Cookie Categories

Understanding how Cookiewise categorizes cookies and how to manage them.

The Five Categories

Cookiewise classifies every detected cookie into one of five standard categories, aligned with IAB Europe's Transparency & Consent Framework:

Necessary

Essential for the website to function. These cannot be disabled by the user.

Examples: Session IDs, CSRF tokens, authentication cookies, load balancer cookies, cookie consent preferences.

Functional

Remember user preferences and enhance functionality. Not strictly necessary but improve the experience.

Examples: Language preferences, region selection, accessibility settings, UI customization, chat widget state.

Analytics

Collect anonymized data about how visitors use the website. Help site owners understand traffic patterns.

Examples: Google Analytics (_ga, _gid), Hotjar (_hjid), Plausible, Matomo, Amplitude.

Marketing

Track visitors across websites for advertising purposes. Used for retargeting and ad personalization.

Examples: Facebook Pixel (_fbp), Google Ads (_gcl_au), LinkedIn Insight Tag, TikTok Pixel, ad network cookies.

Social Media

Enable social sharing features and embedded content. May track users across sites.

Examples: Twitter widgets, Instagram embeds, YouTube video cookies, Facebook comments, LinkedIn share buttons.

Auto-Categorization

Cookiewise assigns a category after the scan, not while the page is loading. The classifier tries sources in this order:

  1. Exact cookie name in the local knowledge base (common analytics, ads, CMS, and consent cookies)
  2. Longest prefix match — e.g. _ga_ → Analytics, wordpress_ → Necessary
  3. Cookie domain — e.g. doubleclick.net → Marketing, youtube.com → Social
  4. Open Cookie Database rules imported into the same knowledge base
  5. Claude AI for leftovers, with a confidence score (high / medium / low)
  6. Known vendor scripts that load after Accept without writing a cookie yet — matched against a hand overlay plus Open Cookie Database platforms, and listed as Functional / Analytics / Marketing / Social with “cookies on use”
  7. Unrecognised hosts that load after Accept and match no catalog vendor — added to the review queue as unknown until you assign a category

Low-confidence and unrecognised items are placed in a review queue. HttpOnly and Secure flags are stored on the inventory record; they are not used as a category heuristic.

Categories follow common CMP groups (necessary, functional, analytics, marketing, social). They are not IAB TCF vendor IDs.

Manual Overrides

You can manually change a cookie's category at any time from the Cookie Scanner results page. Manual categorizations are preserved across future scans - the scanner will not overwrite your custom assignments.

This is useful for:

  • Custom first-party cookies that the auto-categorizer doesn't recognize
  • Cookies that serve a different purpose on your specific site
  • New third-party cookies not yet in our database

Category Display in Banner

The consent banner automatically shows toggle switches for each category (except Necessary, which is always on and cannot be disabled). The number of cookies in each category is displayed to give users informed control.