What are ct.client_id and ct.user_token cookies and how long do they live?
I am auditing all cookies on our Next.js site ahead of an internal privacy review and found two set by the Croct proxy: ct.client_id and ct.user_token. Our consent banner vendor requires formal documentation for every cookie: name, purpose, and exact duration.
Can someone confirm the lifetimes and what each cookie is for? I also saw a ct.preview_token mentioned somewhere but it does not appear on our production domain. And is the duration configurable in case our policy requires shorter retention?
1 answer
Documented this exact table for a client review a while back:
- ct.client_id: anonymous client identification. Lifetime 1 year.
- ct.user_token: the user token for the current visitor. Lifetime 7 days.
- ct.preview_token: only exists while someone is viewing a preview link, which is why you never see it in production traffic. You can list it as session-scoped preview functionality.
All of it is configurable. The SDK cookie options let you set name, maxAge, domain, path, secure, and sameSite per cookie, so if your policy mandates shorter retention you can lower the maxAge values. The domain option is also how you share identity across subdomains if you ever need app.example.com and www.example.com to see the same visitor.
Worth noting for the review: these are first-party cookies set by your own proxy, not third-party trackers, which usually puts them in a friendlier category with consent vendors.