What are cookies, and why does every website ask for your permission?
Cookies, privacy — often-mentioned words, but what do they mean exactly? And why should a business owner care?
Everyone has heard the word 'cookie' — but few know exactly what it does and why it matters. Yet it's an important question for every website owner, because which cookies you use isn't just a data protection obligation, but a business decision too.
What exactly is a cookie?
A cookie is a small text file that a website stores in the visitor's browser. What's it good for? Recognising a returning visitor, keeping the cart's contents, remembering settings (e.g. language, dark mode), and it can collect measurement data too — such as which page you were on.
It isn't malicious in itself — it was originally invented precisely to improve the user experience. The trouble began when marketing systems started using them to track visitors across sites.
Three kinds of cookie, three completely different roles
Necessary cookies — the site doesn't work without these. E.g. login state, cart contents, security tokens. No separate permission is needed for these, because they're required for the site's basic operation.
Statistics (analytics) cookies — e.g. Google Analytics. Tells you how many visitors you have, where they come from, which page is popular. Consent is required.
Marketing cookies — e.g. Meta Pixel, Google Ads. These serve to show the visitor targeted ads later. Consent is required here too, on much stricter terms.
Why do you have to ask for permission?
Under the GDPR (the EU data protection regulation), the user must know what data you collect about them, and must give their prior, informed consent. Statistics and marketing cookies fall under this.
The 'it's in the privacy notice' approach isn't enough — the visitor has to actively say yes, and has to be able to decline just as easily.
From a business perspective, what's at stake?
There are two sides: legal and business. On the legal side, authorities issue real fines — the Hungarian data protection authority has already imposed multi-million-forint penalties on Hungarian websites for faulty cookie handling.
On the business side: if cookie handling is set up wrong, or you measure data you don't have permission for — your marketing spend underperforms too. A well-configured system isn't just secure, it also gives more accurate data.
How do you know yours is in order?
Ask the questions: is there a cookie banner on the site? Can the visitor separately allow statistics and marketing cookies? Is there a privacy notice listing the cookies used? Is consent stored (audit trail)?
If the answer to any of these is 'no' or 'not sure', it's worth having the system reviewed. A proper setup builds the trust of visitors, not just the authorities.
Want to review your cookie handling and GDPR compliance?
As part of our operations package we help set up cookie handling and take care of ongoing compliance — so you don't put your website's legality at risk.