Strictly necessary is the only category that does not need consent, which makes it the category everything gets quietly moved into. The test is narrow and it is written from the visitor's point of view: the storage has to be required to provide the service that the visitor has explicitly requested. Not useful to you, not required by your vendor, not part of how your business runs. Required to deliver the thing they asked for.
The four that almost always qualify
A session identifier that keeps a logged-in user logged in. A shopping basket. A load balancing or routing value that decides which server answers. And the record of the cookie choice itself, because the site cannot honour a decision it cannot remember. These four cover the overwhelming majority of legitimate entries in this category on a small company site, and a list here that is much longer than four is worth re-reading line by line. Everything else on a typical list is there because somebody could construct an argument, and a constructed argument is exactly what this category is not for. If your strictly necessary list runs to a dozen entries, the fastest way to find the problem is to read each one aloud finishing the sentence: the visitor asked for this page, and without this cookie that page would not work. Most of them will not survive the sentence.
Security and fraud prevention, with care
A token that prevents cross-site request forgery on a form the visitor is submitting is necessary to deliver that form safely. A general fraud scoring service that profiles every visitor across many sites is a different thing wearing the same word. The distinction is whether the storage serves the specific interaction the visitor initiated or a broader assessment you conduct. Write which one you are relying on beside the cookie, because the word security on its own has been used to justify both. There is a second trap here, which is the vendor who describes their own product as essential. Essential to the product is not the test and never has been. A bot detection service may be genuinely necessary to serve a login form safely, and the same service running on a marketing page where nothing is submitted is doing something else entirely. Judge it per surface rather than per vendor, because the same script can be exempt on one page of your site and not on another.
What does not qualify, however sincerely argued
Analytics, because the site works without it. Personalisation and remembering preferences, which is usually functional rather than necessary. A consent management platform's own analytics about banner performance, which is a surprisingly common finding. Advertising in any form. And anything a vendor has told you is essential to their product, because their product is not the service the visitor requested. The consent platform's own performance analytics deserves a special mention, because it is set by the very tool that is supposed to be enforcing the categories, it is almost always switched on by default, and it is the one nobody thinks to look for. Check your own banner vendor for it specifically. It is a short conversation with a support team and it removes a finding that would otherwise be quite embarrassing to explain.
Language and accessibility preferences
These sit right on the line and the answer depends on how the visitor got there. A language chosen by the visitor from a selector on your site is arguably necessary to deliver what they then asked for; a language guessed from their address and stored for future marketing is not. Because it is genuinely arguable, it is the kind of entry worth documenting with a sentence of reasoning rather than a category label.
Why the category matters more than it looks
Everything in it is set before any banner appears, so a misclassification is not a paperwork problem, it is a cookie firing without consent on every visit. It is also the first thing an auditor checks, because it is the cheapest place to find a real finding. If you fix only one thing on a banner you inherited, fix this list.
How to keep it honest as the site grows
Put the reasoning in the cookie table rather than in somebody's memory: one line per entry saying which visitor-requested service it delivers. When a new tag arrives and someone proposes adding it here, the existing lines make the question easy to answer. Without them the category drifts, because every individual addition seems reasonable at the time.
Questions people ask about strictly necessary cookies
Do I have to tell visitors about strictly necessary cookies?
Yes. They are exempt from consent, not from disclosure, and they belong in the notice like everything else.
Is my consent cookie itself strictly necessary?
Yes. Remembering the choice is required to honour it, and every regulator that has addressed it agrees.
Can a third party cookie be strictly necessary?
Occasionally, for example a payment provider's anti-fraud token during a checkout the visitor started. It is rare and worth documenting when claimed.
What happens if I get this wrong?
You are storing without consent on every visit, which is the finding regulators act on most readily because it needs no interpretation to demonstrate.