Under a number of privacy laws including the GDPR and CalOPPA, non-essential cookies are considered to be personal data. This is because they collect data that can be used to identify an individual, such as location data and IP address via analytics.