What is the has_js cookie?
has_js is a session cookie automatically generated by Drupal core (older versions, particularly Drupal 6 and 7, commonly use this mechanism). It is set by a small JavaScript snippet that runs as soon as the page loads in the browser.
The cookie appears on any page of a Drupal-powered site where this detection mechanism is active, regardless of whether the visitor interacts with forms or dynamic elements. Its purpose is purely technical: to tell the server whether it can serve content adapted for browsers with JavaScript enabled.
What data it stores
The stored value is simple, typically the digit 1, indicating that JavaScript is active in that browser. It does not contain unique identifiers, email addresses, or other personal data.
The cookie is read exclusively by the server hosting the Drupal site, to decide how to render certain page components (for example, forms that behave differently with or without JavaScript).
What it is used for
The cookie's role is to let the site adapt the display and behavior of certain interface elements based on the visitor's browser capabilities. It is used by Drupal core itself, not by an external analytics or marketing service.
Without this cookie, some older Drupal modules may render degraded versions of forms or other interactive components, defaulting to the assumption that JavaScript is unavailable.
Does it require consent?
has_js is classified as a strictly necessary cookie (required for the site's technical operation), since it does not track user behavior and serves no marketing or statistical purpose. Under the ePrivacy Directive (transposed in Romania via Law 506/2004) and GDPR, strictly necessary cookies do not require prior visitor consent.
- Site owners should still list it in the cookie policy, along with its purpose and duration.
- No separate accept option is needed for this cookie in the consent banner.
How to block or delete has_js
A visitor can delete or block this cookie from browser settings, like any other cookie – for instance via the privacy/history section of Chrome, Firefox, or Edge. Blocking it typically does not affect the site's essential functions, only Drupal's JavaScript detection.
For site owners, even though this cookie doesn't require consent, a CMP such as CookieFix can be configured to automatically block all non-essential scripts until consent is given, helping ensure every cookie found during a scan is correctly classified.
Frequently asked questions
No, it is classified as strictly necessary for the site's technical operation and does not track user behavior. It should still be disclosed in the cookie policy.
The site usually keeps working normally, but some older Drupal forms or components may fall back to their non-JavaScript version.
It is a session cookie, so it is deleted automatically when the browser is closed.
No, it only stores a technical value indicating whether JavaScript is enabled, with no personal identifiers.