# Essential Cookie Classification Workflow

## Classification Process

### Step 1: Inventory All Cookies
Run cookie audit to generate complete cookie inventory with name, domain, purpose, and duration.

### Step 2: Apply Two-Part Test
For each cookie, answer:
1. Is this cookie strictly necessary for a specific website function?
2. Did the user explicitly request that specific function?

Both conditions must be met for the exemption to apply.

### Step 3: Map to WP 194 Categories
Classify each exempt cookie into one of six categories:
- A: User input cookies (session-only)
- B: Authentication cookies
- C: User security cookies
- D: Multimedia player session cookies
- E: Load balancing cookies
- F: UI customisation cookies (session-only)

### Step 4: Document Justification
For each exempt cookie, create written justification including:
- Cookie name and purpose
- WP 194 category
- Why strictly necessary (service cannot function without it)
- Why duration is minimum necessary
- DPO approval and review date

### Step 5: Annual Review
- Review all exempt classifications annually
- Verify cookies still qualify (purpose, duration unchanged)
- Remove exemption if purpose or duration changed
- Document review in compliance records

## Borderline Case Resolution
1. Identify borderline cookies (fraud detection, CDN cookies, persistent preferences)
2. Consult DPA guidance for the specific jurisdiction
3. Default to requiring consent if classification is uncertain
4. Document reasoning for borderline decisions
5. Monitor DPA enforcement actions for precedents