Deutsch
Italiano
Nederlands
Español
Français
What is a cookie?
A cookie is a small text file that a website stores in the visitor's browser. The next time the browser loads a page from that site, it sends the cookie back. That lets a website remember things: that you are logged in, what is in your shopping cart, which language you chose, or that you have visited before.
Cookies themselves are neither good nor bad. What matters is what they are used for. A cookie that keeps your cart is something you need; a cookie that follows you across hundreds of websites to build an ad profile is something you have to agree to first.
The cookie rule in short
In the EU, the rule is in article 5(3) of the ePrivacy Directive, implemented in each country's own law. In the UK it is regulation 6 of PECR. The basic rule is the same: you may only store information on a visitor's device, or read it from there, if the visitor has been given clear information and has consented.
There are exceptions. In the EU, consent is not needed for storage that is strictly necessary for a service the visitor explicitly asked for, or only used to transmit a communication. Where consent is needed, it must meet the GDPR standard: freely given, specific, informed and by a clear action. The EU Court of Justice ruled in Planet49 (2019) that a pre-ticked box is not valid consent, whether or not the cookie contains personal data.
Types of cookies
By who sets them
- First-party cookies are set by the website you visit, under its own domain.
- Third-party cookies are set by another domain, for example an ad network, a video platform or a social media widget embedded in the page.
By how long they last
- Session cookies disappear when you close the browser.
- Persistent cookies stay until a set expiry date, from minutes to years. Google Analytics' _ga cookie, for example, lasts two years by default.
By purpose
This is the classification that decides whether you need consent.
| Purpose | Examples | Consent needed in the EU? | Consent needed in the UK? |
|---|---|---|---|
| Strictly necessary | Shopping cart, login session, load balancing, security, the cookie choice itself | No | No |
| Preferences | Language, region, dark mode | No if they only remember a choice the visitor made, such as a language switch; otherwise often yes | No for adapting appearance or functionality, if visitors can object |
| Statistics / analytics | Visitor counts, page views, Google Analytics | Usually yes; some countries exempt strictly configured analytics | No if only for aggregate statistics to improve your own site, if visitors can object |
| Marketing / tracking | Meta Pixel, Google Ads, LinkedIn Insight Tag, retargeting | Yes | Yes |
| Embedded content | YouTube videos, maps, social media posts | Usually yes | Usually yes |
The UK exceptions were added to PECR by the Data (Use and Access) Act 2025 and apply since 5 February 2026. In the EU, whether analytics cookies may be used without consent depends on the country; the French CNIL and the Dutch rules, for example, allow it under strict conditions. More in Google Analytics and the GDPR.
Not just cookies
The rule is technology-neutral. It covers anything that stores information on a device or reads it from there. In its Guidelines 2/2023, the EDPB lists, among others:
- Local storage and session storage in the browser;
- Tracking pixels and link decoration (identifiers added to URLs);
- Scripts that collect information from the device and send it to a server;
- Fingerprinting, which recognizes a device by its characteristics;
- identifiers in apps and connected devices.
The ICO's guidance for the UK takes the same broad view and speaks of "storage and access technologies". So "we don't use cookies, only a pixel" does not get you out of the rules.
What this means for your website
- Find out what your site really sets. Plugins, embedded videos and marketing tags often add cookies you don't know about. A cookie scanner shows them.
- Sort them by purpose: strictly necessary, preferences, statistics and marketing.
- Block everything that needs consent until the visitor agrees, and make rejecting as easy as accepting.
- Explain it in a cookie policy: each cookie, its purpose, who sets it and how long it lasts. See our cookie policy template.
Cookie Confirm scans your site every month (plus unlimited rescans), sorts the cookies it finds, blocks scripts until consent and keeps your cookie policy up to date.
Sources
- ePrivacy Directive 2002/58/EC (consolidated), article 5(3)
- CJEU: Case C-673/17, Planet49
- EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive
- ICO: What are storage and access technologies?
- ICO: What are the exceptions?
- Data (Use and Access) Act 2025, Schedule 12
- Article 29 Working Party: Opinion 04/2012 on cookie consent exemption
- CNIL: Solutions for audience measurement tools
- Google Analytics Help: Cookie usage on websites