What is the ASP.NET_SessionId cookie?
ASP.NET_SessionId is the session cookie created automatically by ASP.NET's session-state engine (Microsoft), used by many websites and web applications built on .NET technology (ASP.NET Web Forms, MVC, or .NET Framework/Core with session state enabled).
The cookie appears as soon as the server creates a new session for a visitor, typically on the first page load, when the application relies on session state to hold temporary data such as a shopping cart, partial login state, or multi-step form data.
What data it stores
The cookie's value is a server-generated alphanumeric identifier unique to that session (typically a string of around 24 characters). It does not store personal data directly – any such data, if collected, is kept server-side and linked to this identifier.
The cookie is exchanged between the browser and the server hosting the ASP.NET application on every HTTP request, so the server can recognize repeated requests as belonging to the same session.
What it is used for
The purpose of this cookie is purely technical: it lets the server tie together multiple HTTP requests from the same visitor and preserve application state throughout the visit – for example the contents of a shopping cart, form progress, or temporary browsing preferences.
Without this cookie, many ASP.NET applications cannot work correctly, since HTTP is stateless by design and needs a session-identification mechanism to link successive requests.
Does it require consent?
ASP.NET_SessionId is generally classified as a strictly necessary cookie, since it is essential for the basic functioning of the site or application, not for statistics, marketing, or personalization.
- Under the ePrivacy Directive (implemented in Romania via Law 506/2004) and the GDPR, strictly necessary cookies do not require prior user consent.
- Site owners should still disclose it in the cookie policy, along with its purpose and duration.
- If the session is also used for purposes beyond technical operation (e.g. marketing tracking), reclassifying it and obtaining consent may become necessary.
How to block or delete ASP.NET_SessionId
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari) under the per-site cookie management section. Blocking it, however, may break parts of the site that rely on the session, such as shopping carts, login, or multi-step forms.
For site owners, even though this cookie doesn't require consent, a consent management platform (CMP) like CookieFix can automatically block scripts that aren't strictly necessary until consent is given, while keeping the application's technical session intact.
Frequently asked questions
No, as a strictly necessary cookie for the application to function, it does not require prior consent under ePrivacy and GDPR, but it must still be disclosed in the cookie policy.
The ASP.NET-based site or application may stop working correctly – for example, a shopping cart could empty or login could fail, since the server can no longer identify the session.
It's typically a session cookie, so it's deleted automatically when the browser closes; the exact duration can be configured differently by the application's developers.
The cookie itself only holds a randomly generated session identifier; any personal data, if collected, is stored separately on the server and linked to that identifier.