What is the difference between necessary cookies and all the rest?

Updated: 13 October 2026

The short answer

Only cookies without which something the visitor asked for would not work are necessary: login, basket, language choice. Everything else, meaning statistics, advertising and convenience extras, needs consent. The category depends on what the cookie is for, not on how much you need it yourself.

One question that settles it

For each cookie, ask yourself: will the visitor still get what they came for if this cookie is not there? If yes, the cookie is not necessary.

The question is about the visitor, not about you. Statistics matter a great deal to a shop owner, but the customer can buy shoes without them. That is why statistics are not among the necessary cookies, odd as that seems to many people.

The rules know only two exceptions from consent: storage needed to send the page across the network, and storage necessary for a service the visitor clearly wants.

Necessary cookies: examples

Session and login. The cookie that saves you from typing your password on every page once you have logged in.

Basket. The cookie that remembers, during a visit, what the customer has put in it.

Security. Cookies that protect forms and accounts against abuse.

Language choice and the saved consent decision. The site has to remember what the visitor chose, so that it does not ask again at every click.

Spreading traffic between servers. The visitor never sees it, but without it the page might not load.

Regulators in our region give a similar list. The Croatian authority names session, authentication, security and load-balancing cookies, among others. The Estonian one gives a session cookie and a language preference cookie as examples.

Cookies that need consent

Analytics. They count visits and show which pages are read. Example: Google Analytics. The Latvian authority names the _ga, _gat and _gid cookies as ones that need consent.

Marketing. They let you measure how adverts perform and aim them at people who have already been on the site. Examples: Google Ads tags, the Meta pixel, Microsoft Advertising.

Functional. They add convenience, but the site works without them. A typical example is content embedded from an outside service that stores its own files.

These three groups plus the necessary one make up the split you will most often see in consent windows. It does not come straight from the law. It is simply an accepted way of presenting the choice so that people can understand it.

The most common sorting mistakes

Putting statistics under necessary. Polish law has no exception for statistics. The Slovenian authority writes that analytics cookies are never strictly necessary, even when they come from your own domain.

Treating a cookie as necessary because a plugin added it. A shop plugin or a site theme can add an advertising pixel without asking. The category depends on the purpose of the cookie, not on where it came from.

Treating files from outside services as your own. The Slovak regulator writes that third-party cookies generally cannot be regarded as necessary.

One country takes a slightly different line. The Bulgarian authority's guidance allows statistics without consent if the data is anonymised and not shared with anyone. It gives no technical conditions, though, and names Google Analytics as an example of a tool that needs consent.

What this means for your site

A blog without statistics or adverts usually has only necessary cookies. A company site with Google Analytics already has one category to ask about. A shop advertising on Google and Facebook usually has all four.

The rule also covers ways of storing data other than cookies, such as browser storage and tracking pixels. They are sorted into categories in the same way.

The more precisely you describe what each group is for, the easier the decision is for the visitor. Polish law requires the information to state the purpose of storing and reading data, and to say that the visitor can also set conditions in their own browser.

Legal basis in Poland: Article 399 of the Electronic Communications Law. This text describes the rules and how regulators apply them. It is not advice on your particular case.

Key points

A cookie is necessary if the visitor would not get what they asked for without it.
Statistics are not necessary, even if they are your own and you badly need them.
Files from outside services generally fall outside the exception.
The purpose decides the category, not the cookie's name or the plugin that added it.

Sources

This guide is for information only and is not legal advice.