Cookies classified as essential are genuinely required for basic functionality
Why it matters
ePrivacy Art. 5(3) exempts from consent only cookies 'strictly necessary' for a service explicitly requested by the user — a narrow carve-out that does not cover analytics, A/B testing, or affiliate attribution. GDPR Art. 6(1)(b)'s performance-of-contract basis equally does not extend to tracking that serves the operator's interests rather than delivering the requested service. Miscategorizing GA as 'functional' to bypass the consent requirement is a documented enforcement priority: the Austrian DSB, Italian Garante, and CNIL have all found this specific misclassification to constitute an unlawful consent mechanism under GDPR Recital 47.
Severity rationale
Low because the error is a miscategorization in the registry rather than an operational tracking failure, but it undermines the legal basis for treating those cookies as consent-exempt and exposes the consent architecture to challenge.
Remediation
Audit every entry in the essential category against the strict-necessity test: would the site's core service fail for this user without this cookie? If the answer is 'no, but it helps us,' the cookie is not essential.
// src/lib/cookies/registry.ts
// WRONG — GA classified as essential to avoid consent
{ name: '_ga', category: 'essential', purpose: 'Site functionality' }
// CORRECT — GA classified as analytics, consent required
{ name: '_ga', category: 'analytics', purpose: 'Google Analytics tracking.' }
{ name: '_ga_XXXXXXXX', category: 'analytics', purpose: 'GA4 session tracking.' }
Legitimate essential cookies: auth session tokens, CSRF tokens, load balancer stickiness, user-selected language preference. Move everything else — A/B testing, affiliate tracking, 'remember me' persistence — to analytics, marketing, or preferences as appropriate.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- eprivacy · Art. 5(3) — ePrivacy Directive — exemption for strictly necessary cookies only
- gdpr · Art. 6(1)(b) — GDPR — processing necessary for performance of a contract (strictly necessary basis)
- gdpr · Recital 47 — GDPR — legitimate interests cannot override data subject rights for non-essential tracking
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated