Skip to main content
Cookie Gate
Category: Cookie Types

Non-Essential Cookies

Also known as: Non-necessary cookies, Optional cookies
Simply put

Non-essential cookies are cookies that are not strictly required for a website to work, and instead support things like analytics, marketing, or extra features. Because they go beyond what is needed to deliver the service a user asks for, in the EU and UK they generally cannot be set until the user has given consent. This is different from essential (strictly necessary) cookies, which are typically exempt from the consent requirement.

Formal definition

Non-essential cookies are any cookies (and functionally equivalent technologies such as pixels, local storage, SDKs, or fingerprinting) that fall outside the narrow category of strictly necessary/essential cookies, typically covering analytics, advertising, and non-essential functional purposes. Under the ePrivacy Directive as implemented across EU member states and in the UK under PECR, the storage of, or access to, information on a user's device for non-essential purposes generally requires prior consent, and such cookies should not be set before that consent is obtained. It is important to separate two distinct layers: the ePrivacy consent requirement governs the act of storing or accessing information on the device, while any subsequent processing of personal data derived from those cookies is governed by the GDPR, which may in principle rely on lawful bases other than consent (for example, legitimate interests) for that downstream processing, even though ePrivacy consent is still required for the storage/access step. Consent under the GDPR must be freely given, specific, informed, and unambiguous through a clear affirmative action, so pre-ticked boxes and implied consent are widely regarded as insufficient in the EU. This entry describes the general EU/UK position; requirements differ under other regimes (for example, several US state privacy laws rely on opt-out rather than opt-in), and the precise classification of a given cookie as non-essential depends on its specific purpose and factual context.

Why it matters

Non-essential cookies sit at the centre of most cookie compliance work because they are the cookies that generally cannot be set until a user has given valid consent. In the EU, the ePrivacy Directive is implemented across all member states, and in the UK the equivalent rule sits in PECR; under both, storing or accessing information on a user's device for non-essential purposes such as analytics, advertising, or non-essential functionality generally requires prior consent. Regulators including the UK ICO have made clear that non-essential cookies should not be set before that consent is obtained, including on a website's homepage, which is why the timing of cookie deployment, not just the presence of a banner, matters for compliance.

A recurring source of confusion is the relationship between the two legal layers involved. The ePrivacy consent requirement governs the act of storing or accessing information on the device, while any subsequent processing of personal data derived from those cookies is governed by the GDPR. Regulators often highlight that the GDPR may in principle allow that downstream processing to rely on lawful bases other than consent, such as legitimate interests, yet ePrivacy consent is still required for the storage and access step itself. Treating a legitimate interests basis for downstream processing as if it removed the need for consent to set the cookie is a common misunderstanding that can lead to non-compliant implementations.

Because valid consent under the GDPR must be freely given, specific, informed, and unambiguous through a clear affirmative action, practices such as pre-ticked boxes and implied consent from continued browsing are widely regarded as insufficient in the EU. The correct classification of a specific cookie as essential or non-essential is fact-specific and depends on its actual purpose, so borderline cases, particularly some functional cookies, can require careful case-by-case assessment rather than a blanket label.

Who it's relevant to

Privacy and data protection officers
DPOs and privacy teams are responsible for classifying cookies correctly, ensuring non-essential cookies are not set before consent, and maintaining the distinction between the ePrivacy consent for storage/access and the GDPR basis for downstream processing. They typically own the case-by-case assessment of borderline cookies.
Legal and compliance counsel
Legal teams advise on how the general EU/UK consent position applies to a given site and how obligations differ under other regimes, including US state privacy laws that rely on opt-out models. They also assess whether a legitimate interests basis may support downstream processing while recognising that ePrivacy consent is still required for setting the cookie.
Web developers and engineers
Developers implement the technical gating that prevents non-essential cookies, pixels, SDKs, local storage, and similar technologies from loading before consent is captured, and integrate consent management platforms so that deployment reflects the user's recorded choices, including on high-traffic pages such as the homepage.
Marketing and analytics teams
Marketing and analytics functions rely heavily on non-essential cookies for measurement and advertising, and need to understand that these generally cannot fire until consent is given in the EU and UK. This affects campaign tracking, attribution, and audience building, and requires coordination with privacy and engineering teams.

Inside Non-Essential Cookies

Definition and scope
Non-essential cookies are cookies (and functionally similar technologies) that are not strictly necessary to provide a service explicitly requested by the user. They typically include analytics, advertising, targeting, and certain functional or personalization cookies. Under the ePrivacy Directive, as implemented across all EU member states and mirrored in the UK's PECR, placing or accessing such information on a user's device generally requires prior consent.
Contrast with essential cookies
Essential or strictly necessary cookies (for example, those enabling a shopping cart, load balancing, or user-requested security functions) are generally exempt from the consent requirement. Non-essential cookies fall outside this exemption because they are not indispensable to a service the user has requested.
Covered technologies beyond cookies
The same consent rules generally extend to non-cookie technologies that store or access information on a device, such as pixels, tracking beacons, local storage, mobile SDKs, and device fingerprinting. Classifying a technology as non-essential turns on its purpose, not on whether it is literally a cookie.
Two-layered legal analysis
Two distinct regimes can apply. The ePrivacy Directive (and national implementations) governs the storage of or access to information on the device, for which consent is typically required for non-essential cookies. The GDPR then separately governs any processing of personal data that follows. Importantly, while ePrivacy consent is usually needed for the storage/access step, the subsequent processing of personal data may in principle rely on other lawful bases under the GDPR (such as legitimate interest), a distinction that regulators often emphasize. This does not remove the ePrivacy consent requirement for the storage or access itself.
Consent standard where consent applies
Where consent is the basis for setting non-essential cookies in the EU and UK, it must meet the GDPR standard: freely given, specific, informed, and unambiguous, requiring a clear affirmative action. Pre-ticked boxes, implied consent from continued browsing, and (in many regulators' view) cookie walls are widely considered non-compliant.
Jurisdictional variation
Obligations differ by region. The EU and UK generally require prior opt-in consent for non-essential cookies, whereas several US state privacy laws (such as California's CCPA/CPRA) rely more on opt-out mechanisms and honoring signals like the Global Privacy Control. The applicable scope should always be identified before drawing conclusions.

Common questions

Answers to the questions practitioners most commonly ask about Non-Essential Cookies.

Does obtaining consent for non-essential cookies under the ePrivacy rules mean I've also satisfied my GDPR obligations?
Not necessarily. The ePrivacy Directive (as implemented across all EU member states, and mirrored in the UK's PECR) governs the storing of or gaining access to information on a user's device, which is why prior consent is generally required for non-essential cookies. The GDPR separately governs any processing of personal data that follows. Consent obtained for storage and access does not automatically provide a lawful basis for the subsequent processing under the GDPR. In some cases a controller may rely on an alternative GDPR lawful basis, such as legitimate interest, for that downstream processing, even though ePrivacy consent is still required to place or read the cookie in the first place. The two layers should be assessed separately.
Can I treat a user's continued browsing, or a pre-ticked box, as consent for non-essential cookies?
In the EU, this is generally not accepted. Valid consent under the GDPR standard must be freely given, specific, informed, and unambiguous, and it requires a clear affirmative action. Implied consent from continued scrolling or browsing, and pre-ticked or pre-enabled boxes, are widely regarded as failing that standard by EU data protection authorities, and similar positions apply in the UK. This differs from several US state frameworks, which often rely on an opt-out model rather than prior opt-in, so the answer depends on the applicable jurisdiction.
Which technologies should I treat as non-essential when building my consent banner?
Non-essential categories typically include analytics, advertising, and many functional cookies, all of which generally require prior consent in the EU and UK. It is important to note that the same consent rules apply to similar technologies that are not literally cookies, such as tracking pixels, local storage, mobile SDKs, and device fingerprinting, where they involve storing or accessing information on a user's device. Whether a specific technology is essential depends on its actual purpose and the facts of your deployment, so categorisation should be assessed case by case rather than assumed.
How should non-essential cookies behave before a user makes a choice?
As a general rule in the EU and UK, non-essential cookies and equivalent technologies should not be placed or read until the user has given prior consent. In practice this means configuring tags, scripts, pixels, and SDKs so they are blocked or held until an affirmative choice is recorded. Refusing should be as straightforward as accepting. This description reflects common regulatory expectations in these jurisdictions, but the precise implementation that satisfies a given authority can depend on facts and evolving guidance, so legal judgement remains necessary.
What should I record when a user consents to or refuses non-essential cookies?
Consent record-keeping generally supports the ability to demonstrate that valid consent was obtained. Records commonly capture what the user was shown, the categories or purposes they accepted or refused, when the choice was made, and the mechanism used. A consent management platform (CMP) can automate logging and enforcement, but a CMP supports compliance rather than guaranteeing it, and does not replace the underlying legal assessment. The specific records that are adequate can depend on the applicable regime and current authority guidance.
How do frameworks like the IAB TCF or Global Privacy Control fit into managing non-essential cookies?
These are components that can support consent management but address different things. The IAB Transparency and Consent Framework (TCF) is an industry framework used to communicate consent and purposes among advertising participants, often through a CMP. Global Privacy Control is a browser-based signal that some jurisdictions treat as an opt-out request, particularly relevant under certain US state laws. Adopting either does not by itself establish that your handling of non-essential cookies is lawful; they are tools within a broader compliance approach that still requires legal judgement and attention to the applicable jurisdiction.

Common misconceptions

All non-essential cookies require consent everywhere in the world.
Prior opt-in consent for non-essential cookies is characteristic of the EU (where all member states implement the ePrivacy Directive) and the UK. Other regimes, including several US state laws, may instead rely on opt-out approaches. The requirement depends on the applicable jurisdiction.
If consent is required under ePrivacy, then the GDPR must also treat consent as the only lawful basis for the related data processing.
The ePrivacy consent requirement applies to the storage of or access to information on the device. The GDPR analysis for any subsequent processing of personal data is separate, and may in some cases rely on other lawful bases such as legitimate interest. This nuance does not eliminate the ePrivacy consent obligation for the storage or access step itself.
Only cookies are covered, so pixels, local storage, and SDKs are exempt.
Technologies that store or access information on a device for non-essential purposes generally fall within the same rules regardless of whether they are technically cookies. Classification depends on function and purpose, not terminology.

Best practices

Conduct and maintain a cookie audit that classifies each cookie and similar technology (pixels, local storage, SDKs, fingerprinting) as essential or non-essential based on its actual purpose, and document the reasoning.
Where the EU or UK applies, block or defer non-essential cookies until valid consent is obtained, and ensure the consent mechanism reflects a clear affirmative action without pre-ticked boxes or reliance on implied consent.
Separate the two-layered analysis in your documentation: identify the ePrivacy basis for storage/access and the distinct GDPR lawful basis for any subsequent processing, recognizing that a basis other than consent may be available for the processing step.
Identify the applicable jurisdictions for your user base and adapt the approach accordingly, for example using opt-in in the EU and UK and honoring opt-out signals such as the Global Privacy Control where US state laws apply.
Use a consent management platform to present choices and to log and retain records of consent, while recognizing that such tools support but do not by themselves guarantee legal compliance.
Review classifications and consent flows periodically against evolving data protection authority guidance, and seek legal advice for contested cases where a cookie's essential status or lawful basis is uncertain.