What is the SESS cookie?
SESS is the prefix of a cookie name automatically generated by Drupal, one of the most widely used open-source content management systems (CMS). The full cookie name typically continues with a hash derived from the site's domain, so each Drupal installation gets a distinct session identifier.
The cookie is set by the server running Drupal, not by a third-party script, and it usually appears the moment a visitor interacts with the site in a way that requires maintaining state — for example logging in, filling out a multi-step form, or using a shopping cart.
What data it stores
The value of the SESS cookie is a session identifier generated by PHP (the engine Drupal runs on), with no directly readable user information. The server uses this identifier to link a visitor's successive requests to a session stored server-side, where data such as login state or in-progress form content may be temporarily kept.
The associated data generally stays on the site's own server; the cookie itself is sent only to the domain that set it, not to third parties.
What it is used for
The purpose of the SESS cookie is strictly functional: it lets a Drupal-based site recognize the same visitor across multiple pages without forcing them to log in again or re-enter information at every step.
For site administrators, this cookie is essential for authenticated areas (user accounts, the Drupal admin panel), shopping carts, or multi-step forms to work correctly. Without it, these basic functionalities could not operate.
Does it require consent?
SESS is classified as a strictly necessary cookie (the „necessary” category), since it directly supports functionality explicitly requested by the user (such as logging in). Under Article 5(3) of the ePrivacy Directive — transposed in Romania via Law no. 506/2004 — and per ANSPDCP guidance, strictly necessary cookies do not require prior consent to be placed.
- It should not appear as an opt-out option in the consent banner
- It should still be listed, with purpose and duration, in the site's cookie policy
- Site owners should verify the script generating it isn't reused for other purposes (e.g. session-linked traffic analysis)
How to block or delete SESS
A visitor can delete or block the SESS cookie from their browser settings (Chrome, Firefox, Safari, Edge) under the per-site cookie management options. Blocking it may log the user out of a Drupal admin account or interrupt an in-progress form or shopping cart.
Since it's a strictly necessary cookie generated directly by the application rather than an external third-party script, a CMP like CookieFix does not block it automatically regardless of consent — a CMP's role is to block analytics and marketing scripts until consent is given, not the site's core functionality.
Frequently asked questions
Not as an opt-out choice, since it's strictly necessary. It should still be documented in the site's cookie policy, with its purpose and duration.
Drupal appends a hash derived from the site's domain after the SESS prefix, so each installation gets a distinct, isolated session cookie.
You'll be logged out of your Drupal account (if you were signed in), and any temporary session data, like an in-progress form, may be lost.
No. It's a technical session cookie used solely to make the site function, with no marketing or analytics purpose.