What is the ct0 cookie?
The ct0 cookie is generated by the X platform (formerly Twitter) when a user visits twitter.com/x.com or interacts with X widgets and embeds on third-party sites, such as embedded tweets or share buttons.
It typically appears as soon as the browser makes a request to the twitter.com domain, regardless of whether the user is logged in, since it serves a technical session-security role.
What data it stores
The value of ct0 holds a unique, server-generated token used as an anti-CSRF measure. The exact value format is not publicly documented and may vary; as far as publicly known, it does not contain direct identifiers such as a name or email address.
The token is sent by the browser to X servers with subsequent requests to the .twitter.com domain, to verify that the request originates from a legitimate session.
What it is used for
The main purpose of ct0 is protection against Cross-Site Request Forgery attacks: the platform checks this token to confirm that submitted actions (likes, retweets, posts) genuinely originate from the X interface and not from a malicious site attempting to act on the user's behalf.
For third-party sites embedding X content (embeds, buttons), this cookie is part of the underlying technical operation of that widget.
Does it require consent?
Under CookieFix's classification, ct0 is categorized as strictly necessary, since it performs an essential security function (CSRF prevention) without which basic session functionality cannot operate correctly.
- Strictly necessary cookies do not require prior consent under Article 5(3) of the ePrivacy Directive and Romania's Law 506/2004.
- Site owners must still disclose this cookie in their cookie policy, naming the provider (X/Twitter) and its purpose.
- If the site's X embeds also set separate analytics or marketing cookies, those may require consent.
How to block or delete ct0
A visitor can manually delete or block this cookie via browser settings (Chrome, Firefox, Edge, and Safari all allow deleting cookies per domain), though this may break embedded X widgets or require re-authentication on the platform.
For site owners embedding X content, a CMP like CookieFix can automatically block the loading of third-party scripts that trigger this cookie until the visitor gives consent, when the embed is configured as a resource requiring prior approval.
Frequently asked questions
It's a security cookie used for CSRF attack protection, set on the .twitter.com domain.
No, it's classified as strictly necessary and can be set without prior consent, but it must still be disclosed in the cookie policy.
Its typical duration is 1 year from being set, based on public observations of X cookies.
Embedded X widgets and features on a site may stop working correctly, and the session on the X platform may be affected.