--- title: "Cloud SDK cookies" slug: "cloud-sdk-cookies" abstract: "Set Cloud SDK first-party cookies from the client or from the server." --- # Cloud SDK cookies To comply with cookie regulations, the Cloud SDK does not store any cookies by default. However, the SDK must store first-party cookies in the web browser to function properly. As a result, if your site visitor grants consent, you need to [opt in to setting cookies](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-concepts/cloud-sdk-cookies.html#UUID-a0454bd7-595b-1af9-43db-d9211d0960b4_N1730791818190 "Opting in to setting cookies") so that the SDK can function properly in your app. First-party cookies are set by the domain that appears in the web browser's address bar. If you opt in to setting them, the Cloud SDK stores the following first-party cookies: | Cookie name | Description | Configuration options | | --- | --- | --- | | sc_{SitecoreEdgeContextId} | Persists the browser ID between sessions, which is required for all calls that the Cloud SDK makes to Sitecore.Assigns a universally unique identifier (UUID) that is unique per browser until the cookie expires or is deleted.After the cookie expires or is deleted, a new UUID is generated the next time the site visitor returns. | Configured in the CloudSDK function, and stored in the web browser when the function's initialize method runs. See also Initializing the Cloud SDK. | | sc_{SitecoreEdgeContextId}_personalize | Persists the guest ID between sessions, which is required to run SitecoreAI A/B/n tests.Assigns a universally unique identifier (UUID) that is unique per site visitor until the cookie expires or is deleted.After the cookie expires or is deleted, a new UUID is generated the next time the site visitor returns.NoteThe sc_{SitecoreEdgeContextId}_personalize cookie cannot be configured with the HttpOnly attribute because it must be accessible to client-side SDK code. | Configured in the CloudSDK.addPersonalize method, and stored in the web browser when the CloudSDK function's initialize method runs. See also Initializing the Cloud SDK. | | bx_bucket_number | Allocates the site visitor to the variant of a web experience or web experiment by using a bucket number. The allocation is performed for each web personalization that is live on your site during a particular session.Stored only for the duration of the session, and only if you enable web personalizations in your app. | Configured in CloudSDK.addPersonalize.webPersonalization, and stored in the web browser when the CloudSDK function's initialize method runs. See also Initializing the Cloud SDK. | > [!note] > Depending on your site configuration, [SitecoreAI may issue other cookies to website visitors](https://doc.sitecore.com/xmc/en/developers/xm-cloud/en/visitor-cookies.html), as well. ## Checking cookie consent Here's a code example that initializes the Cloud SDK only if a site visitor has accepted cookies. Your own cookie consent implementation will depend on your application requirements, legal regulations, and user experience design. This example is for illustrative purposes only and will not work unless you customize it with your own code. ```typescript "use client"; import { useEffect } from "react"; // Import SDK modules ... // Import your custom logic that checks whether the site visitor has accepted cookies: import { useCookieConsent, cleanup } from ""; export default function CloudSDKComponent() { // Your custom hook to check whether the site visitor has accepted cookies: const { hasConsent } = useCookieConsent(); useEffect(() => { // If the site visitor accepts cookies, run the CloudSDK function: if (hasConsent) { CloudSDK({ // Your initialization settings ... }) // Decide which packages to initialize ... .initialize(); } else { // If the site visitor rejects cookies, run the cleanup logic: cleanup(); } }, [hasConsent]); return null; } ``` ## Opting in to setting cookies > [!important] > Only initialize the Cloud SDK and set cookies if your site visitor grants consent. The Cloud SDK lets you opt in to setting cookies when you initialize the SDK using the [`CloudSDK`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-core/cloud-sdk-core-browser/functions/cloud-sdk-core-browser-cloudsdk.html "CloudSDK") function of the `core` package. To initialize the SDK, you have to set cookies either from the browser or from the server, not both. In the `core` package, the `browser` module lets you set cookies from the browser (client-set cookies), and the `server` module lets you set them from the server (server-set cookies). ### Client-set cookies You can set the `sc_{SitecoreEdgeContextId}` cookie from the browser by setting `enableBrowserCookie` to `true` in the [`CloudSDK`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-core/cloud-sdk-core-browser/functions/cloud-sdk-core-browser-cloudsdk.html "CloudSDK") function of the `browser` module of the `core` package. If you're also using the `server` modules, make sure to set `enableServerCookie` to `false` in the server-side [`CloudSDK`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-core/cloud-sdk-core-server/functions/cloud-sdk-core-server-cloudsdk.html "CloudSDK") function. To be able to run [SitecoreAI A/B/n tests](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-concepts/concepts-personalization/sitecoreai-personalization-and-a-b-n-testing.html "SitecoreAI personalization and A/B/n testing"), you also need to set the `sc_{SitecoreEdgeContextId}_personalize` cookie by setting `enablePersonalizeCookie` to `true` in the `CloudSDK.addPersonalize` method either on the browser or the server. ### Server-set cookies You can set the `sc_{SitecoreEdgeContextId}` cookie from the server by setting `enableServerCookie` to `true` in the [`CloudSDK`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-core/cloud-sdk-core-server/functions/cloud-sdk-core-server-cloudsdk.html "CloudSDK") function of the `server` module of the `core` package. If you're also using the `browser` modules, make sure to set `enableBrowserCookie` to `false` in the browser-side [`CloudSDK`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-core/cloud-sdk-core-browser/functions/cloud-sdk-core-browser-cloudsdk.html "CloudSDK") function. To be able to run [SitecoreAI A/B/n tests](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-concepts/concepts-personalization/sitecoreai-personalization-and-a-b-n-testing.html "SitecoreAI personalization and A/B/n testing"), you also need to set the `sc_{SitecoreEdgeContextId}_personalize` cookie by setting `enablePersonalizeCookie` to `true` in the `CloudSDK.addPersonalize` method either on the browser or the server. When you set cookies from the server, you create and manage cookies on your web server. Then, the web server sends the cookies to the client app. Finally, the client app stores the cookie in the web browser. Setting cookies from the server has the following benefits: - Increases security by allowing cookies that do not require client-side access to use the [`httpOnly`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies) attribute. This helps prevent browser-side JavaScript from accessing the cookies and mitigates cross-site scripting ([XSS](https://developer.mozilla.org/en-US/docs/Web/Security/Types_of_attacks#cross-site_scripting_xss)) attacks. - Mitigates the impact of Intelligent Tracking Prevention (ITP) on cookies. For example, unlike client-set cookies, server-set cookies don't expire automatically after 7 days. > [!note] > The `sc_{SitecoreEdgeContextId}_personalize` cookie cannot use the `HttpOnly` attribute, as the Cloud SDK accesses this cookie from client-side code to identify visitors and support personalization and experimentation scenarios. ### Optional cookie settings Optionally, when you run the `CloudSDK` function, you can configure the cookie domain, the cookie path, and the number of days before cookies expire. [^UUID-a823635e-a6a6-bc5f-f1fb-cdd0de4bfd46_N6659aee98cafa]: The *browser ID* is a universally unique identifier (UUID) that Sitecore CDP assigns to every site visitor of your site. It is unique per browser, and it associates sessions and events with the respective site visitor. The Cloud SDK stores the browser ID as the value for the first-party `sc_{SitecoreEdgeContextId}` [cookie](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-concepts/cloud-sdk-cookies.html "Cloud SDK cookies") in the web browser. [^UUID-a823635e-a6a6-bc5f-f1fb-cdd0de4bfd46_N668cdab24e89b]: The *guest ID*, called [guest reference](https://doc.sitecore.com/cdp/en/users/sitecore-cdp/en/view-a-guest-reference-in-sitecore-cdp.html) in Sitecore CDP, is a universally unique identifier (UUID) that Sitecore CDP assigns to every site visitor of your site. It is unique per site visitor. The Cloud SDK [`personalize`](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-reference/cloud-sdk-personalize.html "@sitecore-cloudsdk/personalize") package stores the guest ID as a first-party [cookie](https://doc.sitecore.com/sdk/en/developers/004/cloud-sdk/cloud-sdk-concepts/cloud-sdk-cookies.html "Cloud SDK cookies") in the web browser.