Strictly necessary cookies, also called essential cookies, are cookies and similar storage items that a website or app needs in order to deliver a service the user has explicitly requested or to carry a communication over a network. In the field of cookies & consent, they form the one category that may be stored on a device without prior consent, because the ePrivacy Directive exempts storage that is technically required for that purpose.
The category is defined by purpose, not by technology. The same session identifier can be strictly necessary when it keeps a shopping cart alive and consent-dependent when it also feeds analytics. Correct classification is therefore a legal and engineering judgment, and it is one of the most frequent points of failure in privacy audits.
The legal basis for the consent exemption
The exemption comes from Article 5(3) of the ePrivacy Directive, which requires consent for storing or reading information on a user’s terminal equipment, with two exceptions. The first covers storage used solely to carry out the transmission of a communication. The second covers storage that is strictly necessary for a service explicitly requested by the subscriber or user. Each EU member state implements this rule in national law, so wording and enforcement differ slightly from country to country.
European data protection authorities interpret the second exception narrowly. A cookie qualifies only if the requested function would not work without it; convenience, business value or a general interest in security is not enough on its own. Under the GDPR, the operator still needs a lawful basis for any personal data the cookie processes and must disclose the cookie in its cookie policy, even though no consent is collected.
The following table separates the two exemption routes and what each one realistically covers.
| Exemption route | What it covers | Typical examples |
|---|---|---|
| Communication exemption | Storage needed to transmit data over a network | Load-balancer affinity, request routing tokens |
| Service exemption | Storage needed for a function the user explicitly asked for | Login session, shopping cart, consent record |
| Neither route | Storage serving the operator’s own interests | Analytics, advertising, A/B testing |
Typical strictly necessary cookies
Most legitimate essential cookies fall into a small number of recurring functions. Each one is tied to an action the user takes, such as signing in, adding a product to a cart or submitting a form, and its lifetime should match that function rather than a marketing horizon.
| Function | Purpose | Typical lifetime |
|---|---|---|
| Authentication session | Keeps a signed-in user recognized between pages | Session or hours |
| Shopping cart | Remembers selected items before checkout | Session to a few days |
| CSRF token | Protects form submissions against forged requests | Session |
| Load balancing | Routes a user to the same server for a session | Session or minutes |
| Consent record | Stores the user’s cookie choices | Six to twelve months |
| Fraud prevention at login | Detects abuse of an authentication service | Session to weeks |
The consent record is a notable case: the cookie that stores a user’s choice is itself treated as strictly necessary, because a consent management platform cannot honor a refusal without remembering it. Security cookies are accepted when they protect a service the user requested, such as a login flow, but not when they secure the operator’s general infrastructure for unrelated purposes.
How essential cookies differ from other categories
Consent banners usually group cookies into four or five categories, and only one of them is exempt. The comparison below shows why preference, analytics and marketing cookies normally require an opt-in in Europe, even when they feel harmless to the operator.
| Category | Consent needed in the EU | Reasoning |
|---|---|---|
| Strictly necessary | No | Requested service cannot work without it |
| Preference | Usually yes | Improves comfort, such as language memory, but is optional |
| Analytics | Yes in most member states | Serves the operator, not the requested service |
| Marketing | Yes | Tracks users for advertising, often through third-party cookies |
Some regulators, notably in France, allow narrowly configured audience measurement without consent when it is first-party, aggregated and strictly limited. That is a separate national exemption, not part of the strictly necessary category, and it does not transfer automatically to other countries. Whether a cookie is a session cookie or a persistent cookie also does not decide its category; duration matters only as evidence of purpose.
Classifying cookies correctly
Reliable classification starts with a cookie inventory: a scan of every cookie, local storage key and tracking pixel the site sets, including those loaded by tags and embedded widgets. Each item is then mapped to the user-facing function that needs it. If no requested function can be named, the item is not strictly necessary.
- Ask whether the feature the user requested would break if the cookie were removed.
- Check that the data the cookie carries is limited to that function and not shared with third parties.
- Set an expiry proportionate to the function, not a default of one or two years.
- Separate multi-purpose cookies into distinct cookies so the essential part can run without consent.
- Repeat the scan after every release or tag change, because new scripts appear silently.
Splitting multi-purpose identifiers is often the decisive engineering step. A platform cookie that both maintains the session and identifies the visitor to an analytics vendor must be divided or disabled until consent, otherwise the whole cookie falls outside the exemption.
Common misclassification mistakes
Regulatory decisions and audits keep finding the same errors. Most stem from treating the strictly necessary label as a convenient default rather than a narrow exception that the operator must be able to justify.
| Mistake | Why it fails | Correction |
|---|---|---|
| Analytics labeled essential | Measurement serves the operator | Move to analytics and gate behind consent |
| Ad fraud cookies as essential | Protects revenue, not a requested service | Treat as marketing or advertising |
| Two-year expiry on a cart cookie | Lifetime exceeds the function | Shorten to session or days |
| Undisclosed essential cookies | Transparency duties still apply | List them in the cookie policy |
| Toggle shown for essential cookies | Misleads users about real choice | Show as always active, without a switch |
A related pitfall is a cookie wall justified by the claim that consent itself is necessary for access. Making a service conditional on accepting non-essential tracking is a separate legal question, and it does not turn tracking cookies into essential ones.
Stripped to the essentials
Some small files are simply part of how a website works. When you sign in, the site needs to remember that it is you as you move from page to page. When you put shoes in a cart, the site needs to remember the shoes. These files are strictly necessary cookies, and the law lets websites use them without asking first.
Everything else, such as counting visitors or showing targeted ads, is extra. It is like a hotel key card: the hotel does not need your permission to give you a key, because you cannot reach your room without it, but it does need permission to follow you around town. Only the key card counts as essential.
Where it is applied
An online bookstore serving customers across the EU prepares a privacy audit before relaunching its site. A cookie scan finds 27 cookies and storage keys. The team maps each one to a function and concludes that only six are strictly necessary: the session cookie, a CSRF token, the cart identifier, a load-balancer affinity cookie, a login abuse-detection cookie and the consent record.
The scan also reveals that the cart cookie had a two-year expiry and carried a visitor identifier that the analytics script reused. The developers split it into a short-lived cart cookie and a separate analytics cookie that now loads only after opt-in. The consent banner lists the six essential cookies as always active without a toggle, and every other category stays off until the visitor chooses. The relaunched site keeps checkout fully functional for visitors who press reject all, which was the outcome the audit set out to prove.