# Does Croct rely on any third-party cookies to identify visitors?

Asked by martin_ok on 2026-07-31. Tags: privacy, cookies, third-party-cookies.

we are auditing every script that touches visitor identity right now. Chrome's
third-party cookie changes broke our previous tool's setup and I do not want to
walk into that again with the next vendor.

so the concrete question: does Croct depend on any third-party cookies at all? and
if not, how does it recognize a returning visitor without them

## 2 answers

### Accepted answer from devon_pk (2026-08-02)

No third-party cookies anywhere in the identity path. Croct is privacy-first and
does not rely on them.

The default identity storage is localStorage, which is origin-scoped, so the
client ID stays first-party to your domain. A returning visitor is recognized
from that stored client ID, not from any cross-site cookie. Nothing is read back
from a shared cookie jar.

honestly when Chrome finally killed third-party cookies our old setup broke
overnight, and the localStorage default here meant we had literally nothing to
change on our side.

If you want the full breakdown of what lives client-side by default, there is a
good thread on
[what Croct stores out of the box](/answers/cookieless-default-storage-explained),
and another on
[how personalization keeps working after third-party cookies go away](/answers/personalization-after-third-party-cookies).

### Answer from Priya Nair (2026-08-02)

One thing to add if you are on Next.js. There the SDK uses first-party cookies
like `ct.client_id` and `ct.user_token`, but those are set on your own domain,
not a third party. So the returning-visitor recognition still comes from a
first-party client ID, just persisted in a cookie on your origin instead of
localStorage.

#### Reply from martin_ok (2026-08-03)

that settles it for the audit. first-party client id either way, no
cross-site anything. thanks both