Performance cookies are the ones that measure how your site performs and how visitors move through it: which pages get read, where people drop off, how fast things load. They are among the most common cookies on the web, and among the most misunderstood when it comes to consent. Here is the clear version.
Definition and examples
A performance cookie collects information about the use of a site, usually aggregated: pages visited, time on page, errors encountered, load times, the rough origin of the visit. Concrete examples include the _ga and _gid cookies of Google Analytics, Hotjar's session cookies, and Microsoft Clarity's identifiers. Some taxonomies separate "performance" (speed, errors) from "analytics" (behavior); in practice most consent banners, Consorm included, group them because the privacy analysis is the same.
How they fit among the cookie categories
| Category | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Sessions, security, cart, consent storage itself | No |
| Functional | Preferences: language, region, display choices | Generally yes |
| Performance / analytics | Measurement of use and speed | Yes |
| Advertising | Profiling, retargeting, ad measurement | Yes, explicitly |
Do performance cookies require consent?
Under explicit-consent regimes like Quebec's Law 25 and the GDPR as applied by most European regulators: yes. Measuring your audience is a legitimate goal, but it is not necessary to deliver the page the visitor asked for, which is the test that exempts a cookie from consent. That means performance cookies must stay blocked until the visitor accepts their category, and the visitor must be able to refuse them as easily as accepting.
The classic mistake
Installing Google Analytics with the default snippet, then adding a banner on top. The banner displays, but the _ga cookie is already set before anyone clicks. A scan of your site shows whether this is happening to you.
Measuring without breaking the rules
Consent does not end measurement; it conditions it. With a banner that blocks trackers until consent and Google Consent Mode v2 relaying each choice, GA4 measures the visitors who accept, and Google models aggregate conversions for the rest. You lose some precision and gain data you can actually defend, plus a record proving each consent behind every number.