Cookies are small text files that most websites store on users' devices.
They access the internet with the purpose of identifying individual devices that users have used to access.
Identifiers in cookies that let you recognise a visitor count as personal data under the GDPR; the claim that a cookie contains no personal data is therefore not always true. The law treats everything that stores something on a device or reads something from it in the same way (local storage, tracking pixels, device fingerprinting). When a cookie is read together with a web browser, it can be helpful to the website in providing user-friendly services, as cookies allow you to recognize visitors. Cookies thus enable the collection of data on the number of website visitors, new and previous visitors, and website usage, allowing you to upgrade and customize the website to the needs and desires of users.
Storing cookies is under the complete control of the user, as they can limit or disable cookie storage in the browser they use.
Why are cookies necessary?
Cookies are essential for providing user-friendly web services. The most common e-commerce functions would not be possible without cookies. They help the website remember individual preferences and experiences. This saves time, making browsing through web pages more efficient and enjoyable.
Why do websites use cookies?
There are several reasons for using cookies: their property of storing data about the state of an individual website (details about the customization of an individual website) helps in providing various web services (online stores), collecting statistical data, containing information about the habits of web users, and monitoring the frequency of visits to a particular website.
Companies can improve the efficiency of their websites and the appropriateness of the type, content, and number of ads they offer to users with the help of cookies. Of course, due to legislation and good user experience, it is necessary to provide information about cookies so that visitors can become acquainted with the type of cookies used, the reasons for their use, and the options for their removal or disabling.
Legal Regulation of Cookie Use
The rules come from the EU ePrivacy Directive and the GDPR, as implemented in national law, and are enforced by your national data protection authority. Check the rules in your country.
Without consent, only cookies that are necessary for a service the visitor has requested are allowed: cart, login, a language or currency the visitor chose, security and the stored consent choice. Analytics cookies are never essential.
You need consent for everything else: analytics (e.g. GA4), advertising cookies and pixels (remarketing), personalisation, social media plugins and embedded content that sets cookies (for example video). Scripts must not load before the visitor consents.
What Does the Law Require from Website Owners?
The law requires website owners to provide certain information to the user:
-
information about the types of cookies used by the website,
-
information about the purpose of collecting cookies, and
-
information about the method of using cookies.
Consent must be freely given, clear and informed; pre-ticked boxes do not count. The "Reject all" button must be as visible and as easy to reach in the banner as "Accept all" (buttons of different sizes or colours are a misleading design), and the visitor must be able to set consent by purpose. You must be able to withdraw consent as easily as it was given, and keep proof of it. As a rule you must also not block the site until the visitor accepts all cookies (a "cookie wall"). The cookie policy must state the types of cookies, the purpose, the duration and the provider. For Google's advertising features (remarketing, conversion measurement), Google requires consent signals in the European Economic Area (ad_storage, analytics_storage, ad_user_data, ad_personalization; Consent Mode v2). This is a condition of Google's tools, not a law. Without these signals you lose part of your measurement and targeting. For managing consent choose a consent management platform (CMP) that is compatible with it.
Example overview of cookies by type:
TYPE | PURPOSE | EXAMPLE | CONSENT |
essential | session, cart, login, chosen language or currency, security | session cookie | no |
analytics | measuring visits | _ga, _ga_<ID> (GA4) | yes |
advertising | remarketing, ad measurement | _gcl_*, _fbp | yes |
functional | wishlist, comparison, choices | custom | depends on purpose |
What if there is no consent
You must not recognise visitors covertly without consent, for example by device fingerprinting: that is tracking too and the same rule applies. Instead, use data from your store for actual sales, use analytics that does not store identifiers on the device and measures only totals (such analytics must also meet GDPR rules), or let Google fill the gap with conversion modelling enabled by Consent Mode v2; the legal assessment of this depends on the supervisory authority. Proposed changes to the EU cookie rules (the so-called digital omnibus) had not been adopted as of 13 October 2026. More in Online store legislation in the EU.
Frequently asked questions
Necessary (technical) cookies - cart, session, login, a language or currency the visitor chose themselves - are allowed without consent. Analytical cookies (GA4) are never essential; together with marketing (Meta Pixel, Google Ads) and personalization cookies they require the visitor's consent.
Yes - EU privacy rules and the GDPR require us to clearly inform visitors about cookie types and obtain consent for non-essential ones. The reject button must be as visible as the accept button, and analytics and advertising scripts must not load before consent. Without this, fines and supervisory measures are possible. We recommend implementing a proper cookie consent tool.
Choose a consent management platform (CMP) that gives visitors a reject option as visible as the accept option, settings by purpose, blocking of scripts until consent, withdrawal of consent and compatibility with Google Consent Mode v2. We offer setup and configuration as part of our maintenance or technical support service.
Blocking technical cookies (cart, session) disables store functionality - but these cannot legally be blocked. Blocking analytical cookies means you do not see accurate visitor numbers in Analytics.
Cookies enable saving the cart, search history, recently viewed products, and customized content. Personalization that is not essential for the store to work requires the visitor's consent; without it the experience is more generic.
My name is Anže, I am a certified Magento solution expert and the maker of several award-winning online stores. I am the architect of all Degriz projects.
Write to me →
Reading