What is the mf_ cookie?
The mf_ cookie is part of the cookie set used by Mouseflow, a behavior analytics tool that provides heatmaps, session replay recordings, and funnel analysis. It is set by the Mouseflow script installed on the website, so from the visitor's perspective it appears as a first-party cookie.
It is created as soon as a visitor loads a page where the Mouseflow script is active, regardless of whether they interact with the page.
What data it stores
The full cookie name contains, after the mf_ prefix, a numeric or alphanumeric identifier tied to the website's Mouseflow site ID. The value itself generally serves to associate the current browsing session with the recordings and behavioral data Mouseflow collects for that site.
The exact value format may vary and is not publicly documented in detail by the vendor. Data gathered through this mechanism (mouse movements, clicks, scrolling, form input) is sent to Mouseflow's servers.
What it is used for
Its main purpose is to let Mouseflow link a visitor's activity to a unique analytics session, so the site owner can review session recordings, click and scroll heatmaps, and reports on friction points in navigation or form completion.
For the website, this information is used strictly for UX and conversion optimization purposes, not for ad targeting.
Does it require consent?
The mf_ cookie falls under the statistics/analytics category, since it involves tracking an individual visitor's behavior throughout a session. Under Romania's Law 506/2004 (transposing the ePrivacy Directive) and the GDPR, this type of cookie requires prior user consent before being set, as it is not strictly necessary for the site to function.
Site owners must disclose this cookie in their cookie policy, obtain explicit consent through a compliant banner, and, where applicable, put a data processing agreement (DPA) in place with Mouseflow, checking the data transfer mechanism if servers are outside the EU.
How to block or delete mf_
Visitors can delete or block this cookie via browser settings (most browsers allow deleting cookies per site or blocking third-party cookies), as well as through privacy/anti-tracking browser extensions. Being a session cookie, it is removed automatically when the browser closes anyway.
For site owners, the Mouseflow script must be automatically blocked until consent is obtained, not merely hidden visually. A CMP like CookieFix can intercept and block the Mouseflow script before it runs, releasing it only after the visitor accepts the statistics category.
Frequently asked questions
It is not malicious, but it involves detailed tracking of browsing behavior (mouse movements, clicks, form inputs), which is why the law treats it as requiring consent.
It is a session cookie, so it is automatically deleted when the visitor closes their browser.
Yes, any website using Mouseflow should list this cookie, its purpose, and its "statistics" category in the cookie policy.
It shouldn't – since it requires visitor consent, the Mouseflow script should be automatically blocked by the CMP until the user accepts the statistics category.