Which of your cookies count as "strictly necessary"?
Strictly necessary cookies are the only ones you can set without consent, so it is tempting to label everything that way. Regulators see straight through that, and over-claiming is a common, avoidable breach.
What genuinely qualifies
A cookie is strictly necessary only if the service the user asked for would not work without it. That means things like:
- Keeping someone logged in.
- Remembering a shopping basket.
- Security and fraud-prevention tokens.
- Load-balancing so the site stays up.
- Remembering the user's cookie choice itself.
What does not qualify (even when it feels essential to you)
Analytics, the Meta pixel, Google Ads tags, retargeting and A/B testing are never strictly necessary, however much you rely on them commercially. They all need consent.
Why mislabelling bites
Marking analytics as necessary so it fires without consent is one of the exact behaviours regulators flag, and it is usually visible in seconds on a scan. Classify honestly, then use Consent Mode to keep measuring the consented traffic. An audit maps every cookie you set to the right category.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · What is a cookie policy?