Overview
Traceten sets up to five first-party cookies on your visitors’ browsers. All are:- Scoped to your domain, not to
traceten.com Secure(only transmitted over HTTPS)- Not readable by Traceten on any other site
Which hosts can read them
By default, cookies Traceten sets are readable only on the exact host that set them. Creating a site does not change this. You can share them across your subdomains per site under Sites → Settings → Cookies, which pre-fills the registered domain we can detect from your site’s domain as a suggestion; nothing is applied until you confirm it. Once confirmed, the snippet writesDomain=example.com on four of the five cookies: _traceten_sid, _traceten_vid, _traceten_cart, and _traceten_optout, and puts the same value on your snippet as data-cookie-domain. A visitor who moves from www.example.com to app.example.com is then recognised as the same person rather than counted twice.
This does not make the cookies cross-site. The browser sends them only to hosts under your own registered domain, never to traceten.com or to anyone else’s site.
Be clear about what that does and does not mean: the cookie values do reach Traceten. The visitor ID, session ID and cart token are read by the snippet and included in the event payloads it sends to our ingest endpoint, which is the service you installed us to provide. What stays inside your domain is the cookie itself, which no other site’s JavaScript and no other site’s requests can reach.
The names change with the scope. A host-only cookie is _traceten_vid. A cookie broadened to your domain is _traceten_vid_<8 characters>, where the suffix comes from your site key, and the same for _traceten_sid and _traceten_cart. The suffix is what keeps two Traceten sites under one registered domain from sharing a visitor, since a broadened cookie is visible to both. _traceten_optout is deliberately left un-suffixed so a refusal covers every site under the domain. When this page names a cookie below, read it as the base name.
Four things follow from the scope:
- Every subdomain under your domain can read and write these cookies, including subdomains run by third parties on your behalf. Reading is the obvious risk; writing matters more, because the snippet trusts the visitor ID it finds, so a page on a subdomain you do not control could set one. They hold pseudonymous identifiers: a random ID, or a keyed hash of the identifier you passed to
identify(). No name, email address, postal address or password is ever written to a cookie. One caveat on Shopify stores:_traceten_cartholds the checkout token, which is a reference to a checkout that does contain the buyer’s details. If you do not control every subdomain under your domain, clear the field under Sites → Settings → Cookies. - Clearing the field changes what is written next, not what is already stored. From then on the snippet writes host-only cookies, but a cookie already set at the wider scope stays in the visitor’s browser until it expires: up to a year for
_traceten_vid, 30 minutes for_traceten_sid, 24 hours for_traceten_cart. To retract them sooner, expire them yourself from a page on your domain, or wait out the lifetime. - An opt-out on one subdomain applies to all of them.
_traceten_optoutis broadened for exactly this reason: a visitor who opts out onwww.example.comstays opted out onapp.example.com, instead of the sibling host failing to see the decision and minting a fresh visitor ID. - The snippet will not scope a cookie to a domain the page does not belong to. It checks the value against the page’s own host and, if it does not match, writes host-only cookies instead. If a browser refuses the value, the snippet rewrites the cookie host-only rather than losing it.
localhost, a bare IP address).
_traceten_consent carries a value only your CMP sets, so its scope is whatever your CMP chose. The snippet never writes a consent value; the one time it touches the cookie is to clear it, at both scopes, when a visitor denies consent.
Three of the five use SameSite=Lax: _traceten_sid, _traceten_vid, and _traceten_cart (Shopify stores only). Lax lets these cookies survive a top-level cross-site navigation onto your site. For _traceten_sid/_traceten_vid, this means a visitor arriving via a link inside an AI answer (ChatGPT, Perplexity, etc.) keeps their session/visitor identity on that entry hit instead of it being dropped; for _traceten_cart, it means Shopify’s checkout redirect from checkout.shopify.com back to your store domain doesn’t lose the cart-to-order link. Lax does not send the cookie on cross-site subresource requests, iframes, or POSTs (only on top-level GET navigations), so it stays within Traceten’s first-party-only cookie policy. _traceten_optout remains SameSite=Strict: an opt-out decision has no reason to be read on a cross-site entry hit. _traceten_consent is set and managed entirely by your CMP, not by Traceten.
No third-party cookies are set. No cookies from traceten.com or cdn.traceten.com are written to the visitor’s browser.
The five cookies
_traceten_sid (Session cookie)
Lifetime: 30 minutes from the last pageview (sliding window)
Contents: A random UUID (e.g. f47ac10b-58cc-4372-a567-0e02b2c3d479)
Purpose: Groups pageviews into sessions. Each session gets a single UUID. When a visitor is inactive for 30 minutes, the next pageview starts a new session with a new UUID.
The session ID is included in each event payload. It allows the dashboard to show per-session attribution (e.g. “this session started from a Perplexity referral and visited 3 pages”). It is not a user identifier. It is a random UUID with no link to any personal data.
_traceten_vid (Visitor cookie)
Lifetime: 1 year from last renewal
Contents: A random UUID, or, after traceten.identify(), a one-way hash of the identifier you supplied
Purpose: Identifies return visitors across sessions. This allows the dashboard to distinguish between new visitors (first time on your site) and returning visitors (previously seen). The lifetime renews on each visit.
Some browsers shorten it regardless of what we ask for. Safari and iOS cap cookies written by a script at 7 days, so on those browsers a visitor who returns after longer than that is counted as new. New-visitor counts are an estimate for that reason, and they run high on Safari and iOS traffic.
The visitor ID is never shared across sites. It cannot be used to track a person across the web. By default it’s scoped to the exact host that set it; if you confirm cross-subdomain scoping for your site, it becomes readable across your own registered domain’s subdomains too, which is how one person browsing www.example.com and app.example.com is then counted once. See Which hosts can read them.
If you call identify(): the cookie’s value is replaced with a hash derived from the email address or account ID you passed. The plaintext value is never written to the cookie and never stored. Because the hash uses a key unique to your site, the same person on another Traceten customer’s site produces a completely different value, so the cookie cannot be used to correlate someone across sites.
Traceten separately records that the earlier random UUID and the new hashed value belong to the same visitor, so a purchase after login can be attributed to the AI referral that preceded it. That record is covered by deletion and access requests. See Identity linking.
_traceten_optout (Opt-out cookie)
Lifetime: 30 days when the snippet writes it via its own opt-out path; 10 years if you set it yourself using the example in Opt-out and Do Not Track
Contents: The value 1
Purpose: Records a visitor’s decision to opt out. When this cookie is present, the snippet stops writing the persistent visitor cookie, stops collecting the higher-entropy device signals, and stops exit, click, and in-app navigation tracking. The initial pageview is still sent and the _traceten_sid session cookie is still written. See Opt-out and Do Not Track for the full list, and use your consent tool if you need collection to stop outright.
_traceten_cart (Shopify cart token cookie)
Lifetime: 24 hours from the time of writing
Contents: The Shopify checkout token for the current cart (a 32-character opaque hex string, e.g. a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4)
Purpose: Bridges the AI attribution session to the Shopify order. When a visitor on a Shopify store enters the checkout (/checkouts/ URL or window.Shopify.Checkout.token present), the snippet reads the checkout token and stores it in _traceten_cart. This value is included in subsequent event payloads so that when the order completes, the Traceten Shopify integration can join the order to the originating AI session.
Only written on Shopify stores. If window.Shopify is not present and the URL does not match /checkouts/<token>, this cookie is never written.
Not written for opted-out visitors. If the visitor has the _traceten_optout cookie set (or DNT: 1), _traceten_cart is never written and the cart token is never included in event payloads.
SameSite=Lax. This cookie uses SameSite=Lax rather than Strict because Shopify’s checkout flow redirects the browser across subdomains. SameSite=Strict would cause the browser to drop the cookie on that navigation, preventing attribution. The legal basis for this setting is legitimate interest (GDPR Article 6(1)(f)) for the purpose of attributing completed purchases to the traffic channel that drove them.
Privacy classification. The cart token is a pseudonymous identifier under GDPR Recital 26. It does not directly identify a person, but it resolves to a natural person when joined with the Shopify order (which contains name, email, and shipping address). It is subject to GDPR Article 17 deletion requests.
_traceten_consent (Consent signal cookie)
Lifetime: Set and managed by the site’s Consent Management Platform. Traceten reads but does not write this cookie.
Contents: The value 1
Purpose: Records that the visitor has granted consent for a small set of additional device-fingerprinting signals via the site’s CMP. When this cookie is present with value 1, or when window.traceten.consent === "granted", the snippet collects those additional signals as extra input to AI-classification. Without consent, they are skipped entirely; all other signals are unaffected.
Scope: First-party (scoped to your domain). Traceten does not write this cookie. Your CMP (OneTrust, Cookiebot, Iubenda, etc.) is responsible for setting and managing it.
Do Not Track
When the browser sendsDNT: 1, the snippet treats the request as if _traceten_optout is set. The persistent _traceten_vid cookie is not written and a transient in-memory ID is used instead. The _traceten_sid session cookie is still written, and the initial pageview is still sent. See Opt-out and Do Not Track.
Consent management
Traceten does not include a consent banner. If your site requires explicit consent for analytics cookies (e.g. under GDPR’s ePrivacy Directive), your consent management platform (CMP) must gate the execution of the Traceten snippet. The recommended approach:example.com: data-cookie-domain must be your own domain, and a value the page does not belong to is ignored.
If the snippet is added to the <head> statically, it fires on every pageview regardless of consent status. Use the dynamic loading pattern above when cookie consent is required.