We have an ecommerce site, and the promocode the user provides on the shopping bag is stored as a session cookie. Is this considered a strictly necessary cookie?

If the user rejects non-essential cookies should we show an error to the customer?

I read our regulation about this (UK's ICO), but it is not clear about this type of situation. I guess if someone knows the logic for the EU regulation, it would probably be the same for the UK.

1 Answer 1


https://gdpr.eu/cookies/ has a good summary of cookie usage under the GDPR in very readable language. It says:

Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies.

A first-party session cookie that is needed for functionality of the site to work would be classified as a "strictly necessary cookie." Your promo code cookie is strictly necessary to be able to claim the promotional discount.

If a user rejects non-essential cookies, you are NOT ALLOWED to block access to the site with an error message. The site is required to allow users to access it even if the user chooses not to store preference long term, or doesn't consent to tracking for statistics and marketing purposes. If the site can't be made to work without a first-party session cookie, that is a strong sign that that cookie is strictly necessary.

  • Thanks, my understanding from ICO guide (link) now is the same when I read the user-input exemption part Oct 7, 2021 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.