What cookies does session replay set?

In addition to the default Heap cookies, session replay sets the following cookies. 

_cs_id

Description

Stores technical user data.
Contains the following information separated by dots:

• User ID,
• User creation timestamp (seconds),
• Number of visits,
• Last pageview timestamp (seconds),
• Last visit timestamp (seconds),
• Timestamp of the last time this visitor was drawn,
• Cookie expiration date,
• Cookie SameSite attribute:
  • None: For cross-domain projects
  • Lax: For projects that are not cross-domains
  • X: When browsers that do not support the SameSite cookie attribute.
• Cookie Secure attribute value:
  • 0: cookie is not secure. Default for projects that are not cross-domain or if the browser doesn’t support the SameSame cookie attribute.
  • 1: cookie is secure, default for cross-domain projects.

Lifetime

13 months, fixed. The cookie value is updated with every pageview.
The cookie is recreated if the visitor can be tracked and no _cs_id cookie exists.

Length

Up to 103 characters

Example

5c8f99e9-46cc-a2cc-b049-031bfdb3d43b.1661526503.5.1661785703.1661785703.1.1695690503380

_cs_s

Description

Stores Session Replay data.
Contains the following data separated by dots:

• The number of pages viewed for the current session
• The Session Replay data collection state:
  • For the legacy Session Replay data collection pipeline:
    • 1 when not collected,
    • 3 when collected,
    • 5 when collected after a specific trigger.
  • For the main Session Replay data collection pipeline:
    • 0 when not collected,
    • 5 when collected
• The Event Triggered Replay (ETR) state:
  • 0 when ETR sampling is not allowed
  • 1 when ETR sampling is allowed
• The cookie expiry timestamp (Epoch time)

Length

Between 16 and 20 characters.

The maximum number of characters depend on the number of pages seen during the session. On average, for less than 100 pageviews, this adds between 16 and 17 characters.

Lifetime

30 minutes, renewed with every page view.

Example

3.0.0.1661531650281

_cs_c

Description

Stores user consent on use of session data use within replays (not masked vs. full masked):

• 1 (consent not expressed) — visitor session is fully masked.
• 2 (consent granted) — visitor session is not fully masked even if the feature is enabled.
• 3 (consent withdrawn) — visitor session is fully masked even if the feature is not enabled.
• 0 (masking not required) — visitor session is not fully masked.

Lifetime

13 months, renewed when consent is updated.