Which consent category does each third party script belong in?

All posts

Assign by purpose, not by vendor. Strictly necessary if the site cannot deliver what the visitor asked for without it, functional if it remembers a preference they set, analytics if it measures behaviour, marketing if it targets or attributes advertising. When a script serves two purposes, take the later category in that order.

The category follows the purpose, not the product

Every consent tool hands you the same four or five boxes and asks you to sort your tags into them. The vendor documentation tells you what each cookie stores and for how long. Nothing joins the two, which is why so many estates end up putting everything in analytics and moving on.

That single habit produces both failure modes at once. Consent gets collected for things that never needed it, so the banner asks for more than it has to. Meanwhile advertising tools sit in a category people said yes to for a completely different reason, which is the assignment that actually carries risk.

The way out is to stop thinking in products. One vendor can occupy several categories at the same time. A tag that keeps a session alive, measures a funnel and builds a remarketing audience is doing three jobs, and the category follows the job rather than the logo on the script.

Two things are worth fixing in place first. The category names are a convention, so your consent tool's labels will not match anyone else's exactly. The requirement underneath them is not: in the EU and UK, anything outside the strictly necessary exemption needs an opt in before it runs, whatever box you filed it in. The ordering matters too, because necessary, functional, analytics and marketing run from least to most restrictive.

The test, step by step

1. Write the purpose in one sentence

   Name what the script does and who benefits. If the sentence needs the word and, you have more than one purpose and probably more than one category.

2. Test the strictly necessary claim first

   Ask whether the visitor would lose something they explicitly asked for if this did not run, not whether the business would lose something. Login sessions, baskets, checkout security and the consent record itself pass. Very little else does.

3. Separate remembering from measuring

   Functional covers a preference the visitor set, such as language, currency or the fact they dismissed a notice. The moment that same store is read to build a report, it has become analytics.

4. Ask whether the data reaches an advertising ecosystem

   If the vendor can match the visitor to an advertising profile or attribute a conversion to a campaign, it belongs in marketing however the vendor describes it. Attribution is advertising: a Google Ads conversion tag is a marketing tag even though the number it produces looks like a measurement.

5. When two purposes apply, take the stricter category

   A tag that measures a funnel and builds a remarketing audience is a marketing tag. The strictest applicable category is the only assignment that survives a question without an argument, and it is where you would end up anyway.

The four that do not sort themselves

Most tags land in an obvious box. Four kinds reliably do not.

Fraud prevention and bot blocking is the genuinely contested one. A risk check running inside a payment the visitor is submitting has a real exemption argument, because removing it breaks what they came to do. A tool that scores all arriving traffic to protect an advertising budget does not, because the beneficiary is the business. Where the argument is still open, gate it and keep the reasoning written down.

A/B testing and personalisation almost always need consent. Splitting traffic means storing which variant somebody saw, and the purpose is optimising the business rather than delivering what was requested. If your consent tool offers a personalisation category, use it; if it does not, these belong with marketing rather than with functional.

Error monitoring and performance carry the strongest non obvious exemption case, and it usually still fails. Reporting a stack trace so the site keeps working is defensible. Attaching a persistent identifier so one person can be followed across sessions is measurement wearing a reliability label, and that is the deciding detail.

Session recording and heatmaps are not ambiguous in law, only in habit. They record what a visitor did on the page. That is analytics at best, and because of what a recording can capture it deserves a clearer mention to visitors than a line in a table.

What guessing costs, in each direction

Over gating is the cheaper mistake. Put a genuinely necessary tool in analytics and it stops for everyone who declines, which costs you measurement and sometimes function. One case deserves naming: the record of the consent choice itself must never sit behind consent, or the banner cannot remember the choice and asks again on every page.

Under gating is the expensive one. Put a marketing tool in necessary or functional and it runs for people who explicitly refused. That is the defect enforcement has actually pursued, and unlike most compliance questions it is visible from outside your organisation in a single page load, by anyone who cares to look. We wrote up the most common version of it in why the Facebook pixel still loads when your tags are blocked.

The asymmetry is the whole reason to take the stricter category while a case is unresolved. Over gating is a cost you can measure and reverse in an afternoon. Under gating is a disclosure, and the exposure runs backwards over every visitor since the tag went in. For where that exposure actually comes from, what regulators actually sanction is the companion piece.

Verify the assignment rather than trusting the panel

Your consent tool's category list shows what you declared. It does not show what the page does. Those are different claims, and only the second one is the compliant state.

Check it the short way. Open the site in a clean profile, refuse everything, reload, and read the cookies, the local storage and the browser's resource timing entries. Anything from a refused category that is still present is either in the wrong box or not gated at all, and the consent tool's own reporting cannot tell you which. Repeat after any release that adds a tag, because this regresses quietly.

Getting the categories right is most of what a consent layer is for, which is why Velo ships the category mapping and the blocking as one thing rather than leaving you to reconcile a panel against a page.