What is the JSESSIONID cookie?
JSESSIONID is the standard session cookie used by platforms built on Java web server technology, such as Apache Tomcat, JBoss/WildFly, WebLogic, or WebSphere. It is part of the Java Servlet specification and is generated automatically by the servlet container, not by the application developer.
The cookie appears as soon as a visitor accesses a page served by a Java application that uses HTTP sessions – for example, during login, adding a product to a cart, or filling out a multi-step form. Essentially any site or portal built on a Java stack (banks, public institutions, enterprise e-commerce platforms) may use it.
What data it stores
The JSESSIONID value is a unique identifier randomly generated by the server (an alphanumeric string), with no direct link to personal data such as a name or email address. This identifier connects browser requests to session data stored on the server (shopping cart, login state, temporary preferences).
The cookie is sent to the domain (and possibly path) of the Java application that generated it, typically with the HttpOnly attribute and, on secure connections, the Secure attribute. It is not sent to third parties and is not used for advertising tracking.
What it is used for
JSESSIONID's role is purely functional: it lets the server recognize the same visitor across multiple HTTP requests, since HTTP is inherently stateless. Without it, users would be logged out or lose their shopping cart contents with every click.
For site administrators, this cookie is indispensable for features like login, checkout, multi-step forms, or Java-based admin panels.
Does it require consent?
JSESSIONID falls under the category of strictly necessary cookies, per the ePrivacy Directive (transposed in Romania via Law 506/2004) and ANSPDCP's interpretation: since it is essential to the session explicitly requested by the user, it does not require prior consent.
- It should not be listed in the consent banner as an option to opt out of.
- It must still be disclosed, along with its purpose and duration, in the site's cookie policy for GDPR transparency.
- Administrators should verify the Java server isn't also setting other cookies (e.g. analytics or personalization) under the same name or alongside JSESSIONID, which would need separate classification and consent.
How to block or delete JSESSIONID
A visitor can delete or block JSESSIONID from browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management), but blocking it may make the Java application unusable (constant logouts, lost cart contents, forms that don't save).
Because it is strictly necessary, JSESSIONID should not, and generally cannot, be blocked by a CMP pending consent – like other technical cookies, it stays active by default. Platforms like CookieFix instead automatically block scripts in the statistics and marketing categories until the visitor gives consent, leaving strictly necessary cookies like JSESSIONID untouched.
Frequently asked questions
No. It's a strictly necessary cookie for session functionality, so it's exempt from the consent requirement under ePrivacy and GDPR, but it must be disclosed in the cookie policy.
You'll typically be logged out of your account or lose data entered in the current session (shopping cart, in-progress form), and the server will generate a new JSESSIONID on the next request.
No. It's a technical session identifier used exclusively by the Java application to maintain user state on the server, not for profiling or advertising.
It's a session cookie – it expires automatically when the browser is closed or after a period of inactivity set by the Java application on the server, typically between 15 and 30 minutes.