What is the joomla_user_state cookie?
joomla_user_state is a first-party cookie automatically generated by the core of the Joomla CMS when a visitor accesses a site built on this platform. It is not set by an external third-party provider, but is part of Joomla's internal session-management mechanism.
It typically appears as soon as a user loads the site or interacts with session-dependent areas, such as login forms, restricted sections, or components that need to know whether a visitor is authenticated or anonymous.
What data it stores
The cookie stores an internal technical value used by Joomla to distinguish between different user states on the site (for example, logged-in versus not logged-in). The exact format of this value can vary depending on the Joomla version and site configuration, so it cannot be described precisely without inspecting the specific installation.
The data stays between the visitor's browser and the server hosting the Joomla site; it is not sent to any third-party service, as it is an internal CMS mechanism.
What it is used for
Its main purpose is to keep the browsing experience consistent during a single session: the site 'remembers' whether the visitor is logged in, so relevant pages are displayed correctly without asking for extra data on every click.
For the site owner, this cookie ensures that access-controlled areas (backend, restricted components) work properly and helps avoid errors from broken or lost sessions during navigation.
Does it require consent?
As a session cookie tightly bound to core authentication functionality, it generally falls under the 'strictly necessary' category in CookieFix's classification.
- Under ePrivacy rules (as transposed locally, e.g. Romania's Law 506/2004) it does not require prior visitor consent, since it is essential for delivering the requested service.
- It should still be listed explicitly in the site's cookie policy, with a plain explanation of its technical purpose.
- Site owners should confirm it is not repurposed beyond its functional role (e.g. for profiling), in which case its classification would need to be reconsidered.
How to block or delete joomla_user_state
A visitor can delete or block joomla_user_state from their browser's privacy settings (Chrome, Firefox, Edge, Safari), under cookie management for that site. Blocking it, however, may cause automatic logout or broken behavior in authenticated areas.
Because it is strictly necessary, site owners should not block it via a CMP before consent — doing so would break essential functionality like login. A platform such as CookieFix can still detect this cookie automatically during a scan and correctly classify it as necessary, blocking only statistics or marketing scripts until consent is given.
Frequently asked questions
It is a session cookie generated by the Joomla platform to track a visitor's login state during the current visit.
No, since it is strictly necessary for core session functionality it does not require prior consent, but it must be disclosed in the site's cookie policy.
It is a session cookie, so it is automatically deleted when the visitor closes the browser or the browsing session ends.
You may get logged out automatically or be unable to properly access areas of the site that require authentication.