Strictly necessary cookies: what may load before consent, and how to prove the rest waits

Strictly necessary cookies are the cookies a site cannot work without for something the visitor asked for: the login session, the shopping cart, load-balancing and security cookies, and the cookie that remembers the visitor's consent answer. Under EU and UK rules they are the only cookies that may be set before the visitor answers the cookie banner; analytics, advertising and session-recording cookies have to wait for a yes. This guide shows which cookies qualify, why a cookie wall rarely does, and how to prove your page holds back everything else. For the wider legal picture, start with the guide to cookie consent and what the law requires.

Quick answer

• Allowed before consent: session and login cookies, cart and checkout, CSRF tokens, load-balancer and bot-protection cookies, the consent cookie itself, and a language or accessibility choice the visitor made.
• Not allowed before consent in the EU: _ga, _gid, _fbp, _gcl_au, _hj…, A/B testing and session-recording cookies, whatever the vendor calls them. The UK has had narrow exceptions for first-party statistics since February 2026.
• The test is necessity for the visitor's request, not for your business.
• Cookie walls, which hide the page until the visitor accepts, do not produce freely given consent in most EU regulators' view.
• Prove it in a fresh browser: the cookie scanner, or a private window with DevTools open before the page loads.
• Fix it with Consent Mode v2 defaults set to denied for Google tags, and consent-based blocking for every other tag.

What counts as a strictly necessary cookie?

Article 5(3) of the ePrivacy Directive (2002/58/EC) allows storage on a visitor's device without consent in two cases only: when it is needed to carry a communication over a network, or when it is "strictly necessary" for a service "explicitly requested" by the user. National laws copy that wording: PECR regulation 6 in the UK, section 25 TDDDG in Germany, Article 82 of the French data protection law.

The detailed reading still comes from the Article 29 Working Party's Opinion 04/2012 on cookie consent exemption, which the European Data Protection Board inherited. Its test has two parts: the visitor asked for the feature, and the feature cannot work without the cookie. That gives this table:

The Working Party's opinion adds a detail most banners miss: a cookie can be necessary for one purpose and not for another. A session cookie that also feeds an analytics profile is no longer exempt. Lifetime counts too: exempt cookies should last no longer than their purpose, which for sessions means the browser session.

Two points that surprise people:

• It is not only cookies. The rule covers anything stored on or read from the device: local storage, tracking pixels, fingerprinting scripts. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) spell this out.
• "Functional" is not a legal category. Many consent platforms add a "functional" or "preferences" group. Only what the visitor asked for is exempt; a chat widget that sets cookies on every page load before anyone opens it is hard to call strictly necessary.

Analytics: the two exceptions

France. The CNIL exempts audience-measurement cookies from consent under strict conditions: used only to produce anonymous statistics for the site itself, not combined with other data or passed to third parties for their own purposes, a cookie lifetime of 13 months at most and data kept for at most 25 months. Standard Google Analytics does not meet them; some self-hosted or specially configured tools do.

UK. The Data (Use and Access) Act 2025 added new exceptions to PECR, in force since 5 February 2026. Cookies used only to collect statistics to improve your own service, or only to remember how the visitor wants the site to look, no longer need consent, provided visitors get clear information and a simple, free way to object. Data shared with a third party for its own purposes falls outside the exception, and advertising still needs consent. The ICO's guidance on storage and access technologies is the reference.

Everywhere else in the EU, treat analytics as needing consent unless your regulator's published guidance says otherwise.

Is a cookie wall allowed?

A cookie wall hides or blocks the content until the visitor accepts cookies. The EDPB's Guidelines 05/2020 on consent say that access to content must not depend on accepting cookies, because consent given to get past a wall is not freely given. That is the default reading across the EU.

The exception people cite is "consent or pay": accept tracking, or pay for the same content without it. The CNIL and the ICO have said such a model can be acceptable under conditions, above all a fair price and a genuinely equivalent alternative. The EDPB's Opinion 08/2024 is far stricter for large online platforms. For a normal business site, there is no paid alternative on offer, so a wall is simply a banner without a real choice. Let visitors read the page with necessary cookies only.

How getReport checks what loads before consent

The scanner opens your page in a fresh Chromium session, like a first-time visitor: no cookies, nothing accepted. It then works in three steps.

1. Before. It waits for the page to settle and records every cookie in the browser, first- and third-party, whether a header or a script set it, plus every request the page made.
2. Find the buttons. It looks for the accept button of 18 consent platforms by their own element ids and classes (Cookiebot, OneTrust, CookieYes, Complianz, Usercentrics, Didomi, iubenda, Borlabs and others). If none matches, it takes any visible button or link whose whole label is an accept phrase in about 20 languages, such as "Accept all", "Alle akzeptieren", "Tout accepter" or "Prihvaćam". It looks for a visible reject control the same way.
3. After. It clicks accept, waits about 2.5 seconds for the network to go quiet, and records the new cookies and requests.

Cookies are classified by name. Consent-platform cookies and session, cart and security cookies count as necessary; language and currency cookies as functional; _ga and _gid as analytics; _fbp as advertising; and so on for Hotjar, Clarity, TikTok, LinkedIn and others. Only analytics and advertising cookies set before the click count against you. An unknown cookie on your own domain is listed as unknown and not held against you; an unknown third-party cookie is treated as advertising. Requests are matched against 25 analytics, advertising, session-replay and social trackers.

Three things to know when you read the result:

• Google Tag Manager itself is not a tracker. The container script sets no cookies, so it is not listed; what it loads is. If the trackers finding names Google Analytics or the Meta Pixel, a tag inside the container fired before the consent event.
• Advanced Consent Mode sends cookieless pings. The scanner recognises the Consent Mode default and, as long as no Google cookie was set before the click, does not count those pings. Whether cookieless pings before consent are acceptable in your country is a question for your privacy adviser.
• The scanner only clicks accept. Testing "Reject" is a manual step (see Verify).

Make everything else wait, step by step

1. Reproduce it by hand

Open a private window, open DevTools (F12) and only then type the address.

• Network tab: tick "Preserve log". Filter for collect, gtag, fbevents or hotjar.
• Application tab (Firefox: Storage) → Cookies → your domain; also check Local storage.

Do not touch the banner. Everything you see now happened before consent. Chrome's incognito mode blocks third-party cookies by default, so advertising cookies on other domains may be missing even when the requests are there; the requests are the evidence.

2. Find what loads each tracker

The Network tab's Initiator column names the script that started each request. gtm.js means the fix is in Tag Manager; the page itself means a hard-coded snippet; a file under /wp-content/plugins/<slug>/ names the plugin. Fix every source, or the tracker you blocked in one place keeps firing from another.

3. Google tags: Consent Mode v2 with denied defaults

Set the defaults before the Tag Manager or gtag snippet, as the first script in the <head> of every page:

<!-- In <head>, above the Google Tag Manager or gtag.js snippet -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500
  });
</script>

When the visitor accepts, the consent platform calls gtag('consent', 'update', { … 'granted' }). Most platforms can set the defaults themselves through a Consent Mode switch or their Tag Manager template; use one method, not both. The Google Consent Mode v2 guide covers basic and advanced mode.

4. Everything else: hold it back

Meta, Hotjar, TikTok, LinkedIn and other non-Google tags ignore Consent Mode.

In Google Tag Manager, open each tag → Advanced Settings → Consent Settings → "Require additional consent for tag to fire" and add ad_storage or analytics_storage. Or fire it on the consent event your platform pushes, such as Cookiebot's cookie_consent_marketing or OneTrust's OneTrustGroupsUpdated.

In the page's HTML, change the script type to text/plain and label its category; the consent platform switches it back after the matching consent:

<!-- Cookiebot: runs only after "marketing" consent -->
<script type="text/plain" data-cookieconsent="marketing">
  !function(f,b,e,v,n,t,s)
  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
  n.callMethod.apply(n,arguments):n.queue.push(arguments)};
  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
  n.queue=[];t=b.createElement(e);t.async=!0;
  t.src=v;s=b.getElementsByTagName(e)[0];
  s.parentNode.insertBefore(t,s)}(window, document,'script',
  'https://connect.facebook.net/en_US/fbevents.js');
  fbq('init', '000000000000000'); // your pixel id
  fbq('track', 'PageView');
</script>

<!-- OneTrust: runs only after the targeting group (C0004) is accepted -->
<script type="text/plain" class="optanon-category-C0004"
        src="https://static.hotjar.com/c/hotjar-0000000.js?sv=6"></script>

Automatic blocking modes in Cookiebot, CookieYes and Complianz catch many well-known scripts. Scripts they do not know, and anything loaded by another script, still need the manual pattern or Tag Manager.

5. Label necessary cookies honestly

Go through your consent platform's cookie list. Anything in the "necessary" group that sets an identifier for analytics, advertising or personalisation belongs in another group. Regulators check that category, and a mislabelled tracker in it runs before consent with the platform's blessing.

6. Finish the banner

A first-layer "Reject all" and cookie lifetimes of 13 months or less are the other two findings in the same scan. The guide to cookie banner requirements covers both.

Platform notes

• WordPress: analytics plugins (Site Kit, MonsterInsights), pixel plugins, chat and popup plugins often print their tag themselves. Look for a consent-integration setting; the WP Consent API lets consent plugins such as Complianz and CookieYes pass the choice to plugins that support it. Test logged out: several analytics plugins skip their tag for administrators.
• Shopify: the built-in banner under Settings → Customer privacy controls pixels added under Settings → Customer events. Tracking code pasted into the theme or loaded by older apps does not follow it; move it into a custom pixel.
• Static and custom sites: consent platform first, then the Consent Mode defaults, then Tag Manager, with every other tag inside Tag Manager.

Verify

• Re-run the scanner: "Only necessary cookies are set before consent" and "No trackers load before consent".
• Test "Reject" by hand: a new private window, click reject, reload, open a second page. No analytics or advertising cookies should appear, and no tracker requests beyond Google's cookieless pings in advanced Consent Mode.
• A "Cookie settings" link, usually in the footer, reopens the banner.

Common mistakes

• Testing in your everyday browser. You accepted months ago, or you are logged in, so you see neither banner nor trackers. Always test in a fresh private window, logged out.
• Putting analytics in "necessary". It makes the scan of your own platform look clean and is exactly what auditors look for.
• Proxying Google Analytics and assuming it is invisible. The scanner matches trackers by path as well as host (/gtag/js?id=, /g/collect) and recognises _ga by name. A proxy changes where the data goes, not whether it needs consent.
• Fixing Tag Manager but not the theme. Search the page source for the tag id (G-, fbq('init') and remove every copy outside Tag Manager.

If a developer or agency makes the change, send them the fixes straight from the report so they see the same evidence you do. Cookie attributes such as Secure and SameSite are a separate topic, covered in cookie flags explained.

Questions people ask

Which cookies count as strictly necessary?

Cookies without which a feature the visitor asked for cannot work: the login session, the shopping cart and checkout, CSRF tokens that protect forms, load-balancer and bot-protection cookies, and the cookie that stores the visitor's consent answer. A language the visitor chose also qualifies. The test comes from Article 5(3) of the ePrivacy Directive and the Article 29 Working Party's Opinion 04/2012: necessary for the visitor's request, not for your business.

Are analytics cookies strictly necessary?

No, not in the EU in general. Analytics helps you, not the visitor's request, so _ga and similar cookies need consent first. Two exceptions exist: France's CNIL exempts tightly limited, anonymous audience measurement, and the UK has allowed first-party statistics cookies without consent since 5 February 2026, as long as visitors are told and can object. Standard Google Analytics meets neither set of conditions out of the box.

Is a cookie wall legal?

In most of the EU, no. The EDPB's consent guidelines say access to content must not depend on accepting cookies, because consent given to get past a wall is not free. Some regulators, including the CNIL and the ICO, accept "consent or pay" models under strict conditions, such as a fair price for a tracking-free version. A normal business site offers no such alternative, so let visitors in with necessary cookies only.

Does the cookie that stores consent need consent itself?

No. The cookie that remembers whether a visitor accepted or rejected is strictly necessary, because the banner cannot respect the choice without it. It should hold only the answer, not an identifier used for anything else, and should not live longer than the consent it records: 6 to 12 months is common, and 13 months is the usual ceiling.

Do cookie rules cover local storage and tracking pixels too?

Yes. Article 5(3) of the ePrivacy Directive covers any information stored on or read from the visitor's device, not only cookies. The EDPB's Guidelines 2/2023 confirm that local storage, tracking pixels, fingerprinting and tracking links fall under the same rule. A tracker that avoids cookies by writing to local storage still needs consent unless it is strictly necessary.