One of the most common misconceptions about cookie consent is that websites need permission for every cookie they use. In fact, the opposite is true.
Under the ePrivacy Regulations, the important distinction is not between cookies and no cookies. It is between essential cookies, which are necessary for a website to function, and non-essential cookies, which require the user’s consent.
That distinction matters because many cookie consent mechanisms are asking visitors the wrong question.
What Is an Essential Cookie?
An essential cookie is one that is genuinely required for the website to provide the service the visitor has asked for.
Take an online shop as an example. If you add an item to your basket and then move to another page, the website needs some way of remembering what you’ve already selected. Without that cookie, your shopping basket would empty every time you clicked a new page.
That is an essential cookie. It exists to make the website function in the way the visitor expects. By contrast, cookies used for advertising, analytics or marketing are not essential to delivering the service the visitor came to use.
So Why Are Websites Asking Me to Accept Essential Cookies?
In most cases, they shouldn’t be.
If a cookie is genuinely essential to the operation of the website, a website visitor does not have to consent to its use. The only question that needs to be asked is whether they consent to the use of non-essential cookies.
That means websites should not be asking “Do you accept cookies?” but instead “Do you accept non-essential cookies?”
Framing the choice this way is both clearer for users and a more accurate reflection of what the law is trying to achieve.
Why This Matters
Many cookie banners create unnecessary confusion by presenting visitors with options such as:
- Accept All Cookies
- Accept Essential Cookies Only
- Reject All Cookies
At first glance, that looks sensible.
The difficulty is that if the website still works after you click “Reject All”, then the essential cookies were almost certainly loaded anyway. Otherwise the website could not function.
In reality, “Reject All” most often means “Reject all non-essential cookies”. Essential cookies continue to operate because they are necessary for the service the visitor has requested.
That is why clear language matters. Visitors should understand exactly what choice they are making rather than being presented with a choice they cannot actually make.
Marketing Cookies Are Not Exceptions to the Rule
Some website operators had argued that marketing cookies are essential because advertising pays for the website or because targeted advertising is an important part of their business model. Regulators have consistently taken a different view.
When deciding whether a cookie is essential, the focus is on whether it is necessary for the visitor to use the service they have requested, rather than how valuable it is to the website owner. Advertising cookies, analytics cookies and other forms of tracking may all have commercial value, but that does not make them essential in the legal sense.
Don’t Make Saying “No” Difficult
Another common problem is the design of cookie banners themselves.
Some websites make it very easy to accept cookies while making it much harder to reject them. The “Accept” button is large and obvious, while the option to decline is hidden behind several additional clicks or buried in a settings menu. Regulators have increasingly criticised these kinds of designs, often referred to as “dark patterns”, because they steer users towards a particular choice rather than allowing them to make a genuine decision.
If you are asking for consent, visitors should be able to refuse just as easily as they can agree.
Good Cookie Banners Are Surprisingly Simple
Many businesses assume cookie compliance requires lengthy banners filled with technical language, but good cookie notices are often much simpler.
- Identify which cookies are genuinely essential to the operation of the website. Those cookies do not require the visitor’s consent.
- Then explain clearly which non-essential cookies you would like to use, why you would like to use them, and give visitors a genuine choice about whether to accept them.
The aim is straightforward: ask for consent where consent is required, explain the choices clearly, and make it easy for visitors to decide.
Simon McGarr
Simon McGarr is a graduate of UCD and GMIT. He has been a lawyer with McGarr Solicitors since qualifying as a solicitor in 2008.