Cookies split into four practical categories: strictly necessary, preferences, statistics and marketing. Only the strictly necessary ones (session, cart, the consent choice) need no consent — the rest do, before they fire. The most common trap is calling analytics "essential" to avoid the banner; it is not, and misclassifying it makes you non-compliant.
What are the four cookie categories?
It does not matter what the vendor calls them; in practice, every cookie falls into one of four categories, and the line that matters legally is between "strictly necessary" and everything else:
- Strictly necessary — without them the site does not work (authentication, cart, security, remembering the consent choice). These do not need consent.
- Preferences — remember user-chosen settings (language, region, theme). These need consent.
- Statistics — measure traffic and behaviour (analytics). These need consent.
- Marketing — remarketing, ad measurement, audience matching (pixels, ads cookies). These need consent.
The rule is simple: if a cookie does something the visitor did not explicitly ask for in order to use the site, it needs prior consent under Law 506/2004.
Concrete examples: what is essential and what is not
The theory is easy; let's look at real cookies, by category:
| Cookie | Category | Consent? |
|---|---|---|
| Session / authentication ID | Strictly necessary | No |
| Cart contents | Strictly necessary | No |
| The cookie that stores the consent choice | Strictly necessary | No |
| Chosen language / region | Preferences | Yes |
_ga, _ga_<ID> (Google Analytics) | Statistics | Yes |
_fbp (Meta Pixel) | Marketing | Yes |
| Google Ads / DoubleClick cookies | Marketing | Yes |
Notice the line: the cart is essential, but analytics that "just counts visitors" is not. Want to know which category your site's cookies fall into? Our glossary of 1,300+ documented cookies tells you each one's purpose and category.
The trap: "analytics is essential"
The most common compliance mistake is not the missing banner — it is reclassification. Someone puts Google Analytics in the "strictly necessary" bucket so they can fire it without consent, arguing "I need statistics to run my business".
Your business need does not change the category. "Strictly necessary" means necessary for the visitor to use the site, not necessary for you to optimise it. Analytics is useful, but the site works perfectly without it — so it is statistics, not essential, and it needs consent. Likewise, a marketing pixel "so my ads work" stays marketing, however commercially important it feels.
Misclassification is dangerous precisely because it looks compliant: you have a banner, you have categories, but the categories lie. A scanner that looks at what actually fires, not at the labels, catches this immediately.
How to identify which cookies your site sets
You can't classify what you haven't inventoried. The practical steps:
- Run a free scan — it lists the cookies and trackers that fire, including the ones firing before consent.
- Look up each cookie in the glossary of 1,300+ cookies to find its purpose and real category.
- Check manually in the browser's Application tab (Storage → Cookies) which keys appear before and after accept.
- Map every cookie to one of the four categories and block everything that isn't strictly necessary until consent.
From inventory to a compliant banner
Once you know the categories, the banner must reflect exactly that split and genuinely block each non-essential category until accept. This is where many free banners fail: they display nice categories but don't stop the scripts behind them.
A CMP like FewCookies actually blocks the preferences, statistics and marketing categories until consent, sends all four Consent Mode v2 signals, and generates the cookie policy straight from what the scan finds — in Romanian and English, at €6/month (tax included, 7-day trial without a card). The correct category for each cookie is also the basis of a cookie policy that doesn't drift from reality. For the legal framework behind it, see Romania's Law 506/2004 explained.
Frequently asked questions
Does the cookie that remembers I rejected need consent?
No. The cookie that stores the consent choice (including a rejection) is strictly necessary: without it, the banner would reappear on every page. It is the only consent cookie you are allowed to set without prior accept.
What category are cookies from a chat widget or embedded YouTube?
Usually marketing or statistics, depending on the provider, and almost never strictly necessary. An embedded YouTube sets Google cookies before playback, so it should only load after consent (or in "privacy-enhanced" mode, which still needs attention).
Can I have a single "accept all" category to simplify things?
You can show an "accept all" button, but you must also offer an equally easy reject and the ability to choose by category. A banner that only offers "accept" does not collect valid consent, because it is not a free choice.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →