What is a session cookie? What MDN and the ICO say, and the vendors

What MDN and Cloudflare say it is

MDN’s guide to HTTP cookies describes the common use: the user signs in, the server checks the credentials and responds with a cookie containing a session ID that records the sign-in status on the browser. Later the browser sends that cookie with each request, and the server checks the session ID and, if it is still valid, sends a personalised page; if it is not valid, the session ID is deleted and the user sees a generic page or is asked to sign in again. MDN lists session management among the uses of cookies: sign-in status, shopping cart contents, game scores or other session details the server needs to remember. Cloudflare’s learning page says the same with an example: a shopping site’s server generates a session cookie when someone logs in, and that cookie contains a unique string of letters and numbers that matches the session with the relevant data for that user.

MDN separates two kinds by the attributes in the Set-Cookie header. Permanent cookies are deleted after the date in Expires. Session cookies are cookies without a Max-Age or Expires attribute, and they are deleted when the current session ends. That is the whole answer to what is a session cookie in technical terms: a cookie that has no expiry date, so the browser treats it as belonging to the visit.

When a session really ends

MDN says the browser defines when the current session ends, and that some browsers use session restoring when restarting, which can cause session cookies to last indefinitely. UniConsent gives the examples: if your browser is set to restore your previous session, such as Continue where you left off in Chrome or Open previous windows and tabs in Firefox, it may keep session cookies after a restart, and some mobile browsers rarely end a session at all because the app is not fully closed. CookieYes, in an article dated 3 March 2026, says in most cases session cookies are removed when the browser is closed but that the behaviour depends on browser settings, device type and how the cookie is configured. Cookiebot and Transcend, by contrast, say the cookie is deleted when the user closes the browser, without that caveat.

MDN also gives a security point: if your site authenticates users, it should regenerate and resend session cookies, even ones that already exist, whenever a user authenticates, to help prevent session fixation attacks, where a third party can reuse a user’s session. Transcend says that although session cookies don’t require explicit consent under the GDPR, businesses still need security measures to prevent hijacking and unauthorized access.

Do they need consent? The ICO’s answer

The ICO’s guidance on exceptions says that not all storage and access technologies require consent, and that you can store or access information without consent in five circumstances. The “strictly necessary” exception applies when the purpose of the storage or access is essential to provide the service the user requests, which means that without it the service could not be provided on a technical level. Among the ICO’s examples that are likely to meet the exception are identifying a user once they have logged in to an online service for the duration of their visit, for example to prevent a new login prompt on an online banking service each time the user loads a new page. Session cookies used to store a user’s preference can rely on the strictly necessary exception, provided they are not linked to a persistent identifier. A separate communication exception covers session cookies used for load balancing with the sole purpose of identifying which server in the pool will handle the communication.

The ICO adds that the exceptions only apply if your use aligns with the purposes and requirements of each one: if your usage goes beyond these, you must get consent. The test the ICO describes is the purpose of the storage. This page is not legal advice, and the ICO’s guidance is about the UK; the vendors below also speak about the EU.

What the vendors say, and where they differ from the ICO

Four of the pages on this topic are written by sellers of consent tools. CookieYes says session cookies fall under the strictly necessary category under the GDPR, are exempt from the consent requirements and are therefore compliant, and that websites can set them without consent but should say what they do, usually in a banner. Transcend, dated 14 February 2025, says session cookies don’t require explicit consent under the GDPR, being necessary for website operations, and elsewhere that they are often exempt. Cookiebot, dated 26 November 2024, says session cookies often fall into the strictly necessary category and are generally exempt from explicit consent, but that analytics cookies typically need consent even if temporary, because they are not strictly necessary.

UniConsent is the one that matches the ICO: it says it depends on what the cookie does, not how long it lasts, citing Article 5(3) of the ePrivacy Directive, which requires prior consent unless the cookie is strictly necessary for a service the user has asked for, with the GDPR setting the standard for that consent. Cloudflare also names the ePrivacy Directive. CookieYes, Cookiebot and Transcend, in the pages we read, speak of the GDPR and do not cite the ICO’s list or MDN. The flat statements leave out the conditions the ICO sets, such as the purpose and the persistent identifier. CookieYes, Cookiebot, Transcend and UniConsent all sell consent tools.

Seeing and clearing the cookies in Chrome

Chrome Help says to open Settings, then Privacy and security, then Third-party cookies, and select See all site data and permissions, where you can search for a site and remove its data. It warns that if you delete cookies you may get signed out of sites that remember you and your saved preferences can be deleted. The vendors’ pages give no step for finding a session cookie in the browser: CookieYes suggests a cookie scan of a website, which is a different job. For the settings that allow or block cookies, see enabling cookies in Chrome, and for what clearing them does, what clearing the cache does.