What is the PHPSESSID cookie?
PHPSESSID is the standard cookie used by the PHP language to identify a browsing session. It is set automatically by the native session_start() function, available in any PHP-based application (websites, online stores, forms, admin panels, and frameworks such as CodeIgniter, Laravel, WordPress).
The cookie appears as soon as the server initiates a PHP session — typically on the first page load, at login, when adding a product to a cart, or when filling out a multi-step form.
What data it stores
PHPSESSID does not itself store personal data; it only holds a unique identifier (a randomly generated alphanumeric string, usually 26 characters long) that links the visitor's browser to session data kept on the server, such as shopping cart contents, login state, or temporary form values.
The value is sent to the domain that set the cookie with every HTTP request, via the Cookie header. It is not shared with third parties and is not used for cross-site tracking.
What it is used for
PHPSESSID serves a purely technical purpose: it lets the server recognize the same visitor as they navigate between pages. Without it, basic functions like the shopping cart, login, CSRF protection, or multi-step forms would not work correctly.
It has no marketing, analytics, or user-profiling role.
Does it require consent?
PHPSESSID falls under the strictly necessary cookie category. Under ePrivacy Directive 2002/58/EC (in Romania, transposed via Law 506/2004) and GDPR guidance, it does not require the visitor's prior consent because it is indispensable for the site or a service explicitly requested by the user.
Even though consent isn't required, site owners must still list it in their cookie policy, stating its category, purpose, and duration, to meet GDPR transparency obligations.
How to block or delete PHPSESSID
Visitors can delete or block PHPSESSID from their browser's settings (Chrome, Firefox, Edge, Safari), under per-site cookie management. Blocking it, however, can break core functionality such as the shopping cart or staying logged in.
Because it is strictly necessary, a GDPR-compliant CMP should not auto-block this cookie before consent — only statistics, marketing, and preference cookies are blocked by default. A CMP like CookieFix makes this distinction automatically, blocking non-essential scripts until consent is given while leaving strictly necessary cookies like PHPSESSID unaffected.
Frequently asked questions
No, it is a strictly necessary cookie from a technical standpoint, so it doesn't require prior visitor consent, but it must be disclosed in the site's cookie policy.
It's typically a session cookie that is deleted automatically when the browser closes, though the exact duration can vary depending on server configuration.
Session-dependent features such as the shopping cart, login, or multi-step forms may stop working correctly.
By itself it only stores a random technical identifier, not personal data; the actual session data is kept on the server, not in the cookie.