What is the .AspNet.Consent cookie?
.AspNet.Consent is a first-party cookie automatically created by the built-in cookie consent feature of ASP.NET Core, Microsoft's framework for building .NET web applications. It is not set by a third-party vendor but by the application's own code, when the developer enables the native "cookie consent tracking" option provided by the framework.
It typically appears as soon as a visitor interacts with a consent banner implemented through ASP.NET Core's standard functions, rather than through CookieFix or another external CMP. It is found on websites and web applications built by .NET developers, often in intranets, institutional portals, or business applications.
What data it stores
The cookie usually stores a simple boolean-style value (such as "yes"/"true" or "no"/"false") indicating whether the user has accepted or declined the application's cookie policy. It does not contain personal identifiers, tracking IDs, or browsing behavior data.
The exact value format can vary depending on how the developer configured it, since ASP.NET Core allows the cookie's name and behavior to be customized. The value is read and written only by the application itself, on the domain the site runs on — it is not sent to third-party servers.
What it is used for
Its purpose is strictly functional: it lets the application remember the user's choice about cookies so the consent banner does not reappear on every visit or every page. Without it, the application would have no simple way to know whether a visitor has already been informed and has made a choice.
For the site owner, this cookie is part of the framework's built-in mechanism for meeting user-information requirements, but it does not by itself provide a full, category-based granular consent solution.
Does it require consent?
.AspNet.Consent is classified as a strictly necessary cookie, since its only role is to remember the cookie decision, with no analytics, marketing, or personalization purpose. Under GDPR and the ePrivacy Directive (transposed in Romania through Law 506/2004), strictly necessary cookies do not require prior visitor consent to be placed.
- It should still be listed in the site's cookie policy, with its actual purpose and duration.
- The site owner should check the ASP.NET Core configuration to confirm this cookie isn't, in practice, being reused for additional purposes (for example combined with other tracking mechanisms).
- It should not be included among the cookies that wait for banner consent.
How to block or delete .AspNet.Consent
A visitor can delete or block this cookie at any time from the browser's cookie and site data settings. Blocking it does not break the site's core functionality, but it may cause the application's own consent banner to reappear on every visit.
Since it is strictly necessary, this cookie should not be auto-blocked pending consent. A CMP like CookieFix is instead useful for automatically blocking, until consent is given, any other statistics, marketing, or preference scripts and cookies the ASP.NET Core application may use, and for generating a compliant consent banner and cookie policy.
Frequently asked questions
It is set by the web application itself, through the native consent feature built into the ASP.NET Core framework, not by a third-party service.
No, it is a strictly necessary cookie used only to remember the cookie decision, so it does not require prior consent under ePrivacy, though it must be disclosed in the cookie policy.
The application will no longer know you already made a choice, and the site's consent banner may reappear on your next visit.
In the typical configuration it lasts about one year, but the application's developer can change this duration.