Privacy ComplianceConsent Banners
What Is a Strictly Necessary Tracker? Why the Category Deserves Scrutiny
Consent banners place some trackers, such as cookies and scripts, in a strictly necessary category that visitors cannot switch off. The concept and term come from European law, where regulators define it narrowly. In the U.S., privacy laws generally do not define the category as explicitly. In either case, businesses should be able to justify each tracker they treat as strictly necessary or essential.
By Alex Proctor
Published October 24, 2026
Summary
Strictly necessary trackers are those that websites need to provide services that visitors requested, such as delivering the website's content, protecting it against attacks, running shopping carts and logins, and recording visitors' consent choices. European regulators generally exclude advertising and most analytics tools from the category. Because trackers in this category run regardless of visitors' choices, tools placed there by mistake escape the banner's control. I recommend that businesses review categorizations carefully whenever they add tools to their websites.
Where Does the Term Come From?
The term comes from Europe's ePrivacy Directive, which requires consent before websites store or read information on visitors' devices. The directive exempts storage or access that is "strictly necessary" to provide a service "explicitly requested by the subscriber or user."
European regulators read that exemption narrowly. Their joint guidance says that necessity has to be examined "from the point of view of the user, not the service provider." The United Kingdom's regulator describes the test as whether "without it the service couldn't be provided on a technical level."
In the U.S., consent banners often call the same category "essential." This Briefing uses the two terms interchangeably.
What Do European Regulators Treat as Strictly Necessary?
European and U.K. guidance generally sorts common tools this way:
| Generally Exempt from Consent | Generally Requires Consent |
|---|---|
|
|
Based on guidance from European, U.K., and French regulators, as of October 2026.
Analytics tools are the most common source of confusion. The European joint guidance says that analytics are "not strictly necessary to provide a functionality explicitly requested by the user." France exempts a limited form of audience measurement, but its regulator notes that most large analytics offerings do not qualify. On advertising, the United Kingdom's regulator states that "there are no advertising purposes that meet the strictly necessary exception."
What Role Does the Category Play in the U.S.?
State privacy laws in the U.S., including California's, generally do not define strictly necessary trackers. They focus on what happens to personal information rather than on how banners label trackers. California's law, for example, asks whether personal information is sold or shared, and whether the vendor that receives it is a service provider or a third party.
Wiretapping claims do not depend on the label either. Courts are divided on when a vendor counts as a third party, with some asking whether it used the data for its own purposes and others asking only whether it could. In a 2025 ruling about customer service calls, a federal judge in California wrote that a contractual limit on a vendor's use of the data "is irrelevant to the question of its capabilities." Tools that banners label as necessary may still be the subject of claims.
Operationally, however, the category is very useful for complying with U.S. laws. Consent platforms rely on categories to act on visitors' choices, so that tools used to sell or share data stop when visitors opt out while the tools that websites need keep running. A well-defined essential category lets businesses honor opt-outs without breaking their websites.
How Do Trackers End Up in the Wrong Category?
Consent platforms typically scan websites and sort the trackers that they find into categories automatically. Trackers that the scan does not recognize may be left without a category. Some platforms do not block uncategorized trackers by default, so those trackers run regardless of visitors' choices.
New York's Attorney General examined this problem in a guide for businesses, even though the state does not have a comprehensive consumer privacy law. The office relies instead on consumer protection laws, which it says require privacy controls to "work as described." The guide states, "If a tag is miscategorized, or not categorized at all, it will not respond to the tool's controls." The office reported that uncategorized tags were "the leading cause of broken privacy controls," affecting seven of the 13 websites that it identified.
Trackers can also be placed in the necessary category on purpose, because blocking them would break part of the website. Security checks on forms are a common example. However, an Austrian court held in 2024 that one such tool, Google's reCAPTCHA, was not technically necessary for websites to operate.
France's regulator has also acted on the label itself. In November 2025, it fined a publisher 750,000 euros, in part because some cookies "appeared as 'strictly necessary' cookies" without useful information about their purposes.
How Should Businesses Decide What Is Necessary?
Tools that websites need in order to function, such as shopping carts and logins, belong in the necessary category and stay on regardless of visitors' choices. Analytics and advertising tools generally belong in the non-essential categories, so that they stop when visitors disable tracking. Tools without a category need to be assigned to one.
I recommend that businesses confirm that each tracker in the necessary category supports a service that visitors requested, and record why. Borderline trackers, such as security checks, fraud detection, and basic measurement, deserve the closest review, because regulators and courts have treated them differently.
Questions
Is Google Analytics a strictly necessary tool?+
Generally not in Europe. France's regulator says that most large analytics offerings fall outside its exemption for audience measurement, regardless of how they are configured. In the U.S., no rule requires analytics tools to be switched off by default. The answer depends instead on whether the data is sold or shared, and on what businesses have told their visitors.
Are security and fraud prevention tools strictly necessary?+
Often, yes, when they protect the service that visitors requested. European guidance lists security cookies that are centered on the user among its exempt examples. However, the same guidance says that fraud detection for advertising, such as click fraud detection, is not exempt. Tools that serve both purposes are generally judged by the purpose that is not exempt.
Are functional trackers strictly necessary?+
Usually not. Many banners place features that improve the experience without being required, such as saved preferences, in a separate functional category that visitors can switch off. European guidance exempts some of these, such as a language choice that visitors ask websites to remember, but generally only for the length of a browsing session. Remembering the choice for longer generally requires visitors' consent.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.