Skip to main content
C
CookieBeam
Back to Guides
Setup4 min read

How to Categorize Your Cookies in CookieBeam

A practical, step-by-step guide to assigning every cookie on your site to the right consent category in CookieBeam, from auto-classification to manual overrides.

Why Cookie Categorization Matters

Every cookie consent banner needs to tell visitors what each cookie does and why it is set. Regulators like the ICO, CNIL, and California's AG expect you to group cookies into clear categories so users can make informed choices. Getting categories wrong is one of the most common reasons consent banners fail an audit.

CookieBeam uses four standard categories that map directly to the IAB Transparency and Consent Framework and to Google Consent Mode v2 signals.

The Four Categories

Necessary (Strictly Necessary)

Cookies that the site cannot function without. These are always active and do not require consent. Examples: session identifiers, CSRF tokens, load-balancer affinity cookies, and shopping-cart state. A cookie is necessary only if removing it would break core functionality for the visitor.

Analytics (Performance / Statistics)

Cookies used to measure how visitors interact with the site. They help you understand page views, bounce rates, and traffic sources, but they are not essential for the site to work. Examples: Google Analytics (_ga, _gid), Plausible, Hotjar session cookies, and Microsoft Clarity.

Marketing (Advertising / Targeting)

Cookies that build a profile of visitor interests or track them across sites for ad targeting, retargeting, or conversion measurement. Examples: Meta Pixel (_fbp, _fbc), Google Ads (_gcl_au), LinkedIn Insight Tag, and any third-party ad-network identifiers.

Preferences (Functionality)

Cookies that remember choices a visitor has made, such as language, region, dark-mode setting, or a closed notification. Removing them does not break the site, but degrades the experience. Examples: locale, theme, dismiss-banner cookies.

How CookieBeam Categorizes Automatically

When you run a Cookie Scan from the dashboard, CookieBeam's scanner visits your site, detects every cookie set on load and after interaction, and classifies each one using a multi-layered approach:

  1. External Database Lookup — cookies are matched against an open-source database of 50,000+ known cookies with pre-assigned categories and vendor metadata.
  2. Domain-Rule Matching — if the cookie's domain matches a known vendor pattern (for example, .doubleclick.net is always Marketing), the category is assigned by rule.
  3. AI Fallback — for cookies not found in the database or rules, CookieBeam sends the cookie name, domain, and page context to a classification model that predicts the most likely category.

After the scan completes, every detected cookie appears in the Inventory tab with its assigned category, vendor, and a confidence indicator.

Reviewing and Correcting Categories

Automatic classification is accurate for well-known cookies, but you should always review the results, especially for:

  • Custom first-party cookies your development team sets (the scanner may not recognise them)
  • Cookies flagged as "Uncategorized" that need a manual decision
  • Analytics vs. Marketing edge cases (some tools set cookies in both categories)

To change a category, open the cookie in the Inventory view and select the correct category from the dropdown. Your change is saved as a Manual Override and will persist across future scans.

Manual Overrides

Manual overrides let you correct or pin a category for any cookie. They take the highest priority in the classification chain, so a manual override always wins over the database, domain rules, and AI.

Common use cases for overrides:

  • A first-party analytics cookie your team created that the database does not know
  • A vendor cookie the AI misclassified (for example, a functional cookie flagged as Marketing)
  • A cookie that changed purpose after a vendor update

You can manage overrides in bulk from Settings → Cookie Database → Manual Overrides. Changes sync across all banners that use the shared cookie database.

Edge Cases and Common Mistakes

Is it Necessary or Preferences?

If the site breaks without the cookie (login fails, cart empties, form loses state), it is Necessary. If the site works but the experience is worse (wrong language, light mode instead of dark), it is Preferences. When in doubt, ask: "Can the visitor complete their primary goal without this cookie?"

Is it Analytics or Marketing?

If the cookie only measures aggregate behaviour on your site (page views, scroll depth), it is Analytics. If the data leaves your site to build a cross-site profile or target ads, it is Marketing. Google Analytics in default mode is Analytics; once you enable Google Signals or link to Google Ads, those cookies become Marketing.

Consent Mode mapping

CookieBeam maps each category to a Google Consent Mode v2 signal automatically: Necessary → always granted; Analytics → analytics_storage; Marketing → ad_storage, ad_personalization, ad_user_data; Preferences → functionality_storage. You do not need to configure this mapping manually.

Keeping Categories Up to Date

Cookies change. Vendors add new trackers, your team ships new features, and third-party scripts evolve. Schedule regular scans (CookieBeam can run them automatically on a daily, weekly, or monthly cadence) and review any new cookies that appear in the Inventory marked as Uncategorized.

Treat your cookie inventory the same way you treat your dependency list: review it periodically, remove what you no longer use, and keep the metadata accurate. A well-maintained inventory is the foundation of a compliant consent banner.

Back to all guides