What is the xs cookie?
"xs" is an HTTP cookie set by Facebook on the .facebook.com domain, used as a secondary session token alongside the main "c_user" cookie. It is created when a user logs into their Facebook account, but it can also be sent to other sites through embedded social plugins (share buttons, Facebook Comments) or the Meta pixel loaded on a page.
On a site that doesn't belong to Facebook, this cookie usually appears only if the visitor is logged into Facebook in the same browser and the site loads a Meta script or widget that triggers a request to the facebook.com domain.
What data it stores
The cookie stores a session identifier used by Facebook to validate the login state, generated and interpreted exclusively by Meta's systems. The exact value format is not publicly documented and may vary; it should not be treated as readable or editable text.
Data associated with this cookie is sent to Facebook/Meta servers, not to the site displaying the widget. The host site essentially triggers a request to the Facebook domain but has no access to the cookie's contents.
What it is used for
For Facebook, "xs" confirms the validity of a logged-in user's session and helps prevent session hijacking. It is part of the security mechanism that accompanies the "c_user" cookie.
For a third-party site loading social plugins or the Meta pixel, the presence of "xs" signals an active connection to the Facebook ecosystem, letting Meta link visits on that site to an existing user profile for targeted advertising and conversion measurement.
Does it require consent?
Category: marketing/tracking. Even though "xs" serves a security function for Facebook itself, its use in a third-party context (via pixel or social plugin integration for advertising or analytics) places it among cookies requiring prior consent under GDPR and the ePrivacy Directive (2002/58/EC).
- Site owners must disclose the cookie in their cookie policy, listing Facebook/Meta as the provider.
- The script or pixel that generates this cookie must not load before the visitor gives explicit consent.
- Consent should be granular, revocable at any time, and properly documented, per applicable data protection guidance.
How to block or delete xs
Visitors can delete or block this cookie from their browser settings (Chrome, Firefox, Edge, Safari – cookies and site data section) or use private browsing mode. Tracker-blocking extensions can also prevent the Facebook scripts that set this cookie from loading.
For site owners, the correct approach is to automatically block the Facebook script or widget until consent is given. A CMP such as CookieFix can prevent these elements (pixel, social plugin) from loading by default and enable them only after the visitor accepts the marketing category.
Frequently asked questions
No, it's a technical session cookie used by Facebook for login and security purposes, not malware. The GDPR concern comes from its use for tracking on third-party sites.
It usually appears because your site embeds a share button, Facebook Comments, or the Meta pixel, and the visitor happens to be logged into Facebook in the same browser.
Yes, if it appears on your site through Facebook integrations used for marketing or analytics, it should be treated as a marketing cookie requiring prior consent.
The typical duration observed is about one year, though Facebook may adjust this without public notice.