Strictly Necessary Cookies EU ePrivacy FAQ

Treat the exemption as a cookie-by-cookie, purpose-by-purpose test. For the transmission exemption, the communication must not be possible without the cookie or similar storage/access operation; a cookie that merely helps, speeds up, measures, or improves the service is not enough.

For the user-requested service exemption, the user must have taken a positive action to request a clearly defined service or feature, and the cookie must be strictly needed for that feature to work. The test is from the user's point of view, not from the website operator's preference for measurement, monetization, personalization, or operational convenience.

WP29 treats first-party user-input session cookies as a core example where the user requested the feature, such as completing a form over several pages or adding items to a shopping basket. The cookie should remain tied to that action and normally expire with the session. Limited extra persistence needs its own justification based on what the user requested and reasonably expects, such as recovering a recently closed basket.

Session authentication cookies can also qualify where they are needed to keep the user authenticated across page requests for a service the user logged into. User-centric security cookies can qualify when they protect that requested login service, such as detecting repeated failed login attempts. Those examples do not authorize secondary uses such as behavioral monitoring, advertising, or cross-site tracking.

Do not classify analytics cookies as strictly necessary under the general Article 5(3) exemptions merely because the site operator needs measurement. WP29 states that first-party analytics are often useful but are not strictly necessary for a user-requested website feature because the user can still access the site when those cookies are disabled.

Some national implementations or regulator guidance may create narrower analytics approaches or safeguards, but this page does not state country-specific exemptions. Before relying on analytics without consent, check the Member State law and competent authority guidance that applies to the website, the user group, and the deployment.