What is the OCSESSID cookie?
OCSESSID is the native session cookie generated by OpenCart, an open-source e-commerce platform used to run online stores. It functions like OpenCart's own version of a PHP session cookie (comparable to PHPSESSID in other applications).
The cookie is set automatically as soon as a visitor lands on a site built with OpenCart, whether they are browsing products, adding items to the cart, or logging into an account. It is placed by the server running the store, not by a third-party service.
What data it stores
OCSESSID stores a unique, server-generated session identifier that does not directly contain readable personal data. Through this identifier, OpenCart links the visitor to session information kept on the server, such as shopping cart contents, compared products, the current checkout step, or login status.
The value is an alphanumeric string with no standardized public format; it is not sent to third parties and is used solely by the store's own server to recognize the session on each request.
What it is used for
The purpose of OCSESSID is strictly functional: it lets the store 'remember' a visitor from one page to the next during the same visit. Without it, the shopping cart would empty on every page reload, and account login would not work correctly.
It is essential for basic online store functionality: browsing, adding products to the cart, completing checkout, and maintaining a logged-in user session.
Does it require consent?
- CookieFix category: necessary (strictly necessary)
- Under GDPR and the ePrivacy Directive (2002/58/EC), cookies strictly necessary to provide a service explicitly requested by the user (e.g. the shopping cart) do not require prior consent.
- The site owner must still disclose it in the cookie policy, along with its actual purpose and duration.
- It should not be placed under 'statistics' or 'marketing' categories in the consent banner, as it does not serve those purposes.
How to block or delete OCSESSID
A visitor can delete or block OCSESSID from their browser's cookie settings (Chrome, Firefox, Edge, Safari), but doing so will empty the current shopping cart and may log the user out, disrupting the store's functionality.
Because it is strictly necessary, a CMP like CookieFix should not block this cookie before consent, since doing so would break core features such as adding products to the cart. CookieFix can still automatically detect the cookie during a scan and correctly classify it as 'necessary,' leaving it active by default, unlike analytics or marketing scripts that it blocks until consent is given.
Frequently asked questions
It is the session cookie generated by the OpenCart platform to maintain a visitor's shopping cart and login state during their visit to an online store.
No, since it is strictly necessary for the store to function (cart, checkout, account), it does not require prior consent under GDPR/ePrivacy, but it must be disclosed in the cookie policy.
It typically lasts for the duration of the current browsing session and is deleted when the browser closes, though the exact duration can vary depending on server configuration.
The shopping cart will be emptied, and account login or checkout completion may stop working correctly on that store.