Which cookies do not need consent? Where "strictly necessary" begins and ends

Almost every cookie banner has a category the visitor cannot switch off. It is usually labelled "strictly necessary", and whatever sits in it loads before anyone has clicked anything. What you put there decides how much of your site runs without consent.

The category has a legal definition, and it is narrower than most site owners assume. This article goes through that definition and applies it to the cookies a typical site uses: sessions and baskets, logins, security, load balancing, language settings, the consent cookie itself, embedded video and analytics.

The sources are Article 5(3) of the ePrivacy Directive, the Article 29 Working Party's Opinion 04/2012 on the cookie consent exemption, the guidance of the French authority CNIL and, for Turkey, the KVKK's Cookie Guidance.

The consent rule and its two exceptions

Article 5(3) of the ePrivacy Directive allows storing information on a user's device, or reading information already stored there, only if the user has consented after receiving clear and comprehensive information. The same sentence carries two exceptions. Consent is not needed for storage or access whose sole purpose is carrying out the transmission of a communication over an electronic communications network. Nor is it needed where storage or access is strictly necessary for the provider of an information society service explicitly requested by the user to provide that service.

The Working Party's opinion calls these Criterion A and Criterion B, and the KVKK guidance uses the same two criteria. EU member states have written the rule into national law: in France it is Article 82 of the Loi Informatique et Libertés, and in Germany Section 25 of the TDDDG contains the same two exceptions.

Necessary for whom?

Most cookies are argued in under Criterion B. The Working Party reads it as two tests that a cookie has to pass together. The user has taken a positive action to request a service with a clearly defined perimeter. And the service does not work when the cookie is disabled.

The opinion adds a guideline: what is strictly necessary is examined from the point of view of the user, not the service provider. It says this about analytics directly. Site operators often regard analytics as a strictly necessary tool, yet the user can still reach every function of the site with those cookies disabled.

Cookies that are typically exempt

The opinion treats these as exempt:

• Session cookies that keep track of what the visitor typed into a multi-page form or added to a shopping basket (Criterion B).
• Authentication cookies that recognise the visitor after login, for the duration of the session.
• Security cookies that protect the login, for example by detecting repeated failed attempts. The opinion expects these to live longer than a login cookie.
• Load-balancing session cookies that record which server in a pool handles the visitor's requests (Criterion A).
• The cookie that stores the visitor's consent choice. The CNIL lists it as exempt, and the KVKK guidance places it under Criterion B.

Persistent login is the exception inside this list. The opinion does not treat a cookie that keeps the visitor logged in across browser sessions as exempt, because the visitor may not realise that closing the browser did not end the session. A "remember me" checkbox next to the login form, with a short note that it uses cookies, is in the opinion's view an appropriate way to obtain consent for it. The KVKK guidance takes the same position.

Borderline cases: preferences and embedded video

Language and display preferences. The opinion exempts a cookie that remembers a choice the visitor made by clicking, such as a language flag, but only as a session or short-term cookie. The CNIL lists interface personalisation cookies as exempt where the personalisation is an intrinsic and expected part of the service.

Embedded video. The opinion exempts multimedia player session cookies that hold the technical data needed for playback (image quality, connection speed, buffering parameters) and requires that nothing else is added to them. It also notes that third-party cookies are usually not strictly necessary, because they relate to a service distinct from the one the visitor requested.

Analytics: regulators differ

The 2012 opinion says first-party analytics cookies fall under neither criterion. In the same passage it adds that they are not likely to create a privacy risk when they are strictly limited to first-party aggregated statistics, the site gives clear information, and safeguards such as an easy opt-out and anonymisation of IP addresses are in place.

The CNIL goes further for France. It treats audience measurement trackers as exempt if they are used for a purpose strictly limited to measuring the audience of the site, on the publisher's exclusive behalf, and produce anonymous statistical data only. The data must not be combined with other processing, non-anonymous data must not be passed to third parties, and the tracker must not follow the visitor across different sites or apps. The CNIL notes that some analytics products on the market fall outside the exemption because the provider reuses the data for its own purposes.

The KVKK guidance takes a similar line: first-party analytics cookies can be assessed under Criterion B when they only produce anonymous statistics and do not track people across sites.

In practice, whether an analytics cookie may run without consent depends on the country whose rules apply to you and on how the tool is configured. If either is unclear, making analytics consent-based may be the safer route.

What is not exempt

The opinion is plain about advertising. Third-party cookies used for behavioural advertising need consent, and so do the operational cookies around them, such as frequency capping, click fraud detection and market analysis. The KVKK guidance says the same. Social plug-ins are split: the opinion accepts the sharing cookie for a visitor who is logged in to the social network, while non-members and logged-out members have to be asked, and plug-in cookies used for tracking are exempt for no one.

Purpose and lifetime

According to the opinion, the purpose of a cookie decides whether it is exempt. If one cookie serves several purposes, it is exempt only if each purpose is exempt on its own. A cookie that remembers a preference and also tracks the visitor needs consent for the tracking. The opinion's advice is to use a separate cookie for each purpose.

Lifetime follows purpose as well. An exempt cookie should expire once it is no longer needed, taking into account what the average user would reasonably expect. The opinion expects most exempt cookies to end with the browser session or earlier.

Exempt cookies still have to be disclosed

The exemption covers consent only. The opinion states that its analysis is without prejudice to the right to be informed. Under the KVKK guidance the duty to inform applies whichever legal ground is relied on, and the guidance recommends that the privacy notice gives each cookie's name, purpose, lifetime and whether it is first or third party.

So strictly necessary cookies belong in your cookie policy, next to the others. For that you need to know which cookies your site sets before the visitor has chosen anything. Scanning your site shows that list.

Five common mistakes

• Putting analytics or advertising cookies in the "necessary" category because the business depends on them.
• Using a single cookie for both login and tracking.
• Giving an exempt cookie a lifetime measured in years when its purpose ends with the session.
• Assuming an embedded video player is exempt without checking which cookies it sets.
• Leaving strictly necessary cookies out of the cookie policy because they need no consent.

Checklist

• For every cookie in the necessary category, can you name the feature the visitor asked for?
• Does that feature stop working when the cookie is blocked?
• Does each of these cookies have a single purpose, and does it expire when that purpose ends?
• Is persistent login tied to a "remember me" choice?
• If analytics runs without consent, have you checked the conditions set by the authority in your country and the tool's configuration?
• Are the exempt cookies listed in your cookie policy with their purpose and lifetime?

The opinion ends with advice for unclear cases: if substantial doubts remain about whether an exemption applies, look at whether consent can be obtained in a simple, unobtrusive way. Which category a cookie goes into is your decision. DILAYS scans your site and shows the cookies and third-party services that load before consent; you can see how on the features page.