Are Session Cookies GDPR Compliant?

With all the new data privacy laws, it may often be difficult for a business to stay compliant, especially e-commerce stores that function in multiple jurisdictions. One area of concern is session cookies. What are they and are they GDPR compliant?

Session Cookies & Their Strictly Necessary Nature

Session cookies are stored on a visitor’s browser while they’re actively navigating the website. They’re not persistent since they’re deleted as soon as the user closes their browser session, although some session cookies persist until the website is visited again. A common example is a shopping cart cookie storing cart items while a customer shops on an e-commerce website. Session cookies can also temporarily store website data to increase page loading speeds.

Under GDPR strictly necessary cookies are cookies exempted from informed consent because they’re essential to the website’s core functionality. Session cookies fall into this category (with a few exceptions) since they’re temporary and only perform functions necessary for the visitor to use the website.

Does This Make Session Cookies Exempt From GDPR Consent?

Because session cookies fall into the scope of strictly necessary cookies as the visitor navigates the website, they are exempt from GDPR consent, allowing websites to use them without needing to ask a user for their consent.

However, it’s important to check that each session cookie performs a task that’s essential to the website’s functionality, even if it’s temporary. If there’s any uncertainty, it’s best to block them first until consent is received. You can also include a section on session cookies in your cookie consent policy to have an official document to refer to.

Conclusion

Session cookies are very important in offering a good user experience as well as enabling the website to remember past visitors. Ensuring GDPR compliance isn’t so easy, but at least you can rest easy that your session cookies are in the clear.