What is the ci_session cookie?
ci_session is the standard session cookie of the CodeIgniter framework (versions 3 and 4), written in PHP. It is set by the website's own application, not by a third-party service, through CodeIgniter's native session driver (CodeIgniter\Session).
It appears as soon as a visitor triggers a session on the server – typically on the first page load, at login, when filling in a form, or when adding a product to a cart. If a site runs on CodeIgniter with active sessions, this cookie is essentially present everywhere.
What data it stores
The cookie's value is a randomly generated session identifier (an alphanumeric string) that does not directly contain personal data. This identifier links to the actual session data, which is stored server-side – typically in the database, in files, or in cache, depending on how the CodeIgniter session driver is configured.
The cookie is sent only to the domain that set it (first-party), to the same site's server, not to third parties.
What it is used for
- Keeps the user logged in across pages visited
- Preserves shopping cart contents or forms being filled in
- Enables CSRF protection and other session-based security mechanisms
- Ensures the correct functioning of technical application flows (checkout, admin panels, restricted areas)
Does it require consent?
In CookieFix's classification, ci_session falls under the necessary (strictly necessary) category. Under Article 4(5) of Law 506/2004 (which transposes the ePrivacy Directive) and ANSPDCP guidance, cookies strictly necessary for a service explicitly requested by the user do not require prior consent.
The site administrator must still declare this cookie in the cookie policy, stating its purpose and duration, for transparency towards visitors, even though no consent checkbox is required.
How to block or delete ci_session
A visitor can delete or block ci_session from browser settings (Chrome, Firefox, Safari, Edge – per-site cookie management section). Blocking it, however, affects core functionality: the user may be logged out automatically, the shopping cart may be emptied, and forms with CSRF protection may fail on submission.
Being a strictly necessary cookie, a CMP like CookieFix does not block it in the consent banner, since the purpose of a consent platform is to automatically block statistics and marketing scripts until the visitor consents, not cookies that are indispensable to the site's operation.
Frequently asked questions
It's the session cookie of the CodeIgniter PHP framework, used to keep track of a visitor's state (login, cart, forms) while browsing the site.
No. It's classified as strictly necessary because it supports basic site functionality, but it must still be listed in the cookie policy.
The typical duration is 2 hours, though the expiration time can be changed by the site administrator in the CodeIgniter configuration.
The user's session is lost: you may get logged out automatically, the shopping cart may empty, or forms may fail to submit due to CSRF protection.