SEO
What is a cookie on a website (and what you must declare)
A cookie is a text file a site stores in the browser. What you must declare depends on its purpose: technical, analytical or profiling.
Key points
- A cookie is a text file with a name, value, domain, expiry and security attributes; it is not a program.
- Consent is needed before loading any non-technical cookie, and refusing must cost as little as accepting.
- The legal basis is directive 2002/58/CE, article 5(3), plus the GDPR and article 122 of the Italian privacy code.
- The Garante set the detail in its guidelines of 10 June 2021, n. 231, applicable from 10 January 2022.
What is a cookie on a website: a small text file the site stores in the browser, and what you must declare depends on what that file does. A technical session cookie needs no consent; an advertising profiling cookie does, before it is written.
What a cookie actually contains
A cookie has a name, a value, a domain, a path and an expiry date. It carries no code and cannot read the disk: it can only be sent back to the server that set it. The attributes matter more than the value: HttpOnly hides it from JavaScript, Secure limits it to HTTPS, SameSite=Lax or Strict blocks cross-site requests.
Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=LaxThe difference from localStorage is technical, not legal: an identifier stored there that recognises a person falls under the same rules. The Garante guidelines speak of «cookies and other tracking tools», not cookies alone.
Three categories, three regimes
What the law says, article by article
The European rule sits in directive 2002/58/CE, article 5(3), amended by directive 2009/136/CE: storing information in the user's terminal requires informed consent, except what is strictly necessary to provide the service. Consent is read through regulation (EU) 2016/679 of 27 April 2016: article 6 for the legal basis, article 7 for the conditions, article 13 for the notice. In Italy the implementing rule is article 122 of the Personal Data Protection Code, decreto legislativo 30 giugno 2003, n. 196. The Garante set the detail in its cookie guidelines, provvedimento 10 giugno 2021, n. 231, applicable from 10 January 2022.
The banner: what it needs and what it must not do
How to check what your site installs
The first check needs no tooling: open the site in a private window and look at the response headers. The command below prints every Set-Cookie the server sends, which is the part many banners do not control.
curl -s -D - -o /dev/null https://example.com | grep -i "set-cookie"The second check is in DevTools, Application tab, Cookies section: there you also see what third-party scripts set after load. Compare that list with the one declared in the cookie policy: every extra entry is an incomplete declaration.
A privacy notice and a cookie policy are not the same document
The privacy notice, article 13 of regulation (EU) 2016/679, explains who processes the data, for which purposes and for how long. The cookie policy lists the tools installed, their duration and their purpose. You need both, reachable from every page. The minimum structure of a site that carries them is described in what a company site needs.
Where this guide stops
This page explains the framework, it does not certify a banner. Whether a consent is valid depends on context, audience and vendor: you need a lawyer or a privacy consultant, and the Garante judges case by case. A free template left unconfigured is the most common cause of a challenge.
What to do now
Frequently asked questions
Is a cookie a virus?
No. A cookie is a text file with a name and a value, not a program: it cannot run code or read files from the disk. The privacy risk comes from tracking, not from the file itself.
Do technical cookies need consent?
No, cookies strictly necessary for the service need no consent, as article 5(3) of directive 2002/58/CE states. They still belong in the cookie policy with duration and purpose.
How easy must refusing cookies be?
As easy as accepting. The Garante guidelines of 10 June 2021, n. 231, require refusal to sit at the same level as acceptance, with no extra steps.
Do Google Analytics cookies need consent?
It depends on the configuration. If the tool is set not to identify people and does not combine data, the Garante treats it like a technical cookie; if it profiles or shares data, prior consent is required.
How long may I keep a cookie?
The law sets no single ceiling: duration must match the declared purpose. The guidelines of 10 June 2021 ask for the shortest necessary duration and periodic consent renewal.