What is the form_key cookie?
form_key is a session cookie automatically generated by Magento, the open-source e-commerce platform used by many online stores worldwide, including in Romania. The cookie appears as soon as a visitor loads any page of a Magento-based site, whether logged in or not.
It is set directly by Magento's core application (server-side), not by a third-party script or marketing plugin, which is why it is considered an internal functional cookie of the commerce platform.
What data it stores
The value of the form_key cookie is a randomly generated alphanumeric string created by Magento for each new session (or when the session is refreshed). It does not contain personal data, only a validation token used internally by the application.
The same value is usually included as a hidden field in the site's HTML forms (add to cart, checkout, login, contact forms). The data stays on the store's own domain (first-party) and is not sent to external servers.
What it is used for
The purpose of form_key is protection against CSRF (Cross-Site Request Forgery) attacks: on every form submission, Magento checks whether the value in the form matches the one in the cookie. If they don't match, the request is rejected.
In practice, this cookie ensures that actions such as adding a product to the cart, completing checkout, or logging into an account cannot be triggered from another site without the user's knowledge. It is essential to the integrity and security of store transactions.
Does it require consent?
form_key falls under the strictly necessary cookie category, in line with guidance from data protection authorities and the European data protection working group. Since it is indispensable for the secure operation of forms (cart, checkout, login), this cookie does not require prior visitor consent, per Article 5 of the ePrivacy Directive 2002/58/EC (transposed in Romania via Law 506/2004).
- The site owner must still disclose it in the cookie policy, with its purpose and duration.
- It should not be shown as a toggle option in the consent banner.
- Correct classification in the CMP is recommended so it isn't accidentally blocked, which would break store functionality.
How to block or delete form_key
A visitor can manually delete or block the form_key cookie from their browser settings (Chrome, Firefox, Edge, Safari), under the cookie management section for a specific site. Blocking it, however, will prevent forms from being submitted correctly and can make it impossible to add products to the cart or complete checkout.
Because it is strictly necessary, a CMP like CookieFix does not block it automatically before consent; instead, it classifies and documents it in the cookie policy, letting the store function normally from the first visit, while statistics or marketing scripts remain blocked until the visitor gives consent.
Frequently asked questions
No, because it is strictly necessary for form security (CSRF protection), it is not subject to the consent requirement under the ePrivacy Directive, but it must be disclosed in the cookie policy.
Site forms (add to cart, checkout, login) may stop working, because Magento cannot validate the submitted request.
No, its value is a random technical token used only for form validation, unrelated to the visitor's identity.
It is a session cookie, so it is automatically deleted when the browser is closed or the Magento session expires.