Do you need consent for first-party cookies?

Sometimes. First-party cookies are not automatically exempt from consent simply because they are set by the website being visited.

• Strictly necessary cookies: Authentication, security, or shopping-cart cookies may qualify for an exemption.

• Analytics cookies: May still require consent depending on their purpose and configuration.

• Advertising or profiling: First-party tracking used for these purposes can require prior consent.

The CNIL notes that first-party cookies can be used both for website functionality and advertising tracking, so the purpose matters more than who sets the cookie. CNIL guidance on first-party and third-party tracking