Strictly Necessary Cookies Under GDPR: What Qualifies?

Strictly necessary cookies are the cookies a website cannot deliver its core service without—session cookies, shopping-cart storage, login authentication, and security tokens—and they are the only cookie category exempt from consent under the EU's ePrivacy rules and GDPR. Everything else, including analytics and marketing cookies, must stay blocked until the visitor opts in. The exemption is deliberately narrow: if your site still works without a cookie, that cookie is not strictly necessary.

Quick definition: A cookie is strictly necessary when the service the visitor explicitly requested—loading the page, keeping a cart, staying logged in, checking out securely—cannot be provided without it. Convenience, analytics, and revenue are not "necessity" in the legal sense.

Ensuring your business is GDPR compliant matters for any store operating in the EU or serving EU customers, and cookies are one of the first things regulators check. Getting the "strictly necessary" boundary right is how you avoid fines while keeping checkout working from the first pageview.

What Are Strictly Necessary Cookies?

Strictly necessary cookies are cookies exempted from informed consent because they must be present for the website's core functionality. This includes cookies used for services the user has explicitly requested—keeping items in a cart, maintaining a login session, remembering a cookie-consent choice itself, or securing a payment.

Because these cookies are exempt from the consent requirement, the website can set them as soon as the user first interacts with the site. All other cookies must be blocked until the user agrees to their use.

The legal source of the exemption is Article 5(3) of the ePrivacy Directive (the EU "cookie law"), which allows storage or access on a user's device without consent in exactly two cases: when it is needed solely to transmit a communication, or when it is strictly necessary to provide a service the user explicitly requested. The GDPR then governs any personal data those cookies process. In its final Guidelines 2/2023 (adopted October 2024), the European Data Protection Board confirmed this rule applies broadly—not just to cookies but to pixels, tracking URLs, and other techniques that store or read information on a device.

Which Cookies Qualify as Strictly Necessary—and Which Don't?

The test regulators apply is simple: does the user lose the service they asked for without this cookie? Here is how that plays out for a typical eCommerce stack:

Two patterns are worth calling out because they trip up so many stores:

• Analytics is never strictly necessary. European regulators have been consistent on this: your site works without measurement, so measurement needs opt-in consent. "We need the data to run the business" is not the legal test.
• A cookie's category depends on what it does, not what it's named. A "functional" cookie that also feeds an advertising profile needs consent. And many cookies that qualify for the consent exemption still process personal data—which means GDPR duties (transparency, security, a lawful basis) apply even where consent doesn't. See Are Cookies Personal Data Under GDPR? for that distinction, and 7 Types of Website Cookies for the full taxonomy.

How to Audit Your eCommerce Stack for Strictly Necessary Cookies

Your Shopify store, payment processor, and analytics tools all inject cookies into your checkout flow. Before you can claim a cookie is strictly necessary, you need to know what's actually running on your site.

Start by mapping your tech stack. List every third-party service connected to your store: Shopify's built-in session cookies, Klaviyo for email capture, Meta Pixel for retargeting, Google Analytics, your payment gateway (Stripe, PayPal, Square), shipping calculators, live chat, and any other integrations.

Next, audit what cookies are actually set. Visit your homepage in a fresh browser session with developer tools open, add something to your cart, and go through checkout—all before interacting with the consent banner. Document each cookie: its name, which service created it, when it expires, and what it does. A faster route is an automated scan: PieEye's free GDPR cookie scan crawls your site and categorizes every cookie and tracker it finds, including the ones firing before consent.

Then ask, for each cookie: Does the user lose a critical function without this? A session cookie that keeps someone logged in? Necessary. A cookie that remembers they added a product to their cart? Necessary. A cookie that tracks which products they viewed for retargeting ads? Not necessary.

This audit forces honesty. Many eCommerce brands discover they're running more non-essential tracking than they realized—most often an analytics tool configured to fire before consent. Documenting everything also protects you if a regulator asks what cookies you use and why.

The Gray Zone: Legitimate Interest vs. Strictly Necessary

GDPR allows processing under "legitimate interest" as an alternative legal basis to consent. This creates confusion: if you claim a cookie is strictly necessary when it isn't, you're breaking the rules. But if you properly document a legitimate interest—like fraud prevention—some processing can proceed without consent, provided you meet the balancing test.

Here's the catch that trips people up: legitimate interest under GDPR does not override the ePrivacy consent requirement for setting non-essential cookies in the first place. The ePrivacy Directive takes precedence on the act of storing or reading a cookie, and it recognizes only consent or strict necessity. That's why "legitimate interest" toggles for advertising cookies keep losing in front of European regulators.

Where legitimate interest genuinely helps: your payment provider's fraud-detection cookies are typically defensible as strictly necessary for the payment service the customer requested, and backend processing of data you already hold can often rest on legitimate interest. But an analytics tool arguing that understanding user behavior "prevents cart abandonment and protects revenue"? That's not necessity, and it's not a winning legitimate-interest argument for device access either.

For your store, the practical sort is: payment and security cookies—strictly necessary. Session, cart, and consent-storage cookies—strictly necessary. Anything serving marketing, behavioral analysis, or advertising—consent, full stop. Document your reasoning for each cookie. If a regulator asks why you didn't request consent, you want to show clear logic, not a guess.

Building a Compliant Checkout Without Breaking Conversion

Your checkout is a hotbed of cookie conflicts. You need session cookies, CSRF tokens, and payment tokens to work. But you also want to personalize recommendations and track funnel drop-off.

The practical path: allow strictly necessary cookies to load immediately. This includes Shopify's session token, your payment processor's payment token, and any CSRF protection. Your checkout works from the first click.

Then, after the user consents, load marketing and analytics pixels. If a visitor never consents, those tags never fire. You lose some mid-funnel data, but you stay compliant—and with Google Consent Mode v2 (required for EEA/UK ad features since March 2024), Google can model some of the gap from consented traffic.

Test the flow both ways. Many eCommerce managers assume consent-gating hurts conversion, but the measured impact is usually smaller than feared—users who want to buy click through the banner, and users who refuse analytics were unlikely to be retargetable anyway. If you want to optimize the banner itself, see our guide to A/B testing cookie banners without breaking compliance.

Common Mistakes That Trigger Enforcement

Mislabeling cookies as strictly necessary isn't a paperwork error—regulators treat it as setting cookies without consent, and 2025 showed how expensive that gets. In September 2025, France's CNIL fined SHEIN €150 million for placing advertising cookies before any consent and for continuing to set and read cookies after users clicked "Reject All." The same day it fined Google €325 million, in part because refusing personalized-ad cookies took six clicks while accepting took two. The pattern regulators and courts now test is not "do you have a banner?" but "does your banner's promise match what your site actually does?"

The predictable traps:

• Labeling cookies "strictly necessary" without testing whether the site actually breaks without them. If your banner claims a cookie is necessary but your site works fine without it, you've made a false statement.
• Loading Google Analytics or ad pixels before consent because it "doesn't matter." It's the single most common gap automated audits find.
• Assuming your CMS or Shopify consent app handles blocking automatically. Some consent apps display a banner but never actually block anything. Spot-check with a fresh browser profile—or run a free cookie scan and compare the report against your banner's claims.
• Burying the cookie policy four links deep with no way to revisit choices.

One more thing to watch in 2026: the EU's proposed Digital Omnibus (published November 2025, still in negotiation) would move the cookie-consent rules from the ePrivacy Directive into the GDPR, mandate single-click "reject," and ban re-asking for six months after a refusal. The strictly-necessary exemption survives in every draft—so the audit work above stays valuable regardless of how the proposal lands.

Running a compliant store requires ongoing attention as your stack grows. A proper consent management platform enforces your cookie categories automatically—blocking non-essential tags until consent, logging every choice—rather than relying on manual checks that get overlooked during high-volume sales periods. For definitions of the consent and cookie terms used here, our privacy glossary is a good bookmark.