What is the nsid cookie?
nsid is a session-type HTTP cookie set by PayPal (the name most likely stands for "navigation session ID") on the .paypal.com domain. It is not set directly by the website the visitor is browsing; instead, it appears when a visitor interacts with a PayPal button, widget, or checkout flow embedded on a site, such as completing an order in an online store.
The cookie is created when the browser makes a request to PayPal's domains, typically when a PayPal checkout page opens or the user is redirected to it, and it exists only for the duration of the browsing session.
What data it stores
As a technical session cookie, its value is an identifier generated by PayPal's systems, with no publicly documented format from the provider. It is not intended to store personal data in plain text; rather, it acts as an internal reference to the current session state.
The data linked to this identifier stays on PayPal's servers; the merchant's website does not have access to the cookie's contents — the browser simply sends it automatically to the .paypal.com domain with each relevant request.
What it is used for
The main purpose of the nsid cookie is to help PayPal keep a browsing session consistent throughout a payment or authentication process, so the user doesn't lose context (such as a shopping cart or checkout step) while moving between the merchant's site and PayPal's pages.
For the site owner, this cookie has no analytics or marketing function; it strictly supports the correct operation of the PayPal payment integration.
Does it require consent?
CookieFix classifies nsid as a strictly necessary cookie, since it is essential for safely carrying out a transaction the user has actively initiated. Under EU data protection authority guidance and the ePrivacy rules implemented in Romania (Law 506/2004), strictly necessary cookies tied to a service actively requested by the user do not require prior consent.
- The site owner should still list it in the cookie policy, along with its provider, purpose, and duration.
- No separate opt-in is needed for this cookie, but transparency toward visitors remains a GDPR requirement.
How to block or delete nsid
A visitor can manually delete or block the nsid cookie via browser settings (per-domain cookie management), though doing so may interrupt or break the PayPal payment flow for that session.
Because it is strictly necessary, site owners should not block it through the consent banner. A CMP such as the one CookieFix provides can automatically categorize this cookie as necessary and exclude it from the default blocking applied to statistics or marketing scripts, so the PayPal integration keeps working regardless of the visitor's choices for other categories.
Frequently asked questions
No, since it's classified as strictly necessary for the payment session the user requested, it doesn't require prior consent, but it should be listed in the cookie policy.
Blocking it may prevent a PayPal payment or login from completing correctly during that browsing session.
It's a session cookie, so it's automatically deleted when the browser closes or the browsing session ends.
It's set by PayPal on the .paypal.com domain when the user interacts with a PayPal button or checkout flow embedded on the site.