDPR consent (Article 7, Recital 32).
The EDPB's guidelines on consent make this explicit: where processing involves multiple purposes, separate consent must be obtained for each. Consent Management Platforms that present a single "Accept Non-Essential Cookies" toggle without granular controls fail this requirement.
The miscategorisation problem in practice: DPA audits frequently find:
- Marketing cookies (especially Meta Pixel) listed as "functional" — removing the consent requirement unlawfully
- Analytics cookies classified as "strictly necessary" on the basis that the business "needs" the data — this confuses the operator's needs with the user's needs
- Third-party social embed cookies (YouTube, Twitter) not categorised at all — appearing to load without consent
- Affiliate tracking cookies omitted from the cookie register entirely
Each of these represents a material compliance failure. In the event of a complaint or audit, a documented cookie register that correctly classifies each cookie — with reasoning — is the primary evidence you will need to defend your approach.
Your Cookie Classification Checklist
Before configuring your consent banner, work through each cookie on your site:
- List every cookie set by your site and its third-party scripts (use a cookie scanner or browser developer tools)
- Identify the setting party — is it your server, or a third-party script you load?
- Determine the purpose — what does this cookie actually do?
- Apply the strictly necessary test — would the user-requested service fail without it?
- Assign to the correct category — strictly necessary, functional, analytics, or marketing
- Document your reasoning — keep a cookie register showing category assignment and justification
- Configure your CMP to block non-necessary cookies until the appropriate consent category is accepted
Use our free Cookie Consent Banner Generator to build a compliant consent banner that maps your cookie categories to correctly structured opt-in controls — with the reject option as prominent as accept, and all non-necessary categories off by default.