Understanding how data is managed through cookies is vital for ensuring user privacy and compliance with regulatory standards. This blog aims to explore the intricacies of session cookies and their roles in the broader scope of cookie management.
What Are Session Cookies?
A session cookie is a cookie with no expiry date set, which means the browser deletes it as soon as you close it. Websites use them to hold state during a single visit, like keeping you logged in, holding a shopping cart, or remembering how far through a form you’ve got.
They’re often described as the harmless kind of cookie, and as automatically exempt from consent. Neither is reliably true. What decides whether a cookie needs consent is what it’s for, not how long it lasts.
What Are Session Cookies Used For?
- Authentication. Keeping you logged in as you move between pages, so you don’t re-authenticate on every request.
- Shopping carts. Holding basket contents before checkout, including for shoppers who haven’t logged in.
- Multi-step forms. Retaining what you’ve entered as you move between steps.
- Load balancing. Keeping you pinned to the same server for the duration of a visit.
- Security. CSRF tokens, fraud detection, and rate limiting tied to a single session.
- Media players. Remembering playback position or quality settings for the current visit.
- Session-scoped analytics and testing. Counting the visit, or holding which variant of a page you were shown.
That last one behaves exactly like the others technically, and it’s treated completely differently in law. Which brings us to the part most articles get wrong.
How Do Session Cookies Work?
A session cookie holds a session ID, a randomly generated identifier that matches a session record held on the server. The cookie itself usually carries nothing but that ID. The data sits server-side.
Technically, what makes a cookie a session cookie is the absence of an ‘Expires’ date or a ‘Max-Age’ value. Set either one and it becomes a persistent cookie. There’s no separate session cookie type in the specification, just a cookie that was never told when to die.
Because the session ID is what identifies an authenticated user, it’s the obvious target for session hijacking. Session cookies are normally flagged ‘secure’, so they only travel over HTTPS, and ‘httponly’, so client-side scripts can’t read them. ‘Samesite’ controls whether they’re sent on cross-site requests.
One consequence people miss: closing the tab isn’t enough. Session cookies survive until the whole browser closes, and most browsers restore them if the user reopens with session restore. On shared devices that matters.
What is the Difference Between Cookies & Sessions?
Expanding on their differences, it’s important to note that sessions can store more complex data structures compared to cookies, which are typically limited in size. While cookies are sent with every HTTP request, potentially slowing down the web browsing experience if not managed well, session data does not travel back and forth between the client and server, thus optimizing performance and security. Sessions end either after a timeout or when explicitly terminated, whereas cookies persist based on their specified lifespan.
Session Cookies Example
Consider an online banking session where a user logs in to check their balances and transact. A session cookie here would not only manage login states but also complex, security-critical interactions during the session. It ensures that the user does not need to authenticate every single transaction within that session, thereby balancing security and convenience.
Session Cookies vs Persistent vs Third-Party
| Session cookie | Persistent cookie | Third-party cookie | |
|---|---|---|---|
| Expiry | None set. Deleted when the browser closes | The Expires date or Max-Age value it was given |
Either, set by the third party |
| Set by | The site you’re visiting | The site you’re visiting | A different domain, loaded by the site |
| Typical use | Login state, carts, form progress | Preferences, returning-visitor recognition, analytics | Advertising, cross-site tracking, embedded content |
| Survives a browser restart | No | Yes, until expiry | Yes, until expiry |
| Usually needs consent | Depends entirely on purpose | Depends entirely on purpose | Almost always |
| Blocked by default in Safari and Firefox | No | No | Yes, since 2020 |
The two categories aren’t mutually exclusive. A third-party cookie can be session-scoped, and a first-party cookie can be persistent. The row that actually determines your obligations is the consent row, and it doesn’t follow from any of the others.
Do Session Cookies Need Consent?
While the general rule is that strictly necessary session cookies do not require consent, the definition of ‘strictly necessary’ can vary by jurisdiction. For instance, in the European Union under the GDPR, only those cookies absolutely essential for delivering services explicitly requested by the user are exempt from the consent requirement. This emphasizes the importance of not only informing users about the use of such cookies but also ensuring that their implementation strictly adheres to legal definitions of necessity and minimum scope of operation.
Sometimes. Being session-scoped doesn’t exempt a cookie from anything.
Under Regulation 6 of PECR in the UK and Article 5(3) of the ePrivacy Directive across the EU, you need consent before storing information on someone’s device or reading information already there. Two long-standing exemptions apply: where the cookie’s sole purpose is carrying out the transmission of a communication, and where it’s strictly necessary to provide a service the user has explicitly requested.
Neither exemption mentions duration.
What Actually Decides It
The Article 29 Working Party settled this in Opinion 04/2012, which the ICO still points to. Its finding is that it’s the purpose and the specific implementation being achieved that determine whether a cookie is exempt.
The Opinion does say that first-party session cookies are far more likely to be exempted than third-party persistent ones. But it’s explicit that while those characteristics are a useful initial indicator for prioritizing compliance work, they aren’t sufficient on their own to establish whether a cookie meets either criterion.
Its own example makes the point. A cookie used to authenticate a user logging in is exempt. A near-identical cookie used to identify and track that user isn’t. Same shape, same lifetime, different purpose, different answer.
Three further rules that catch people out:
- The test is from the user’s point of view, not yours. The question is whether the service the user asked for would work without the cookie, not whether your business would prefer to have it.
- Multi-purpose cookies fail the test unless every purpose qualifies. One cookie doing session management and analytics needs consent for the whole thing.
- The transmission exemption is narrower than it sounds. A cookie has to be pivotal to the transmission. Merely assisting, speeding up or regulating it doesn’t qualify.
Session Cookies That Are Usually Exempt
Drawing on the Opinion’s worked list, these are the ones that normally clear the bar, provided they’re not also doing something else:
- User-input cookies, including session IDs and shopping baskets
- Authentication cookies for a service the user logged into
- User-centric security cookies, where the security was explicitly requested
- Multimedia player session cookies
- Load balancing session cookies
- User interface customization cookies, such as a language choice the user actively made
- Social plugin content-sharing cookies, for logged-in members
The ICO’s position is that it’s still good practice to tell users about these cookies even where consent isn’t required. Exempt from consent is not exempt from transparency.
Session Cookies That Usually Aren’t
- Advertising and retargeting cookies, even when session-scoped
- Third-party operational advertising cookies, including frequency capping, ad affiliation, click fraud detection and market research
- A/B testing and personalisation cookies, where the user didn’t request the variation
- Any cookie whose session ID also feeds a cross-site profile
Cookie Consent & Data Privacy
Cookie management is a crucial aspect of maintaining user trust and complying with global data privacy regulations such as GDPR and CCPA. It’s important for users to understand their rights and for websites to uphold their responsibility in managing cookies transparently. This includes implementing a cookie consent banner, maintaining a detailed cookie policy, and providing users with easy access to modify their preferences at any time. By effectively managing cookie consent, particularly session cookies, websites not only comply with legal standards but also enhance user satisfaction by balancing functionality with privacy.
FAQs:
How do I get rid of session cookies?
Close the browser. Session cookies have no expiry date, so the browser deletes them when it shuts down. Closing a single tab won’t do it, and session restore can bring them back. To remove them immediately, clear cookies and site data in your browser settings.
How do I find my session cookie?
Open your browser’s developer tools, go to the Application panel, and select Cookies under Storage. Any cookie showing “Session” in the expiry column is a session cookie, meaning it has no Expires or Max-Age value set.
How do I create a session cookie?
Set a cookie without an ‘Expires’ date or a ‘Age-Max’ value. In an HTTP response that’s Set Cookie: sessionid=abc123; Path=/; Secure; HttpOnly; SameSite=Lax.
What are some examples of session cookies?
Login and authentication cookies, shopping cart cookies, multi-step form progress, load balancing cookies that keep you on one server, CSRF tokens, and media player settings for the current visit.
Are session cookies GDPR compliant?
The question is usually about PECR or the ePrivacy Directive rather than GDPR, since that’s where the cookie consent rule sits. A session cookie is lawful without consent only if its purpose meets an exemption. Being session-scoped isn’t itself a basis for exemption, and where the cookie handles personal data, GDPR applies to that processing separately.
Do session cookies need a cookie banner?
Only if they need consent, which depends on purpose. Authentication and cart cookies generally don’t. Session-scoped advertising or testing cookies do. Even exempt cookies should still be disclosed in your cookie policy.
Are session cookies safe?
They’re lower risk than persistent cookies for tracking, because they don’t survive the browser closing. The main risk is session hijacking, which is why they should be set Secure and HttpOnly and given a server-side timeout as well as a browser-side one.
What’s the difference between a session cookie and session storage?
A session cookie is sent to the server on every request, holds about 4 KB, and lasts until the browser closes. Session storage stays in the browser, holds about 5 MB, and is scoped to a single tab, so it’s cleared sooner.