Cookies are small files your website leaves on a visitor's computer or phone so it can remember things about them.
Most cookies need permission before you are allowed to use them. A small group does not: the ones your website genuinely cannot work without. Those are called essential cookies.
Working out which of yours are truly essential, and which only feel essential, is the part most website owners get wrong.
A simple way to think about it
Imagine someone puts three things in a shopping basket on your site, then clicks through to another page. Something has to remember what they picked. That something is a cookie.
Without it, the basket empties every time they move. The site simply does not work.
That is an essential cookie. The visitor came to shop; remembering their basket is part of giving them what they asked for.
Now picture a different cookie, one that records which pages they looked at so you can check your visitor numbers on Monday. Useful to you. But nothing breaks for the visitor if it is missing. They never asked for it.
That one is not essential, and you need permission first.
The test: if you removed the cookie, would the visitor notice something stop working? If yes, it is probably essential. If the only person who would notice is you, it is not.
Usually essential
- Remembering that someone is logged in
- Remembering what is in a shopping basket
- Keeping your site secure, for example stopping someone submitting a form from a fake copy of your page
- Remembering the cookie choice a visitor just made. You genuinely do need a cookie to remember that someone said no to cookies
Usually not essential
- Visitor statistics, including Google Analytics
- Advertising, and showing ads to people who visited before
- Social media feeds and share buttons
- Embedded YouTube videos and Google Maps
- Live chat widgets, unless the visitor opened the chat themselves
That last group is the one that catches people out. A video or a map on your contact page can quietly leave cookies the moment the page loads, long before anyone has clicked anything on your banner.
Why the difference matters
If you treat something as essential when it is not, it gets used before anyone agreed to it. That is the actual problem, not the label you gave it.
There is a second issue too. Essential cookies are not offered as a choice, because there is no point offering a choice you cannot say no to. So anything you mislabel is something your visitors can never refuse.
How to check your own site
You do not need any tools for a rough check.
- Open your website in a private or incognito window.
- Refuse everything on the cookie banner.
- Have a look at what cookies are there anyway.
In most browsers you can see this by clicking the small icon to the left of the web address, then looking for "cookies" or "site data".
Anything sitting there that is not on the essential list above is worth asking your developer about. Most people find one or two surprises.
Do you have to mention essential cookies at all?
You do not need permission for them. You do still need to be open about them.
Visitors are entitled to know what your site stores and roughly how long it keeps it. That belongs on a cookie page, linked from your banner. It is a short page, and writing it once is a lot less work than explaining later why it was never there.
If you would rather not sort this out yourself, our Cookie Notice tool handles the asking, the remembering, and the holding-back of everything that needs permission.
This is general guidance, not legal advice. If your site handles anything sensitive, it is worth asking someone qualified where you are.