Airbnb's 'Necessary' Cookies Include Rive and Swift-AVIF – Why?

I went looking through Airbnb's updated app cookie settings and something jumped out. Under "strictly necessary" cookies they list several third-party libraries that have no real business setting cookies at all — specifically Rive and swift-avif-decode.

Rive is a vector animation rendering library. The whole point is it runs client-side in the app or browser. There's no server-side state that needs tracking. Animations themselves aren't functional for booking a place to stay — they're decorative. Calling that cookie "necessary" is a stretch.

swift-avif-decode is equally odd. It's a library to decode AVIF image format. Again, that's a pure local rendering dependency. Decoding an image format doesn't require a cookie. If it's setting one, that suggests they're pulling a CDN or analytics call inside the decode library, or they've just lazily listed every third-party domain that the app contacts as "necessary" regardless of what data actually gets stored.

This matters because "strictly necessary" is a specific classification in GDPR and similar frameworks. It means the cookie (or tracker) is essential for the app to function — payment processing, login, security. It's not supposed to cover optional performance or cosmetic features. Misclassifying non-essential services under this label lets them skip consent banners and ignore the user's choice to opt-out.

A few other cookies like Google Maps and Stripe are genuinely necessary if the app uses them for core features. But Rive and swift-avif-decode? Either Airbnb needs to audit what their SDKs are actually dropping, or they're deliberately sweeping third-party tracking under the "necessary" rug because it's convenient.

If you use Airbnb, check your own app — the cookie details page shows the full list. It's worth asking them directly on their forum or support why an animation library is required to book a trip. Small transparency cracks like this only get worse if nobody calls them out.