Strictly necessary cookies
Strictly necessary cookies are cookies without which a service the user explicitly asked for cannot work, such as a login session or a shopping cart, and they are exempt from the consent requirement.Article 5(3) of the ePrivacy Directive has two exemptions from consent: storage or access whose sole purpose is carrying out the transmission of a communication, and storage or access that is strictly necessary for an information society service explicitly requested by the user. Cookies in the second group are what banners call necessary.
The test is narrow. The Article 29 Working Party's Opinion 04/2012 accepts user-input cookies (a cart, a form), authentication session cookies, security cookies (for example against repeated failed logins), multimedia player session cookies, load-balancing cookies, and the cookie that stores the visitor's consent choice. It does not accept analytics or advertising cookies, even when the site owner considers them essential to its business. Being first-party or short-lived does not make a cookie necessary; its purpose does.
Necessary cookies still need to be disclosed. The cookie policy lists them with their purpose and lifetime, and the banner shows the category as always active, without a toggle. Some laws use the idea more broadly: Brazil's ANPD accepts legitimate interest for strictly necessary cookies. If a cookie in this category is used for anything else, such as tracking a returning visitor for marketing, the exemption no longer applies. The cookie audit checklist helps sort them.