Strictly necessary cookies are the narrow category exempt from prior consent under ePrivacy Article 5(3) — cookies essential to deliver a service the user explicitly asked for. Typical examples: session IDs, authentication tokens, load-balancing cookies, CSRF tokens, shopping cart contents, and the cookie consent state itself. The ICO and EDPB apply the test narrowly: analytics, marketing, personalization, chatbot, embedded video, and social media cookies do not qualify — even if the site couldn't function "as well" without them. Convenience is not necessity. Under CCPA, strictly necessary cookies are still personal information but usually don't trigger sale-or-sharing opt-out unless the data is shared.