> Cookie categories explained: strictly necessary, functional, analytics and marketing. Which GDPR cookie consent categories need consent, with real examples.
>
> Canonical: https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide

[Regulation](https://www.flowconsent.com/en/blog?category=regulation)

# Cookie categories under GDPR: the 4 cookie consent categories explained

Published 26 March 2026 · Updated 9 October 2026 · 6 min read

In short

Strictly necessary, functional, analytics, marketing cookies: which categories require consent? GDPR guide with practical examples.

## TL;DR

The GDPR and the ePrivacy Directive classify cookies into four categories based on their purpose: strictly necessary, functional, analytics (performance), and marketing (advertising). Only strictly necessary cookies are exempt from consent. All other categories require prior, freely given, and informed consent before being placed on the user's device. Understanding this classification is essential for properly configuring your cookie banner and CMP.

## The four cookie categories under the GDPR

European regulations do not define cookie categories rigidly, but market practice and guidance from the CNIL, ICO, and major CMPs have converged on four main families. These categories structure the cookie banner and determine which cookies require consent.

The fundamental distinction is this: a cookie is either strictly necessary for the website to function (and therefore exempt from consent), or it is not (and therefore requires prior consent). Functional, analytics, and marketing cookies all fall into the second category.

## Strictly necessary cookies (essential)

A strictly necessary cookie is one without which the website cannot function properly. It is set in response to a user action (logging in, adding items to a cart, selecting a language) and serves only that specific purpose.

These cookies do not require user consent under the ePrivacy Directive. They are exempt because their purpose is strictly limited to providing the service requested by the user.

Common examples: session authentication cookies, shopping cart cookies, security cookies (CSRF tokens), load balancing cookies, and cookies that store the user's consent choice (the CMP cookie itself).

An important point: the fact that a cookie is "useful" or "important" to the website is not enough to make it strictly necessary. The CNIL and ICO emphasize this distinction. An analytics cookie, even if it is essential for the site's business objectives, is not strictly necessary for the service requested by the user.

## Functional cookies (preferences)

A functional cookie stores information already provided by the user to personalize their experience: display theme (dark/light mode), selected region, login credentials remembered between sessions, video player settings, live chat history.

These cookies are not strictly necessary for the website to function. The site works without them, but the experience is degraded. Under the GDPR and the ePrivacy Directive, functional cookies require user consent before being set.

The boundary between "strictly necessary" and "functional" is sometimes blurry. A simple rule: if the site can deliver the requested service without this cookie (even less comfortably), then the cookie is functional, not strictly necessary.

## Analytics cookies (performance / statistics)

An analytics (or performance) cookie collects data on how visitors use the site: pages viewed, visit duration, bounce rate, traffic sources, error messages. This data is aggregated and used to improve the site's performance and content.

The most common example is Google Analytics (cookies `_ga`, `_gid`). Other tools like Matomo, Plausible, Piano Analytics, and Adobe Analytics also use analytics cookies.

For the purpose and lifetime of each of these cookies, see our explainer on [the \_ga, \_gid and \_gat cookies](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr).

By default, analytics cookies require user consent. The CNIL provides an exception for audience measurement tools configured in a strictly necessary manner: purpose limited to audience measurement for the publisher only, anonymous statistical data only, no cross-referencing with other processing, no sharing with third parties. [Google Analytics does not qualify for this exemption](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) in its standard configuration.

Matomo is the best-known example of a tool that can meet these criteria: see [how to configure Matomo for the CNIL exemption](https://www.flowconsent.com/en/blog/matomo-cookies-gdpr-do-you-need-banner).

## Marketing cookies (advertising / targeting)

A marketing (or advertising, or targeting) cookie tracks the user's browsing activity to display personalized advertising. These cookies build a user profile based on interests, purchases, and searches, and share this information with advertising networks.

Common examples: Facebook Pixel, Google Ads (remarketing cookies), DoubleClick, retargeting cookies, social media sharing button cookies, affiliate platform cookies.

Our guide to [Meta Pixel cookies and GDPR compliance](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance) shows what this means in practice for one of the most widespread marketing trackers.

Marketing cookies always require prior user consent. There are no exceptions. They are often third-party cookies (set by a domain different from the visited site), which makes them particularly sensitive for compliance.

## Which consent for which category?

Strictly necessary cookies do not require consent, but informing the user remains mandatory. Functional cookies require prior consent. Analytics cookies require prior consent, except under the CNIL exemption for certain tools configured in "strictly necessary" mode. Marketing cookies always require prior consent. To transmit these consent signals to Google services, you need to implement [Google Consent Mode V2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide).

Consent must be freely given (no [cookie wall](https://www.flowconsent.com/en/blog/cookie-wall-legal-alternatives) except under strict conditions), specific (per category, not blanket consent), informed (the user knows what they are accepting), and unambiguous (a positive action, no pre-checked boxes). The user must be able to refuse as easily as to accept, and withdraw consent at any time.

Banners that make refusal harder than acceptance fall into the [cookie dark patterns the CNIL prohibits](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited).

## How to configure your CMP by category

A consent management platform (CMP) like FlowConsent presents cookie categories in the [cookie banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) and allows the user to give or refuse consent per category.

The standard configuration includes four tiers. The first tier (always active, cannot be disabled) contains strictly necessary cookies. The second tier (disabled by default, consent required) contains functional cookies. The third tier (disabled by default, consent required) contains analytics cookies. The fourth tier (disabled by default, consent required) contains marketing cookies.

Each category should include a clear description of its purpose and, ideally, a list of associated cookies with their lifespan and provider. The [FlowConsent cookie scanner](https://www.flowconsent.com/en/scan) automatically identifies cookies on your site and classifies them by category.

In FlowConsent, this list is generated automatically from your active services, as described in our documentation on the [cookie declaration](https://www.flowconsent.com/en/doc/cookie-declaration).

## Common classification mistakes

**Classifying Google Analytics as "strictly necessary".** Google Analytics sets tracking cookies that are not essential for the site to function. Unless specifically configured and validated by the CNIL, these cookies belong to the analytics category and require consent.

**Forgetting third-party widget cookies.** Social sharing buttons, embedded video players ([YouTube](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr), Vimeo), Google Maps, and chat tools all set cookies. They must be classified in the appropriate category and blocked before consent.

**Treating functional cookies as "strictly necessary".** A cookie that remembers display theme or navigation preferences is functional, not strictly necessary. The site works without it.

**Not listing cookies by category in the cookie policy.** The [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) must detail each category with associated cookies, their purpose, lifespan, and provider.

**Pre-checking non-essential categories.** Consent must result from a positive action. Functional, analytics, and marketing categories must be disabled by default in the cookie banner.

## How to audit your site's cookies by category

A [cookie audit](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) starts with a full site scan to identify all cookies and trackers. Each cookie must then be classified into one of the four categories.

For each identified cookie, document its name, domain (first-party or third-party), lifespan, purpose, and the category it belongs to. If you cannot identify a cookie's purpose, treat it as a marketing cookie (most restrictive category) by default.

Check cookies set on all pages of the site, not just the homepage. Some pages contain widgets or iframes that set additional cookies (embedded YouTube videos, third-party forms, conversion pixels).

## Checklist: classifying and managing cookies by category

1. Scan the site to identify all active cookies and trackers.
2. Classify each cookie into one of four categories (strictly necessary, functional, analytics, marketing).
3. Configure the CMP to present categories separately in the cookie banner.
4. Keep strictly necessary cookies always active (cannot be disabled).
5. Disable functional, analytics, and marketing cookies by default.
6. Actually block scripts for non-consented categories (not just hide the banner).
7. Detail each category in the [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) with associated cookies.
8. Check if your analytics cookies qualify for the CNIL exemption (strict criteria).
9. Regularly audit the site to detect new cookies introduced by updates or new widgets.
10. Test refusing each category to verify that corresponding cookies are not set.

## Conclusion

Classifying cookies into four categories (strictly necessary, functional, analytics, marketing) is the foundation of GDPR cookie compliance. Only strictly necessary cookies are exempt from consent. All other categories must be blocked by default and activated only after explicit consent. For inspiration on how to present these categories to your users, see our [cookie consent banner examples](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices).

To identify and classify the cookies on your site, run a [free scan with FlowConsent](https://www.flowconsent.com/en/scan).

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-cookie-categories-guide) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-cookie-categories-guide)

Questions

## Common questions on this topic.

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Which cookie categories require consent under the GDPR?

All categories except strictly necessary cookies. Functional, analytics, and marketing cookies require prior, freely given, specific, and informed consent before being placed on the user's device.

### Is a language preference cookie strictly necessary or functional?

It depends on the site. If the site cannot display content without knowing the user's language (no default version), the language cookie is strictly necessary. If the site works with a default language and the cookie only remembers a preference, it is functional and requires consent.

### Is Google Analytics exempt from consent as an analytics cookie?

Not in its standard configuration. The CNIL provides an exemption for audience measurement tools configured in a strictly limited way (anonymous data, no sharing with third parties, no cross-referencing). Google Analytics in its default configuration does not meet these criteria.

### Do social sharing buttons set marketing cookies?

Yes. Facebook, LinkedIn, Twitter/X, and other social sharing buttons typically set third-party cookies that track the user's browsing activity for advertising purposes. These cookies belong to the marketing category and require consent.

### Can functional and analytics cookies be grouped into a single category?

It is technically possible but not recommended. The GDPR requires specific consent per purpose. Grouping categories with different purposes reduces the granularity of user choice and may be considered non-compliant by data protection authorities.

### How do I know if a cookie is strictly necessary or not?

Ask yourself: can the site deliver the service requested by the user without this cookie? If yes, the cookie is not strictly necessary. An analytics cookie, a personalization cookie, or an advertising cookie is never strictly necessary, even if it is important for your business.

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Regulation · 7 July 2026](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months)

### [Cookie retention under GDPR: the 13-month rule explained](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months)

[Cookie lifetime, consent validity and data retention are three different clocks. Here is how long each can last under GDPR and the CNIL rules, and how to configure them.](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months)

[Read the article ](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months)·

[Marketing tools · 1 July 2026](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr)

### [The \_ga, \_gid and \_gat cookies explained: purpose, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr)

[What the Google Analytics cookies \_ga, \_ga\_\<container-id>, \_gid and \_gat actually do, how long they last, why they need consent in the EU and how Consent Mode v2 changes their behaviour.](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr)

[Read the article ](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr)·

[Marketing tools · 29 June 2026](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

### [The \_fbp cookie (and \_fbc) explained: what it is, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

[What the Meta cookies \_fbp and \_fbc contain, how long they last, how they feed the Conversions API and why they must stay blocked until your visitors consent.](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

[Read the article](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)