Almost every cookie banner has a category labelled necessary, essential or strictly necessary, switched on and greyed out. It is the one category visitors cannot refuse. That makes it tempting to put a lot in there, and it is one of the first places regulators and auditors look.
This guide explains what the strictly necessary exemption covers, what it does not, where UK and EU rules now differ, and how to sort your own cookie list. It is practical guidance, not legal advice.
Quick answer
A cookie is strictly necessary when the service the visitor asked for cannot work without it. Shopping baskets, login sessions, security, load balancing and the cookie that remembers a visitor's consent choice are the classic examples. Analytics, advertising, social media tracking and A/B testing are not strictly necessary, even if your business depends on them. The test is the visitor's point of view, not yours.
Strictly necessary cookies can be set without consent, but you still have to tell people about them.
Where the rule comes from
In the EU, the cookie rule sits in Article 5(3) of the ePrivacy Directive. Storing or reading information on a visitor's device needs consent unless it is for the sole purpose of carrying a communication, or it is strictly necessary to provide a service the user explicitly requested. EU regulators explained how to read that exemption in Opinion 04/2012 on the cookie consent exemption, which is still the reference most national authorities point to.
In the UK, the same idea lives in PECR. The Data (Use and Access) Act 2025 changed PECR, and the ICO finalised its guidance on storage and access technologies on 29 April 2026. The UK now lists five exceptions: communication, strictly necessary, statistical purposes, appearance and emergency assistance. The statistical purposes and appearance exceptions come with conditions, which we cover below.
Under both regimes, the strictly necessary exemption is narrow. Regulators read it strictly because it is the main route to setting cookies without asking.
The visitor's perspective test
The ICO puts it plainly: you assess strictly necessary from the point of view of the user, not your own. Its example is advertising. Ads may fund your website, so from your side they feel essential. From the visitor's side they are not part of the service they asked for, and the ICO says no advertising purpose meets the exception.
A simple way to apply this: imagine the visitor clicks Reject all. Would the thing they came to do still work? If the basket empties itself on every page, the basket cookie is necessary. If your analytics dashboard goes quiet but the visitor can still browse and buy, analytics is not.
Usually strictly necessary
These examples come from the ICO guidance and the EU opinion, and they cover most websites:
- Shopping basket and checkout cookies that remember the items a visitor has added.
- Login and session cookies that keep a signed-in user signed in while they move between pages.
- Security cookies tied to a service the user requested, such as protecting an online banking session or detecting repeated failed logins. PECR's own examples include security, fraud prevention, detecting technical faults and authenticating the user.
- Load-balancing cookies used only to route a visitor's requests to the right server. The ICO places these under the communication exception; either way, no consent is needed.
- The consent cookie itself. The ICO says a cookie that remembers a visitor's cookie choices over a period of time can be exempt, giving 90 days as an example, as long as it is used only for that purpose.
- Form cookies that hold what a user has typed across a multi-step form during a visit.
Notice the time limits running through these. The EU opinion says an exempt cookie's lifespan should match its purpose. A session cookie that keeps a basket alive for the visit is easy to defend. The same cookie set to last two years and carrying a persistent identifier is much harder to defend.
Usually not strictly necessary
- Analytics and audience measurement. Not strictly necessary under EU rules. In the UK, first-party statistics may now fall under the statistical purposes exception, but only if you give clear information and a simple, free way to object, and only if the data is used to improve your own service. Data shared for another company's purposes does not qualify.
- Advertising, retargeting and conversion pixels, including frequency capping and ad measurement. The ICO says advertising purposes have never been exempt.
- Social media plugins and tracking. A share button used by a logged-in member of that network can be exempt in narrow cases, but any tracking of visitors needs consent, whether they are members or not.
- Cross-site and cross-device tracking. Always needs consent.
- Embedded video, maps and chat widgets that set cookies on page load. The ICO suggests configuring embeds so they set nothing until the visitor presses play, using a privacy mode where one exists, or asking for consent first.
- A/B testing and personalisation. Useful to you, but the service works without them.
Mixed-purpose cookies
One of the most common problems a scan turns up is a cookie doing a necessary job and an optional one at the same time: a security cookie that also feeds marketing segments, or a session cookie that a tag manager reads for analytics.
The ICO is clear that if you rely on a purpose such as security, the cookie must be used only for that purpose. If it is used for anything else as well, the exception no longer applies and you need consent. The usual fix is to split the jobs into separate cookies, so the necessary one stays on and the optional one waits for a choice.
Preference cookies: UK and EU now differ
Cookies that remember a language, currency or dark-mode setting used to sit in an awkward middle. The EU opinion accepts session-length interface cookies as exempt and treats longer-lasting preferences more cautiously. In the UK, the new appearance exception covers cookies used solely to adapt how a site looks or works to a user's preference, again on condition that you give clear information and an easy way to object.
If you serve both UK and EU visitors, the simplest approach is to keep preference cookies in their own category, explain them clearly and let visitors switch them off. That works under both regimes.
How to sort your own cookie list
- Scan the site, including logged-in and checkout pages. A homepage-only scan misses the cookies that matter most. Our guide to what cookie scanners find and miss explains why.
- Write one line per cookie: what it does and what breaks without it. If nothing breaks for the visitor, it is not strictly necessary.
- Check the lifespan. Shorten anything that lasts longer than its job needs.
- Look for shared purposes and split them where you can.
- Test with Reject all. Clear your cookies, reject, then browse, log in and check out. Only your necessary cookies should appear. A visible Reject all button makes this test, and your visitors' choice, simple.
- Document it. Your cookie policy should still list strictly necessary cookies and say why they are needed.
Where COKIQ helps
COKIQ starts from a scan. It detects first-party and third-party cookies and scripts, classifies them, and turns the findings into a cookie policy inventory you can review and correct. On your site, the banner keeps necessary cookies on and holds non-essential scripts until the visitor makes a choice in the analytics, marketing or preferences categories. Each choice is logged with the policy version that was shown. You can see the details on the features page. COKIQ supports compliance work; questions about your specific setup still need qualified advice.
For the next steps, read how long cookie consent lasts and our overview of GDPR cookie consent requirements.