What is the csrftoken cookie?
Csrftoken is a security cookie set by the website's own server-side application, not by an external analytics or advertising service. The name is generic — many frameworks and platforms (most notably Django) use a cookie with this or a similar name to implement CSRF protection, which is why the provider is listed as 'various'.
The cookie typically appears as soon as a visitor loads a page containing a form (login, contact, checkout, comments) or any action that submits data to the server.
What data it stores
Csrftoken stores a randomly generated token — a string of characters with no human-readable meaning and no personal data such as a name or email address. The exact value format differs between frameworks.
This value is sent back to the server with every form submission (usually in a hidden field or an HTTP header) and compared against the value stored in the cookie to confirm the request genuinely came from the site itself.
What it is used for
The cookie's role is purely technical: it prevents Cross-Site Request Forgery attacks, where a malicious website could send forged requests to your application using a visitor's authenticated session (for example, changing a password or placing an order without the user's knowledge).
For the site owner, csrftoken is part of the application's core security mechanism, not an analytics or marketing tool.
Does it require consent?
Csrftoken falls under the 'necessary' (strictly necessary) category under the ePrivacy Directive (implemented in Romania through Law 506/2004) and GDPR. Since it is essential for the safe operation of forms, it does not require the visitor's prior consent.
- It should still be listed in the site's cookie policy, along with its purpose and storage duration.
- It should not be blocked before consent, since doing so would break form functionality.
How to block or delete csrftoken
A visitor can delete the csrftoken cookie from their browser settings, but it will be automatically regenerated by the server the next time a page with a form loads — it is required for forms to work correctly.
On the site side, a CMP such as CookieFix automatically classifies csrftoken as a necessary cookie and does not block it before consent, unlike statistics or marketing scripts, which it keeps blocked until the visitor gives their consent.
Frequently asked questions
No. It is a security cookie used solely to verify the authenticity of requests sent to the server, not to track online behavior.
It is set by the visited website's own application (server-side), not by a third-party service. It commonly appears on sites built with Django, but also on other frameworks implementing similar CSRF protection.
No, since it is a strictly necessary cookie for form security it does not require prior consent, but it must still be disclosed in the site's cookie policy.
The next form submission may be rejected by the server with a validation error, and the browser will automatically receive a new token when the page reloads.