When you set up a cookie consent banner, one of the first decisions you'll make is which cookie categories to present to users. Get this right and your consent flow is both legally sound and user-friendly. Get it wrong and you risk either over-blocking functionality or under-declaring what you're actually tracking.
The Five Standard Categories
1. Necessary (Always On)
Necessary cookies are strictly required for the website to function. They can't be disabled. Examples include:
- Session cookies that keep users logged in
- Shopping cart cookies on e-commerce sites
- CSRF protection tokens
- Load balancer cookies
Because these are essential to service delivery, they don't require consent — but you should still disclose them in your privacy policy.
2. Analytics
Analytics cookies collect information about how visitors use your website — which pages are popular, where traffic comes from, and how long people stay. Common examples: Google Analytics (_ga, _gid), Matomo, Hotjar, Mixpanel.
These cookies don't directly target advertising, but they do involve processing behavioural data. Consent is required under GDPR before loading them.
3. Marketing
Marketing cookies (sometimes called "targeting" or "advertising" cookies) track users across websites to build profiles used for personalised advertising. Examples: Meta Pixel (_fbp), Google Ads (_gcl_*), LinkedIn Insight Tag, TikTok Pixel.
These are typically the most privacy-invasive category and see the lowest acceptance rates. Users who reject marketing cookies should not be served personalised ads.
4. Preferences (Functional)
Preference cookies remember choices the user has made — language, theme, region, currency. While not strictly "necessary" for the site to work, they significantly improve the user experience. Examples: language selection, saved display settings, remembered notifications.
5. Social Media
Social media cookies are set by embedded content from platforms like YouTube, Twitter/X, Facebook, and Instagram. Even just embedding a YouTube video can set Google cookies unless you use privacy-enhanced mode. These should be declared and consented to separately.
Best Practices for Category Setup
- Be honest. Only enable categories you're actually using. If you have no marketing cookies, don't show a marketing toggle — it erodes trust.
- Write clear descriptions. "Analytics cookies help us understand how our website is used so we can improve it" is far better than "These cookies track usage data."
- Use your scanner. Run a cookie scan to discover all the cookies actually being set on your site — you may find third-party scripts setting cookies you weren't aware of.
- Review regularly. Adding a new tool (chat widget, marketing pixel, A/B testing) means your declared categories need updating. Bump your consent version when you do.