What they are
An analytics cookie is a small file stored in the visitor's browser containing an identifier — a random string — that lets an analytics tool recognise the same browser on a later request. That is the whole mechanism. Everything analytics reports about "returning visitors", "sessions" and "user journeys" is built on top of that identifier.
Typical contents: a visitor ID, a session ID, a timestamp for when the session started, and sometimes the traffic source that brought the visitor in, so a conversion can be attributed later.
Why they are classified as non-essential
Because the site works perfectly without them. The visitor asked to read a page, not to be counted. Analytics serves the site owner's purpose, not the user's request — which is exactly the distinction the "strictly necessary" exemption draws.
This is why analytics cookies generally require consent in the EU and UK, while a login session cookie does not.
First-party and third-party
A first-party analytics cookie is set by the domain the visitor is on. A third-party one is set by another domain, which means that domain can potentially recognise the same browser across every site that uses it.
Third-party cookies are the ones under the most pressure: browsers have progressively restricted them, and cross-site recognition is the practice that privacy regulation targets most directly. First-party cookies survive better technically, but being first-party does not exempt them from consent — the legal test is necessity, not origin.
What you lose without them
Honestly, less than you would expect, and more than nothing:
- Returning visitor identification. You can no longer say with certainty that this is the same person who came last week.
- Multi-session journeys. Someone who visits three times before converting looks like three separate visits.
- Last-touch attribution across days. Attribution collapses to the session in which the conversion happened.
What you keep: page views, unique visits within a window, traffic sources, referrers, entry and exit pages, device and country breakdowns, and conversions within a session. For most decisions — which pages work, which channels bring traffic, what changed after a release — that is the full input set.
How cookieless tools count without them
The common approach is to count a visit using a rotating, non-reversible hash of coarse signals such as the IP address and user agent, combined with a daily-rotating salt, so that the value cannot be linked back to an individual and cannot be joined across days. The result is a statistical count of visitors, not a register of people.
It is less precise per individual, and it is deliberately incapable of building a profile. The trade is precision for the absence of personal data.
The practical question
Look at what you actually did with analytics over the last three months. If the answer is "checked which pages and sources grew, and whether the redesign helped", cookies were not carrying any weight in your decisions — they were carrying the compliance burden.
If your business genuinely depends on multi-session attribution against a large ad budget, that is a real requirement and you should keep the identifiers, obtain proper consent, and accept that the visitors who decline will be missing from your data.