Short version: almost all of them. Under GDPR and the ePrivacy rules, you need consent before setting any cookie that is not strictly necessary to deliver the service the visitor asked for. Analytics needs consent. Advertising needs consent. Most functional cookies need consent. Session and login cookies do not.
The tricky part is not the rule. It is working out which bucket a specific cookie belongs in, especially when you did not set it yourself.
Which cookies require consent under GDPR?
Every cookie that is not strictly necessary requires prior consent. That covers analytics, advertising, A/B testing, personalisation, social embeds and session recording. The exemption is narrow: it only applies to storage that is essential to provide a service the user has actively requested, judged from the user's point of view, not yours.
The phrase to focus on is "actively requested". A visitor asks for a page and asks to log in. They do not ask to be measured. That is why a session cookie is exempt and an analytics cookie is not, even though both feel necessary to the person running the site.
What counts as strictly necessary?
A short list, and it stays short:
- Session and authentication cookies. The visitor asked to log in, so keeping them logged in is part of that.
- Shopping cart cookies. Same logic. The cart is the requested service.
- Security cookies, such as CSRF tokens and fraud detection tied to a login.
- Load balancing cookies that route the visitor to a server.
- Consent state itself. Remembering that someone said no is necessary in order to respect the no. Consentify stores this in
csfy_consent.
Notice what is not on the list: analytics, heatmaps, "remember my language" in some readings, and anything at all to do with advertising.
Do analytics cookies need consent?
In the UK and most of the EU, yes. The ICO's storage and access technologies guidance, finalised in April 2026, confirms that non-essential analytics cookies require prior consent. The EDPB has taken the same position for years.
There is one nuance worth knowing. A few national regulators, notably France's CNIL, allow a narrow exemption for strictly configured first party audience measurement: no cross site tracking, no data sharing, limited retention. It is a real exemption, but it is narrow enough that a standard Google Analytics install does not qualify. If you are relying on it, check your configuration against the actual conditions rather than assuming.
Cookieless analytics is the cleaner route. Tools that set no cookies and store nothing on the device fall outside the storage and access rules entirely. Our tracker database flags which tools are cookieless, because it changes what you have to do about them.
What about cookies you did not set yourself?
These are the ones that catch people out. An embedded YouTube video, a Google Maps iframe, a font loaded from a CDN, a chat widget, a social share button. Each of those can set third party cookies the moment the page renders, before any banner appears.
Legally, you are responsible for what your site loads, including third party content you chose to embed. In our scan of 1,775 websites, Google was present on 50.6% of pages, Meta on 9.2% and Microsoft on 6.6%. Very few of those sites deliberately installed all of it. It arrived with a plugin, a theme or an embed.
How do you find out which cookies your site sets?
Open your site in a private browsing window, then check the Application tab in developer tools for cookies and local storage, and the Network tab for third party requests. Or run a scanner that does the same thing and labels what it finds. Manual checking is accurate but slow, and it is easy to miss scripts that only load on certain pages.
A free GDPR scan loads your site the way a first time visitor does and lists every tracker and cookie that fires before consent, with a risk level for each. It takes about ten seconds. If you want to look up a specific cookie you have already found, the tracker database has entries for over 85 trackers with the cookies each one sets, what they do and how long they last.
The category is a decision, not a label
Here is the part that gets sites in trouble. Putting a cookie in the "necessary" category does not make it necessary. It just means you have documented a decision that someone else can review.
We see analytics cookies filed as necessary all the time, usually because moving them out of that bucket costs measurable traffic data. That is a real trade off, and it is worth being honest with yourself about it, because it is the single easiest thing for a complainant or a regulator to check.
The safer default: if you would be uncomfortable explaining the categorisation out loud, it is probably wrong.
What happens if a cookie fires before consent?
The consent is not valid, because the processing already happened. This is the most common failure we see, and it usually is not a decision anyone made. The banner is present, but the tracking script loads in the page head and runs before the banner has even rendered.
That is why our scan data shows sites with a consent banner leaking more often than sites without one. A banner that appears after the tags fire is decoration. Consentify avoids this by not putting the tracking scripts on the page at all: integrations are injected only after the visitor accepts, so there is nothing to fire early.
For the underlying legal detail, our GDPR cookie consent guide covers what valid consent requires. If you are serving UK visitors, the UK GDPR and PECR page covers the differences.
Not sure which of your cookies need consent? Run a free scan and see exactly what fires before anyone clicks.