Do logged-in users still need a cookie banner?
Logging in does not switch off the cookie rules. Account and session cookies that keep someone logged in are exempt, but analytics and marketing cookies inside your members area still need consent, just like anywhere else.
Essential cookies are exempt, as always
The cookies that keep a user authenticated, hold their session and secure their account are strictly necessary, so they do not need consent. That is true whether the person is logged in or not. Logging in does not change their status.
But analytics and marketing still need consent
If you run GA4, pixels or heatmaps inside the logged-in area, those are still non-essential and still need consent under PECR and GDPR. A logged-in dashboard is not a consent-free zone.
How to handle it cleanly
- Capture consent once (often at sign-up or first visit) and carry it through the logged-in experience so you are not nagging members on every page.
- Tie the consent record to the account where you can, which also helps you prove consent later.
- Respect a change of mind: let members update their choice in account settings.
In short: the login itself is exempt, the tracking around it is not.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Which cookies are strictly necessary?