Common cookies used around Contao 4 websites

This is an archive post. It will not be updated.

Important: I give no guarantee whatsoever that this information is correct or complete. The situation keeps changing, so this is only meant as a “starting point” for your own research. Also, I am not a lawyer, so this should not be understood as legal information, but only as technical help. In the end, all details must always be approved by legal professionals!

Depending on how your data protection expert ticks, you may have to provide very detailed information about the cookies in the cookie consent bars or in the privacy policies. But first this information has to be researched, which is not that easy, especially for third-party providers. Many colleagues are also not aware that third-party providers often set different cookies depending on which device the users are using.

That’s why I’m collecting information here that I have already researched for projects in this context. If you spot an error, I’d be glad to hear from you.

“Necessary” cookies

Name: PHPSESSID

  • Type: HTTP cookie
  • Purpose: Records the current PHP session (necessary for the content management system (CMS) and security functions to work correctly)
  • Cookie validity: Browser session
  • Provider: Website owner (no transfer to third parties)

Name: csrf_contao_csrf_token

  • Type: HTTP cookie
  • Purpose: Increases the security of the website against CSRF attacks (cross-site request forgery)
  • Cookie validity: 22 hours
  • Provider: Website owner (no transfer to third parties)

Name: _rspkrLoadCore

  • Type: HTTP cookie
  • Purpose: Increases the security of the website against CSRF attacks (cross-site request forgery)
  • Cookie validity: 22 hours
  • Provider: Website owner (no transfer to third parties)

Name: cms_cookies_saved

(Used if the cookie bar of the Contao Marketing Suite (extension) is used in the project!)

  • Type: HTTP cookie
  • Purpose: Stores the privacy settings that visitors selected in the cookie notice box.
  • Cookie validity: 7 days (depends on what you set in the Contao Marketing Suite!)
  • Provider: Website owner (no transfer to third parties)

Name: cms_cookies

(Used if the cookie bar of the Contao Marketing Suite (extension) is used in the project!)

  • Type: HTTP cookie
  • Purpose: Stores the privacy settings that visitors selected in the cookie notice box.
  • Cookie validity: 7 days (depends on what you set in the Contao Marketing Suite!)
  • Provider: Website owner (no transfer to third parties)

Statistics cookies: Matomo

Name: mtm_consent

(Used if the cookie bar of the Contao Marketing Suite (extension) is used in the project!)

  • Type: HTTP cookie
  • Purpose: Stores whether consent to Matomo tracking has been given.
  • Cookie validity: 6 months
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Name: _pk_testcookie

  • Type: HTTP cookie
  • Purpose: Checks whether the user’s browser stores cookies.
  • Cookie validity: deleted again immediately
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Name: _pk_id

  • Type: HTTP cookie
  • Purpose: Generates statistical data on how the user uses the website
  • Cookie validity: 6 months
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Cookie name: _pk_ref

  • Type: HTTP cookie
  • Purpose: Stores which website the user came from to the current website
  • Cookie validity: 6 months
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Cookie name: _pk_ses, _pk_cvar, _pk_hsr

  • Type: HTTP cookie
  • Purpose: Temporarily stores statistical data for the user’s current visit to the website
  • Cookie validity: 6 months
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Cookie name: matomo_ignore

  • Type: HTTP cookie
  • Purpose: Tells Matomo that the user has actively given a permanent no-tracking instruction (e.g. via an iFrame on the privacy page)
  • Cookie validity: 6 months
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Cookie name: MATOMO_SESSID

  • Type: HTTP cookie
  • Purpose: When users use the permanent no-tracking instruction, this cookie is briefly created (“noone”) to prevent CSRF security problems (cross-site request forgery).
  • Cookie validity: Browser session
  • Provider: Website owner (no transfer to third parties, provided Matomo is self-hosted)

Reviews: kununu cookies

Cookie name: kununu

  • Type: HTTP cookie
  • Purpose: Used in connection with kununu’s review function. Displays company reviews based on the experiences of other users.
  • Cookie validity: Browser session
  • Provider: Xing
  • Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Cookie name: kununu_op

  • Type: HTTP cookie
  • Purpose: Used in connection with kununu’s review function. Displays company reviews based on the experiences of other users.
  • Cookie validity: 1 year
  • Provider: Xing
  • Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Cookie name: kununu_country

  • Type: HTTP cookie
  • Purpose: Used in connection with kununu’s review function. Evaluates the user’s geographical location in order to display suitable services.
  • Cookie validity: 1 day
  • Provider: Xing
  • Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Cookie name: kununu_country_ip

  • Type: HTTP cookie
  • Purpose: Used in connection with kununu’s review function. Evaluates the user’s geographical location in order to display suitable services.
  • Cookie validity: 1 day
  • Provider: Xing
  • Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Videos: YouTube

Name: VISITOR_INFO1_LIVE

  • Type: HTTP cookie
  • Purpose: Tries to estimate the users’ bandwidth on pages with embedded YouTube videos.
  • Cookie validity: 179 days
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: YSC

  • Type: HTTP cookie
  • Purpose: Registers a unique ID to keep statistics of which YouTube videos the user has watched.
  • Cookie validity: Browser session
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-cast-installed

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Browser session
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-connected-devices

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Persistent
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-device-id

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Persistent
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-fast-check-period

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Browser session
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-session-app

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Browser session
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: yt-remote-session-name

  • Type: HTTP cookie
  • Purpose: Stores the user’s settings when a YouTube video embedded on other websites is played.
  • Cookie validity: Browser session
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Name: GPS

  • Type: HTTP cookie
  • Purpose: Registers a unique ID on mobile devices to enable tracking based on the geographical GPS location.
  • Cookie validity: 1 day
  • Provider: YouTube, LLC
  • Privacy policy: https://policies.google.com/privacy

Text to speech: ReadSpeaker

Name: _rspkrLoadCore

Name: pll_language