What is the csrf_token cookie?
csrf_token is a session cookie used by a very wide range of web applications and frameworks (not a single commercial provider) to generate and verify a unique token tied to the user's session. It is set by the website itself (first-party cookie), not by a third-party service.
It typically appears as soon as a visitor loads a page containing a form (login, checkout, comments, contact form) or when a session starts, regardless of whether the visitor has given consent for other cookie categories.
What data it stores
The cookie value is usually a randomly generated alphanumeric string (a hash or cryptographic token) with no direct link to the person's identity. The exact format varies depending on the framework used by the site.
The token is sent back to the server with every state-changing request (such as submitting a form), so the server can verify the request genuinely originated from the page shown to the visitor and not from a malicious third-party site.
What it is used for
The cookie's role is purely security-related: it prevents an attacker from tricking an authenticated user's browser into silently sending a request to the site (e.g., changing a password or making a payment) from another site controlled by the attacker.
For site owners, this cookie is part of the standard form and session protection mechanisms built into most modern web frameworks.
Does it require consent?
csrf_token is classified as strictly necessary under Article 5(3) of the ePrivacy Directive and equivalent national implementations (in Romania, Law 506/2004). Strictly necessary cookies do not require the visitor's prior consent.
- Site owners must still list it in the cookie policy, with its purpose and duration.
- It should not be grouped with categories requiring opt-in (statistics, marketing, preferences).
- Listing it separately as an example of a technical cookie helps transparency.
How to block or delete csrf_token
A visitor can delete or block this cookie from their browser settings (Chrome, Firefox, Edge, Safari — cookie management section), but doing so may break forms on the site (login, checkout, contact), since the server will no longer be able to validate submitted requests.
Because it is strictly necessary, this cookie should not — and practically cannot — be blocked by a CMP pending consent, unlike statistics or marketing cookies. A platform like CookieFix automatically blocks, until consent is given, only the scripts from categories that actually require the visitor's agreement, leaving strictly necessary cookies such as csrf_token unaffected.
Frequently asked questions
No. It is a strictly necessary cookie for site security and operates without prior visitor consent, under ePrivacy and GDPR rules.
A new one is usually generated automatically on the next visit. If you block it entirely, forms that submit data (login, payments, comments) may stop working.
Not directly — it's a randomly generated token with no inherent link to the user's identity, though it may be tied to an authenticated session.
Yes. Even though it doesn't require consent, strictly necessary cookies must still be disclosed in the cookie policy, along with their purpose and approximate duration.