Cookie Categories
Understanding how Cookiewise categorizes cookies and how to manage them.
The Five Categories
Cookiewise classifies every detected cookie into one of five standard categories, aligned with IAB Europe's Transparency & Consent Framework:
Necessary
Essential for the website to function. These cannot be disabled by the user.
Examples: Session IDs, CSRF tokens, authentication cookies, load balancer cookies, cookie consent preferences.
Functional
Remember user preferences and enhance functionality. Not strictly necessary but improve the experience.
Examples: Language preferences, region selection, accessibility settings, UI customization, chat widget state.
Analytics
Collect anonymized data about how visitors use the website. Help site owners understand traffic patterns.
Examples: Google Analytics (_ga, _gid), Hotjar (_hjid), Plausible, Matomo, Amplitude.
Marketing
Track visitors across websites for advertising purposes. Used for retargeting and ad personalization.
Examples: Facebook Pixel (_fbp), Google Ads (_gcl_au), LinkedIn Insight Tag, TikTok Pixel, ad network cookies.
Social Media
Enable social sharing features and embedded content. May track users across sites.
Examples: Twitter widgets, Instagram embeds, YouTube video cookies, Facebook comments, LinkedIn share buttons.
Auto-Categorization
Cookiewise assigns a category after the scan, not while the page is loading. The classifier tries sources in this order:
- Exact cookie name in the local knowledge base (common analytics, ads, CMS, and consent cookies)
- Longest prefix match — e.g.
_ga_→ Analytics,wordpress_→ Necessary - Cookie domain — e.g.
doubleclick.net→ Marketing,youtube.com→ Social - Open Cookie Database rules imported into the same knowledge base
- Claude AI for leftovers, with a confidence score (high / medium / low)
- Known vendor scripts that load after Accept without writing a cookie yet — matched against a hand overlay plus Open Cookie Database platforms, and listed as Functional / Analytics / Marketing / Social with “cookies on use”
- Unrecognised hosts that load after Accept and match no catalog vendor — added to the review queue as
unknownuntil you assign a category
Low-confidence and unrecognised items are placed in a review queue. HttpOnly and Secure flags are stored on the inventory record; they are not used as a category heuristic.
Categories follow common CMP groups (necessary, functional, analytics, marketing, social). They are not IAB TCF vendor IDs.
Manual Overrides
You can manually change a cookie's category at any time from the Cookie Scanner results page. Manual categorizations are preserved across future scans - the scanner will not overwrite your custom assignments.
This is useful for:
- Custom first-party cookies that the auto-categorizer doesn't recognize
- Cookies that serve a different purpose on your specific site
- New third-party cookies not yet in our database
Category Display in Banner
The consent banner automatically shows toggle switches for each category (except Necessary, which is always on and cannot be disabled). The number of cookies in each category is displayed to give users informed control.