> What are strictly necessary cookies? The legal test, real examples of essential cookies, what does not qualify and how to check your own cookie list. > > Canonical: https://www.flowconsent.com/en/blog/strictly-necessary-cookies-examples [Best practices](https://www.flowconsent.com/en/blog?category=practices) # Strictly necessary cookies: what qualifies, with examples By Roland Vekemans · Published 14 October 2026 · 7 min read In short Strictly necessary cookies (also called essential cookies) are the cookies a website cannot do without to deliver a service the visitor explicitly asked for: keeping a login, holding a shopping cart, securing a form, remembering the cookie choice itself. They are the only cookies exempt from consent under the ePrivacy Directive. The test is narrow: "useful to the business" is not "strictly necessary", so analytics, advertising and A/B testing cookies stay outside the exemption. Essential cookies need no consent, but visitors should still be told about them. Almost every cookie banner has a toggle labelled "strictly necessary" that is switched on and greyed out. That category is where many compliance problems hide: a site puts a cookie there, the banner never asks, and nobody checks whether the cookie really qualifies. This guide explains what the exemption covers, which cookies pass the test, which do not, and how to verify your own list. For the basics of how cookies work and the main types, start with our guide to [what cookies are and how they work](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work). ## What are strictly necessary cookies? The legal definition comes from Article 5(3) of the [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive). Storing information on a visitor's device, or reading it, requires consent. Two exceptions exist: 1. **Transmission exemption:** storage or access whose sole purpose is to carry out the transmission of a communication over a network. 2. **Strictly necessary exemption:** storage or access that is strictly necessary for the provider of an online service explicitly requested by the user to deliver that service. Almost every essential cookie on a website falls under the second exception. The words matter: the service must be **explicitly requested** by the visitor (a page, a checkout, an account area), and the cookie must be **strictly necessary** to provide it, not merely helpful. The rule is not limited to cookies. The EDPB guidelines on the technical scope of Article 5(3) confirm that it covers local storage, session storage, pixels and other techniques that store or read information on a device. A `localStorage` entry that remembers a cart follows the same logic as a cart cookie. Each country transposes the rule in its own law: the UK has PECR, Germany § 25 TDDDG, France article 82 of the Loi Informatique et Libertés, Spain article 22.2 of the LSSI. The wording differs slightly, but the test is the same everywhere in the EU. ## How to tell if a cookie is strictly necessary The Article 29 Working Party (the predecessor of the EDPB) set out the reasoning in its Opinion 04/2012 on cookie consent exemption. It still guides regulators today. Ask three questions about each cookie: 1. **Does the visitor explicitly request the service the cookie supports?** Viewing pages, logging in, adding a product to a cart or submitting a form are requests. Being measured, profiled or shown ads is not. 2. **Would that service break without the cookie?** If the site still delivers what the visitor asked for, even less comfortably, the cookie is not strictly necessary. 3. **Is the cookie limited to that purpose and that duration?** A cookie that serves one essential purpose and one non-essential purpose loses the exemption as a whole. Its lifespan should match the need: often the session, sometimes a few hours. A cookie must pass all three. The CNIL and the ICO both insist on the same point: a cookie can be important to your business and still not be strictly necessary for the visitor. That distinction is the reason why the four usual [cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) exist, and why only the first one is exempt. ## Strictly necessary cookies examples ### Examples regulators accept The WP29 opinion and the CNIL guidelines describe the same family of uses: - **Authentication cookies** that keep a visitor logged in during a session, including those that secure the login mechanism (limiting repeated or automated login attempts). - **User-input cookies** that remember what the visitor typed or chose during the visit: a shopping cart, a multi-step form, a checkout. - **Security cookies** that protect a service the visitor uses, such as CSRF tokens on forms. - **Load-balancing cookies** that keep a visitor on the same server during a session. - **The consent cookie**, which stores the visitor's choice on the banner. Without it, the banner could not respect a refusal. - **Interface customisation cookies** (language, display) when the customisation is an intrinsic and expected part of the service, for example a language the visitor chose from a selector. - **Media player session cookies** that are needed to play a video the visitor started, without tracking. ### Cookie names you will often see - `PHPSESSID`, `JSESSIONID`, `ASP.NET_SessionId`: server session identifiers in PHP, Java and .NET. - `csrftoken`, `XSRF-TOKEN`: form protection in Django, Laravel and Angular apps. - `wordpress_logged_in_*`: WordPress login for logged-in users. - `woocommerce_cart_hash`, `cart` (Shopify): cart contents in online shops. - `AWSALB`: load balancing on Amazon Web Services. - `__cf_bm`: short-lived bot protection set by Cloudflare. A name alone proves nothing. A session cookie used to identify a visitor across sites would not qualify, even with a harmless name. What counts is what the cookie does on your site. ## Which cookies are not strictly necessary? These are the cookies most often wrongly placed in the essential category: - **Analytics cookies** (`_ga`, `_gid`, Hotjar, Clarity). Statistics help you run the site but do not deliver anything the visitor asked for. In France, the CNIL allows a narrow exemption for audience measurement configured under strict conditions, which tools like [Matomo can meet in exempt mode](https://www.flowconsent.com/en/blog/matomo-cookies-gdpr-do-you-need-banner). Standard Google Analytics does not. - **Advertising and retargeting cookies** (Meta Pixel, Google Ads, LinkedIn Insight). Never strictly necessary. - **A/B testing and personalisation cookies**. The visitor did not ask to be put in a test group. - **Social media plugin cookies** that track visitors who never clicked the plugin. - **Chat widgets loaded on every page** before the visitor opens the chat. The chat may become necessary once the visitor starts a conversation, not before. - **Preference cookies that are only convenient**, such as remembering a dismissed newsletter popup. A quick way to find out what your site actually sets: check in 30 seconds which cookies your site drops with the [free cookie scanner](https://www.flowconsent.com/en/scan), then compare the result with the list your banner shows as essential. ## Do essential cookies require consent? No. Strictly necessary cookies can be set as soon as the page loads, before any interaction with the banner, and the visitor cannot refuse them. That is why most banners show the category as always on. No consent does not mean no obligation: - **Information is still expected.** List each essential cookie in your [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) with its purpose, provider and duration. Regulators such as the CNIL recommend it, and the GDPR transparency rules require it as soon as personal data is involved. - **The GDPR still applies** when the cookie relates to personal data, such as a session ID tied to an account. You need a legal basis (usually contract or legitimate interest), a privacy notice and security measures. - **No hidden extras.** If an essential cookie is also used for analytics or advertising, it needs consent for the whole. The UK is a special case. The Data (Use and Access) Act 2025 amends PECR and adds new exemptions, for example for some statistical and appearance cookies, under conditions such as clear information and a simple way to object. Check the current status in our [UK GDPR and PECR guide](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) before relying on it. In the EU, the exemption remains limited to strictly necessary cookies. ## Is it okay to accept essential cookies? From a visitor's point of view, yes. Essential cookies are what make the login, the cart or the form work, and a site that respects the rules uses them for nothing else. You are not really "accepting" them: they are set whatever you choose. When a banner offers "only necessary cookies" or "reject all", choosing it means the site may keep its essential cookies but must not set analytics, advertising or other optional cookies. If you still find `_ga` or a Meta cookie in your browser after that choice, the site is breaking the rules, not you. ## How long can a strictly necessary cookie last? There is no single legal maximum for essential cookies, but the duration must be proportionate to the purpose. Authentication and cart cookies are often [session cookies](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) that disappear when the browser closes. A "remember me" login cookie or the consent cookie can last longer, because their purpose requires it. A cookie labelled essential that lives for two years with a unique identifier should raise a question: what service does it provide that a shorter cookie could not? ## How to check which of your cookies are strictly necessary 1. **Scan your site with a fresh browser** and list every cookie and storage entry set before any click on the banner. 2. **Identify each one:** name, domain, provider, duration and what it does. Vendor documentation usually tells you. 3. **Apply the three-question test** above, cookie by cookie. 4. **Move anything that fails** to the right category (analytics, marketing or preferences), so it is blocked until consent. 5. **Scan again after a refusal** to prove that only essential cookies remain. Consent management platforms automate part of this work. FlowConsent, for example, sorts each detected service into a category with a documented legal basis, so a service like Google Analytics cannot end up in the essential category by accident. ## How FlowConsent handles strictly necessary cookies FlowConsent keeps essential cookies active from the first page load and blocks every other category until the visitor gives consent. The automatic cookie scan detects the services your site loads and maps them to a maintained catalog, where each service carries its category and its plausible legal basis: consent, contract, legitimate interest or a possible CNIL exemption. Essential cookies then appear in the generated cookie declaration with their purpose and duration, which covers the information duty. After a refusal, the compliance scan shows which cookies remain, so you can prove that only strictly necessary ones are left. Setup takes about ten minutes, and FlowConsent is free up to 25,000 sessions per month. See [how services, categories and legal bases work](https://www.flowconsent.com/en/doc/services-and-legal-basis). [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fstrictly-necessary-cookies-examples) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fstrictly-necessary-cookies-examples) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies are strictly necessary? Cookies without which a service the visitor explicitly asked for cannot work: login and session cookies, shopping cart cookies, security tokens on forms, load-balancing cookies and the cookie that stores the visitor's consent choice. Interface cookies such as a chosen language can also qualify when they are an expected part of the service. Analytics, advertising and A/B testing cookies never qualify as strictly necessary under the ePrivacy Directive. ### What does "only necessary cookies" mean? It is the option on a cookie banner that refuses every optional category. The site may keep the cookies it needs to work, such as the session, the cart and the consent cookie itself, but it must not set analytics, advertising, social media or personalisation cookies. If such cookies still appear in your browser after you chose this option, the site is not respecting your refusal. ### Is it okay to accept essential cookies? Yes. Essential cookies are what make the login, the cart or a form work, and a compliant site uses them for nothing else. You cannot really refuse them: they are set whatever you choose on the banner, which is why the category is shown as always active. The choice that matters is the one about optional cookies such as analytics and advertising. ### Do strictly necessary cookies need to be listed in a cookie policy? They do not need consent, but they should be listed. Regulators such as the CNIL recommend informing visitors about them, and the GDPR transparency rules apply whenever the cookie relates to personal data, such as a session tied to a customer account. A good cookie policy gives each essential cookie's name, provider, purpose and duration, in the same way as for optional cookies. ### Are functional cookies strictly necessary? Usually not. Functional or preference cookies make a site more comfortable, for example by remembering a layout or a dismissed popup, but the site still works without them, so they need consent. The exception is a customisation that is an expected part of the service the visitor asked for, such as a language picked in a language selector. When in doubt, ask whether the requested service would break without the cookie. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Best practices · 16 October 2026](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) ### [Tracking cookies: what they are, examples and how to block them](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) [What tracking cookies are, how they follow you across visits and sites, common examples like \_ga and \_fbp, what the law requires and how to check or block them.](https://www.flowconsent.com/en/blog/what-are-tracking-cookies) [Read the article ](https://www.flowconsent.com/en/blog/what-are-tracking-cookies)· [Comparisons · 22 October 2026](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) ### [First-party vs third-party cookies: differences, examples and GDPR](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [What separates first-party and third-party cookies, real examples of each, how Safari, Firefox and Chrome treat them in 2026, and why consent depends on purpose rather than domain.](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [Read the article ](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)· [Best practices · 11 October 2026](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) ### [What is a session cookie? Definition, examples and consent rules](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) [What a session cookie is, how it works, how it differs from a persistent cookie, real examples, and when it needs consent under EU rules.](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) [Read the article](https://www.flowconsent.com/en/blog/what-is-a-session-cookie) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)