[tibu]

From the ICO page https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

This means you are unlikely to need consent for:

cookies used to remember the goods a user wishes to buy when they add goods to their online basket or proceed to the checkout on an internet shopping website; session cookies providing security that is essential to comply with data protection security requirements for an online service the user has requested – eg online banking services; or load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers.

[mLuby]

From another ICO page: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

  Are analytics cookies exempt?
  
  No. It is important to note that PECR does not distinguish between cookies used for analytics activities and those used for other purposes. Analytics cookies do not fall within the ‘strictly necessary’ exemption. This means you need to tell people about analytics cookies and gain consent for their use.
  …
  Whilst analytics can provide useful information for you, they are not part of the functionality that the user requests when they use your online service – if you didn’t have analytics running the user could still be able to access your service. This is why analytics cookies aren’t strictly necessary and do require consent.