No. No article of the General Data Protection Regulation (GDPR) requires websites to sort cookies into categories, and the GDPR does not prescribe any list of categories. Grouping cookies into categories such as “necessary”, “analytics” and “marketing” is a common way of presenting choices, not a legal requirement in itself. What the law does require is that consent is specific to each purpose.
Where Cookie Rules Come From
In the EU, the main rule for cookies is Article 5(3) of the ePrivacy Directive, not the GDPR. It allows a website to store information on a user’s device, or to access information already stored there, only if the user has given consent after receiving clear and comprehensive information, including about the purposes. Each EU country applies this rule through its own national law.
Two kinds of storage or access are exempt from consent: those used only to carry out the transmission of a communication over a network, and those strictly necessary to provide a service the user has explicitly requested.
The rule applies whether or not the information stored or accessed is personal data. The EU Court of Justice confirmed this in its 2019 Planet49 judgment (Case C-673/17). Where cookies do involve personal data, the GDPR applies as well.
What Consent Has to Look Like
Consent for cookies has the same meaning as consent under the GDPR: a freely given, specific, informed and unambiguous indication of the user’s wishes, given by a statement or a clear affirmative action. In practice:
- Consent is specific: where cookies serve several purposes, users should be free to choose which purposes they accept, rather than having to accept everything at once.
- Consent is informed: in Planet49, the Court said the information given to users includes how long cookies will operate and whether third parties may have access to them.
- A pre-ticked box is not valid consent.
- Users can withdraw consent at any time, and withdrawing must be as easy as giving consent.
Why Categories Are Common
Because consent has to be specific to each purpose, many websites group cookies by purpose, such as analytics or advertising, and let users accept or refuse each group. This is one way to offer purpose-level choices. The categories a site uses should reflect what its cookies actually do, and whether a cookie is exempt from consent depends on its purpose, not on the label it is given.
A consent management platform can help present these choices and keep a record of the consent given.
Conclusion
The GDPR does not require cookie categories. EU cookie consent comes from Article 5(3) of the ePrivacy Directive, which requires consent before non-exempt cookies are stored or read, whether or not they involve personal data. Consent must be specific to each purpose, and grouping cookies by purpose is a common way to give users that choice.
This article is general information, not legal advice.