cookie-consent
Cookie Consent
Overview
The ePrivacy Directive (implemented in national law; the UK has PECR) requires prior consent before storing or reading non-essential data on a user's device, and the GDPR defines what valid consent is. GDPR fines reach EUR 20 million or 4% of global annual turnover, whichever is higher; national regulators (CNIL, the Italian Garante, the Dutch AP and others) actively fine cookie banners that make rejecting harder than accepting.
Strictly necessary storage needs no consent: login session, CSRF token, shopping cart, load balancing, and a preference the user explicitly set (for example a language switch they just clicked). Everything else needs consent first: analytics, advertising, personalization, embedded third-party media.
This skill is engineering guidance, not legal advice; have counsel check the wording and your cookie list.
| Category | Examples | Consent needed |
|---|---|---|
| Strictly necessary | Auth session, CSRF token, cart | No |
| Functional | Remembered preferences not explicitly chosen, chat widgets | Yes |
| Analytics | Google Analytics 4, Mixpanel, Hotjar | Yes |
| Marketing | Meta Pixel, Google Ads, retargeting | Yes |