Types of cookies on websites and which ones wait for a yes

There are four ways to sort the types of cookies on websites: by how long they last, by who sets them, by what they do, and by whether they wait for consent. The last one matters most to you as the owner, and it follows from the other three.

This post ties each type to what the EU’s Article 29 Working Party, the UK’s ICO and the UK regulations say about whether it needs a yes first, then shows you how to check your own cookies from your phone.

Four ways to sort the types of cookies on websites

A cookie is a small text record a website asks the browser to keep and send back on later visits. Every cookie can be described four ways at once:

• Lifespan: session or persistent.
• Source: first party or third party.
• Purpose: strictly necessary, functional, analytics or marketing.
• Consent: exempt, or waits for a yes.

The first two you can read off the cookie itself. The third you work out from what it does. The fourth depends mostly on the third.

Session cookies vs persistent cookies

The Article 29 Working Party, the group of EU data protection authorities that preceded the EDPB, set the definitions in 2012. A session cookie is automatically deleted when the user closes his browser. A persistent cookie stays on the device until it reaches an expiry date, which can be minutes, days or several years away.

Lifespan matters for one reason: the Working Party says an exempt cookie should expire once it’s not needed. A basket cookie can reasonably live a few hours in case the visitor closes the tab by accident. A language choice can live longer if the visitor asked you to remember it.

Lifespan on its own decides nothing. The same opinion says a short cookie and a long cookie can be identical in type and still fall on different sides, because the risk comes from the purpose of processing rather than the information inside.

The Court of Justice added a reporting duty in 2019. In Planet49, it ruled that the information a site gives must include the duration of the operation of cookies and whether third parties may have access to them. The ICO asks for the same, giving cookie duration as its example of how long you intend to store or access information.

First party vs third party cookies

A first party cookie is set by the site whose name is in the address bar. A third party cookie is set by another domain that the page loads, like an ad network or a social widget.

The Working Party notes the term can mislead, because browsers define third party by domain while data protection law defines it by who controls the data. For the consent question, it sides with control: a third party cookie is one set by a company that does not operate the website currently visited. An analytics vendor using a first party cookie on your domain can still be a third party if it uses the data for itself.

The opinion says first party session cookies are far more likely to be exempt than third party persistent ones, because a third party’s cookie usually serves a service the visitor didn’t ask for.

For your banner, the ICO says you must clearly and specifically name any third parties whose technologies you ask people to consent to, including where a third party’s cookie appears to come from your own domain. The first party vs third party debate around Google Analytics turns on that point.

Strictly necessary and functional cookies

These two get mixed up, and the mix-up costs people either a banner they didn’t need or a consent they skipped.

Strictly necessary cookies, often labelled essential cookies, are the ones a site can’t do without to deliver what the visitor asked for. The ICO says the exception applies when the purpose is essential to provide the service the subscriber or user requests, and gives the basket as its example. The UK regulation itself, in Schedule A1 to PECR, lists what qualifies: protecting information, preventing fraud or technical faults, keeping the device secure, automatic authentication, and recording selections made on a website.

The Working Party’s 2012 list says much the same for the EU: basket and form cookies, login cookies for the session, security cookies, the player cookie that remembers your volume, and load balancing. These can be set without consent, and a banner that offers to switch them off is pretending.

Functional cookies remember a choice: language, text size, region, a closed notice. The Working Party calls them UI customisation cookies and says they’re exempt when the visitor made the choice and the cookie lasts a session or slightly more. Remembering the choice for months needs the visitor to be told, which can be as simple as “uses cookies” next to the language switch.

Are functional cookies strictly necessary?

Usually not. The site works without them. Since 5 February 2026, the UK has a separate exception for cookies whose sole purpose is to adapt the website’s appearance or functions to the visitor’s preferences, with conditions: the visitor is told, and has a simple, free way to object. The ICO adds that this does not cover personalising content from inferred interests or behaviour. In the EU, the Working Party’s reading applies: short-lived and chosen by the visitor, fine; longer, say so.

Functional cookies vs performance cookies

A functional cookie remembers something the visitor did. A performance cookie, which most banners call analytics, measures something the visitor did. One serves the visitor; the other serves you.

Analytics and marketing cookies

Analytics cookies count. Pages viewed, visits, where people arrived from, where they left. The Working Party is clear that in the EU they’re not strictly necessary to provide a functionality explicitly requested by the user, because the visitor can use the whole site with them off. It drew a line between first party analytics limited to aggregate statistics, which it saw as low risk, and third party analytics that follow a person across sites, which it called a substantially greater risk. It asked the legislator to add an exemption for the first kind. The directive hasn’t been amended since, so under it analytics cookies wait for consent.

The UK did add one. Since 5 February 2026, paragraph 5 of Schedule A1 exempts storage whose sole purpose is statistics to improve your own service, as long as the data isn’t shared except to help with that improvement, the visitor is told, and the visitor has a simple, free way to object. The ICO says a third party analytics provider fits only as a processor acting on your behalf. Tracking individuals or feeding ad platforms falls outside it. Whether your analytics tool counts as a processor in your setup is a question the guidance hands back to you. The Google Analytics and GDPR post goes through where common setups land.

Marketing cookies, also called advertising or targeting cookies, recognise the visitor on other sites so ads can follow them. Here the EU and UK agree completely. The Working Party says third party advertising cookies are not exempt from consent. The ICO says there are no advertising purposes that meet the strictly necessary exception, because the site works without ads. A pixel from an ad platform sets these; the tracking pixel post explains how.

The whole sort, for the EU and UK:

• Strictly necessary: set without consent, both.
• Functional, short and chosen: exempt in both; longer needs information in the EU, and the UK’s preference exception with a way to object.
• Analytics: consent in the EU; exempt in the UK only within the statistics exception.
• Marketing: consent, both, always.

What regulators found when cookies didn’t wait

Three published decisions from the last three years.

In Romania, the data protection authority fined Urban Home Development 10,000 lei in May 2024 after a complaint showed its website installed cookies that were not technically necessary before users gave consent, and ordered the setup corrected. The same authority has issued a run of similar decisions since, listed in the EU-01 Handbook article.

In the UK, the ICO reprimanded Sky Betting and Gaming in September 2024 for sharing data with advertising companies as soon as they accessed the SkyBet website, before anyone could accept or reject advertising cookies. It ran from 10 January to 3 March 2023.

In France, the CNIL fined the SHEIN group’s Irish company €150 million on 1 September 2025. Advertising cookies were placed as soon as visitors arrived on the site, and clicking Refuse all still led to new cookies being set.

Check your own cookies from your phone

You can sort your own cookies in ten minutes without a tool.

1. Open your site in a private window and don’t touch the banner. Note what the banner says is set already. If it lists only strictly necessary cookies, good.
2. Open your cookie notice or policy page. Count the cookies it lists, and write down each one’s category and lifespan. A missing lifespan is a gap Planet49 and the ICO both point to.
3. Match each listed cookie to a purpose using the four-way sort. Ask of each: would the site work without it? If yes, it isn’t strictly necessary, whatever the label says.
4. Look for the strangers. Any cookie or vendor you don’t recognise is probably a third party that came with a plugin, a chat widget or an ad account. Find its company name and check that your banner names it.
5. Press Reject and browse three pages. Then open the banner’s settings again. Did anything move? If marketing or analytics show as on, Reject didn’t do its job.
6. Check the toggles. Strictly necessary should have no toggle. Everything else should start off.
7. Check your lifespans against jobs. A basket cookie at two years, or a consent record at thirty years, is worth asking your developer about.

The check website cookies post shows the browser’s own cookie list for a closer look, and the cookie policy template post covers how to write the list up.

Peeky reads the public pages of your site. For cookies that set before the visitor has answered, the checks are EU-01 and UK-01 in the Handbook, and UK-05 for the advertising partners that load with them.

Questions people ask

What are examples of cookies on the internet?

A shopping basket cookie that remembers what you picked, a login cookie that keeps you signed in, a language cookie that remembers you chose English, an analytics cookie that counts visits, and an advertising cookie that recognises you on other sites. The Article 29 Working Party's 2012 opinion works through each of these by purpose.

Are functional cookies strictly necessary?

Usually not. Strictly necessary means the site can't deliver what the visitor asked for without it. A functional cookie adds a convenience, like remembering a language or a text size. The ICO's guidance says the strictly necessary exception applies when the purpose is essential to provide the service the user requests. In the UK since February 2026 there is a separate exception for preference cookies, with conditions.

What's the difference between functional cookies and performance cookies?

Functional cookies remember a choice the visitor made, like a language. Performance cookies, usually called analytics cookies, measure how the site is used: pages viewed, time spent, where people drop off. The Working Party's opinion says analytics cookies are not strictly necessary to provide a functionality explicitly requested by the user, so in the EU they wait for consent.

Is it better to accept or reject cookies?

For a visitor, rejecting loses nothing the site needs to work, because strictly necessary cookies are set either way. For a site owner, the question is whether Reject actually does anything. The CNIL fined one retailer in 2025 after finding that clicking Refuse all still placed new cookies.

Do session cookies need consent?

Not because they're short. A session cookie is exempt when its purpose is something the visitor asked for, like a basket or a login. The Working Party says first party session cookies are more likely to be exempt than third party persistent ones, but that the risk comes from the purpose, not the information or the lifespan.