Does Croct set any cookies at all out of the box?
I am completing a vendor privacy assessment and the form requires me to document exactly what is stored client-side, under which name, and for how long. Vague answers do not pass review here.
For a default Croct installation, no special configuration:
- Is anything written to cookies, or is it localStorage only?
- Under which configurations do cookies appear, and with which names and lifetimes?
- Can every cookie attribute (domain, maxAge, sameSite and so on) be declared explicitly, so I can put exact values in the assessment?
I need this precise enough to survive an auditor reading it line by line
1 answer
Went through the same exercise for our assessment last quarter, so here are the exact answers.
-
Default storage is localStorage, origin-scoped. A default installation sets no cookies, and no third-party cookies are involved in targeting under any configuration.
-
Cookies appear only when you configure them. The main case is cross-subdomain identity, where storage moves to first-party cookies: croct.id for the client ID and croct.user_token for the user token, with a typical maxAge of 1 year. Separately, the Next.js SDK manages its own first-party cookies: ct.client_id, ct.user_token, and ct.preview_token.
-
Yes. The plug cookie option controls name, secure, maxAge, domain, path, and sameSite per cookie, so the entire storage posture is declarable in your assessment with exact values rather than defaults you have to reverse engineer.
If the subdomain case is relevant to your setup, there is a thread on sharing identity across subdomains when the default is localStorage with the configuration details.
This maps one-to-one onto the assessment form fields. Documented as localStorage-only for our single-domain setup, with the cookie configuration noted as not applicable. Thank you for the precision.