What is the _session_id cookie?
_session_id is the default session cookie that Ruby on Rails, one of the most widely used web frameworks written in Ruby, sets automatically for each visitor. It appears as soon as someone loads a page of a Rails application that has session handling enabled, which is the standard out-of-the-box behavior.
It is not set by an external third-party service, but by the site's own application, since Rails runs on the server and generates this cookie for every new browsing session.
What data it stores
The cookie stores a unique, server-generated session identifier that links successive requests from the same visitor to session data kept on the server (or, depending on configuration, encrypted directly inside the cookie itself). The value is a cryptographic-looking string with no meaning visible to the visitor.
The exact format of the value can vary depending on the Rails version and application configuration (for example, which session store is used), so it cannot be described precisely in general terms. The associated data typically stays on the server hosting the application and is not shared with third parties.
What it is used for
Its main purpose is to keep track of a visitor's browsing/login state across multiple HTTP requests, since HTTP itself is stateless by design. In practice, it lets the site "remember" who the user is while they navigate.
It is commonly used for features such as authentication, shopping carts, multi-step forms, flash messages (temporary notifications), or CSRF protection, depending on how the specific application is built.
Does it require consent?
_session_id is, in most cases, classified as a strictly necessary cookie (required for the site's basic functioning), since without it many Rails applications could not properly manage a user's session. Under Romania's Law 506/2004 (transposing the ePrivacy Directive) and ANSPDCP's interpretation, strictly necessary cookies do not require prior visitor consent.
- The site owner should still list it in the cookie policy, with the correct purpose and category.
- If this cookie were actually repurposed for marketing or analytics (an unusual but technically possible developer choice), it would need to be reclassified, and consent would become mandatory.
- Confirming the cookie's real behavior is the responsibility of whoever administers the Rails application, since actual usage depends on its code.
How to block or delete _session_id
A visitor can delete or block this cookie from browser privacy settings (Chrome, Firefox, Edge, Safari), but doing so may break basic functionality such as staying logged in or keeping items in a shopping cart, leading to repeated logouts or navigation errors.
For site owners, a CMP such as CookieFix can automatically block scripts that are not strictly necessary until consent is given, but an application's own session cookies, like _session_id, are generally left active since they are essential to the site working at all.
Frequently asked questions
No, it is normally a technical cookie used only to maintain the session on the server, and it does not track behavior across other websites.
It is typically a session cookie that expires when the browser is closed, although the exact duration can be changed by the developer of the Rails application.
Generally no, since it is classified as strictly necessary, but it should still be disclosed in the site's cookie policy.
The current session is lost, and the visitor may be logged out or lose data entered in a form or shopping cart.