What is the ts cookie?
"ts" is a technical cookie set by PayPal when a visitor interacts with a PayPal payment button, a checkout form integrated with PayPal, or logs into a PayPal account on a third-party website. It belongs to a family of security-related cookies used by PayPal (alongside similarly named ones such as "ts_c") to protect payment sessions.
It typically appears once the PayPal script loads on the page, whether it was added directly by the site owner or through an e-commerce plugin (WooCommerce, Magento, PrestaShop, etc.).
What data it stores
The cookie stores a technical identifier used by PayPal's systems to recognize and validate the browser session during the payment process. The exact value format is not publicly documented by PayPal and may vary; no further technical details about its internal structure are known.
The data is sent to PayPal's servers (the .paypal.com domain), not to the website hosting the payment button. The typically observed lifespan is around 3 years.
What it is used for
From PayPal's perspective, "ts" helps with fraud detection and protecting authentication/payment sessions, aiding in identifying suspicious behavior or session hijacking attempts.
For the website operator, this cookie provides no marketing or analytics data — its role is strictly functional, ensuring that the PayPal payment flow runs correctly and securely for the customer.
Does it require consent?
The "ts" cookie is classified as strictly necessary because it is essential for the secure functioning of the PayPal payment mechanism actively chosen by the user. Under Article 5(5) of Directive 2002/58/EC (ePrivacy) and its national transpositions, strictly necessary cookies may be placed without prior consent.
The site owner must still list this cookie in the cookie policy, along with its purpose and provider (PayPal), to meet GDPR transparency requirements (Article 13).
How to block or delete ts
A visitor can delete or block this cookie at any time from browser settings (Chrome, Firefox, Edge, Safari – "Privacy and security" / "Cookies and site data"), either globally or specifically for the paypal.com domain. Blocking it, however, may prevent completing a payment through PayPal.
- Since it is strictly necessary, a CMP like CookieFix does not block it automatically by default, but it can display information about it in the banner and cookie declaration, alongside the option to hold back non-essential PayPal scripts until consent, if the site owner wants tighter control.
- Site owners can choose to load the PayPal button/script only on visitor interaction (e.g. a click on "Pay with PayPal"), reducing unnecessary exposure to third-party cookies.
Frequently asked questions
No, since it is classified as strictly necessary for the secure payment/login process, it can be set without prior visitor consent, but it must be listed in the cookie policy.
The PayPal payment or login process may not work correctly or could be interrupted, since PayPal uses this cookie for session security.
The typically observed lifespan is around 3 years from when it is set, though this can vary depending on PayPal's internal policies.
The data is sent exclusively to PayPal (the .paypal.com domain); the website displaying the PayPal button does not have direct access to this cookie's content.