What is the sbjs_session cookie?
sbjs_session is a cookie generated by the Sourcebuster.js script, bundled with the WooCommerce plugin for WordPress. Sourcebuster is an open-source library used by WooCommerce to perform traffic-source attribution tracking, linking orders to the marketing channel that generated them.
The cookie is created as soon as a visitor loads a page on a WooCommerce store, regardless of interaction with the content. It is set separately from sbjs_current and sbjs_first, which retain longer-term traffic source information.
What data it stores
The cookie stores a numeric identifier marking the current browsing session (typically a timestamp or session counter). It does not contain directly identifying data such as a name or email address, but it is part of a broader set of Sourcebuster cookies (sbjs_session, sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_udata) that together allow the visitor's journey to be reconstructed.
The data stays stored locally in the visitor's browser and is read by the WooCommerce script on the site to populate hidden order-attribution fields; it is not sent to an external server operated by the provider.
What it is used for
The main purpose is accurate order attribution: the store owner can see, in WooCommerce Analytics reports, which marketing channel (organic search, social media, paid campaigns, referral) generated a given sale. For the site owner, this data helps evaluate marketing campaign performance and optimize advertising spend.
Because the session expires after 30 minutes of inactivity, the cookie only reflects the current visit rather than the visitor's full history on the site.
Does it require consent?
CookieFix classifies sbjs_session under the statistics (analytics) category, since it is used to measure and analyze visitor behavior, even though the data stays local and serves an internal attribution purpose.
- Under the GDPR and the ePrivacy Directive (2002/58/EC, transposed in Romania by Law 506/2004), statistics cookies generally require the visitor's prior consent, unless the measurement setup is configured so that it involves no processing of personal data or cross-site tracking.
- The site owner must disclose this cookie in the cookie policy and ensure the Sourcebuster/WooCommerce script does not run before the visitor has given consent for the statistics category.
How to block or delete sbjs_session
A visitor can manually delete or block the cookie from browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management) or use private/incognito browsing, in which case the cookie does not persist after the session ends.
At the site level, the administrator should automatically block the Sourcebuster/WooCommerce scripts that set sbjs_session until the visitor accepts the statistics category. A CMP such as CookieFix can do this automatically, intercepting the relevant scripts and releasing them only after consent is obtained, reducing the risk of non-compliance.
Frequently asked questions
It is set locally, in the visitor's browser, by the Sourcebuster.js script bundled with the WooCommerce plugin, not by an external third-party server.
About 30 minutes; the cookie expires if the visitor stops interacting with the site within that window, marking the end of the current session.
No, it is considered a statistics/analytics cookie used for traffic-source attribution, so it requires the visitor's consent under GDPR/ePrivacy.
The WooCommerce store will no longer be able to correctly attribute the order to a specific traffic source, but the checkout process and site functionality are not affected.