Which cookie categories should be off by default?

Cookie categories that depend on consent should be disabled by default until the user makes an active choice.

Common examples include:

• Strictly necessary: May remain active when the technology qualifies for an applicable exemption.

• Analytics: Should be disabled when its use requires consent.

• Advertising: Should be disabled where consent is required.

• Personalization: Should be disabled when it relies on consent.

• Functional: Must be assessed based on its actual purpose rather than its category name.

The key question is whether a technology requires consent under the rules that apply to the website. Category names alone do not determine whether a cookie can be enabled without consent.

A granular cookie consent setup should therefore define default states based on the actual purpose of each technology and any applicable exemptions.