What is the taboola_session_id cookie?
taboola_session_id is generated by Taboola scripts, a native advertising and content recommendation network ("you may also like" widgets) embedded on many news sites, blogs, and online stores. It is not a classic HTTP cookie but a sessionStorage entry, a browser-local storage mechanism serving a similar purpose but limited to a single tab/session.
It appears on a site when the visitor accepts the marketing category in the consent banner, or, if the site is not compliant, even before consent is given, as soon as the Taboola widget or a Taboola tracking pixel added by the site owner or a third-party ad platform loads.
What data it stores
The entry stores a session identifier generated by Taboola, used to link a user's interactions (impressions, clicks on recommendations) to a single browsing session. The exact value format is internal to Taboola's platform and may vary; it is not publicly documented in detail.
Since it lives in sessionStorage, the data stays only in the browser while the tab is open and is sent to Taboola's servers whenever its scripts communicate with the platform (for example, when a recommendation widget is displayed or interacted with).
What it is used for
For Taboola, this identifier helps recognize the same browsing session throughout a visit, supporting measurement of content recommendation performance, preventing duplicate counting of impressions, and optimizing recommendation/advertising algorithms.
For the site owner, correctly functioning tracking means more accurate reporting on the performance of embedded Taboola widgets and, indirectly, better-calibrated advertising revenue.
Does it require consent?
Under CookieFix's classification, taboola_session_id is marketing (advertising/tracking). Since it is used to track a session for advertising/recommendation purposes, it falls under Article 4^1 of Law 506/2004 (transposing the ePrivacy Directive) and requires the visitor's prior consent, together with an appropriate legal basis under GDPR.
- The site owner must disclose this cookie/storage element in the cookie policy.
- The Taboola script must be blocked until the visitor gives consent for the marketing category.
- Consent must be as easy to withdraw as it was to give.
How to block or delete taboola_session_id
A visitor can clear sessionStorage content through browser settings (for example by clearing browsing data or using incognito/private mode, which does not persist sessionStorage across sessions). Tracker-blocking browser extensions can also prevent Taboola widgets from loading.
For site owners, automatic blocking before consent is achieved through a CMP that stops the Taboola script from running until the visitor consents – for instance, CookieFix can automatically block this script and only activate it after the visitor chooses the marketing category.
Frequently asked questions
No, it is a session-tracking mechanism used for advertising and content recommendations, and does not contain sensitive data such as passwords or financial information.
Since it is stored in sessionStorage, it only lasts for the current browsing session and disappears when the tab or browser is closed.
Yes, since it is used for marketing/tracking purposes, it requires the visitor's prior consent under Law 506/2004 and GDPR.
Remove the Taboola widgets or pixels, or block their execution with a CMP until visitor consent is obtained.