Cookies and the cookie list

What the list is for

Every site in Cookiemark has a list of the cookies it sets. Each cookie has a category, a provider, a purpose and a period it is kept for. You find it on the site's Cookies tab. The list does two jobs.

• It informs the visitor. In the preferences window, each category shows the number of cookies in it. A visitor can open that line and read what each cookie does. You can hide these lines with Show cookies in the preferences on the Design tab.
• It cleans up after a withdrawal. When a visitor switches a category off, Cookiemark removes the cookies of that category that the list names. A star in a name matches anything, so _ga_* covers every cookie that starts with _ga_.

The list does not decide what gets blocked. Blocking works on scripts and frames, as Blocking scripts and embeds explains.

Filling the list

From a scan

The quickest way is a scan. It visits your pages, collects every cookie it finds and suggests a category, a provider and a purpose for each one it recognises. Tick the cookies you want and add them to the list in one go.

From a service

Press Add from a service and pick one of the 12 services we keep cookie details for, such as Google Analytics or the Meta Pixel. Cookiemark adds the cookies that service sets, with a description written for visitors.

By hand

Press Add cookie and fill in five fields: the name, the category, the provider, the purpose and how long it is kept. Write the purpose for a visitor, not for a developer. "Counts how many people visit each page" tells them more than "GA4 client identifier".

Changes to the list go live when you publish, like every other change.

The cookie Cookiemark sets

Cookiemark sets one cookie, cookiemark_consent. It holds the visitor's choice, a random consent ID and the time of the choice. It is necessary, because the site cannot remember a refusal without it, and it is always at the top of your list.

The cookie lasts as long as you set under Regions, Ask again after: 6, 12 or 13 months. Six months is the default. When it runs out, the banner asks again.

The cookie lives on your own domain. Cookiemark sets no cookies on its own domain and none for tracking. Some visitors are outside the countries where you show the banner. For them, the script remembers that answer in the session storage of the browser tab, not in a cookie.

Your cookie policy

Cookiemark does not write a cookie policy page for you yet. Write it on your own site, and use the cookie list in the dashboard as its source. Then enter its address under Settings, Links and behaviour. The banner and the preferences window then link to it. Enter the address of your privacy policy in the field next to it, and they link to that page too.

Give visitors a way back to their choice from that page, or from your footer. A link to #cookiemark-preferences opens the preferences window.

<a href="#cookiemark-preferences">Cookie settings</a>

The small button in the corner of the page does the same. You switch it on or off under Design, Button to reopen.

Safari and the seven-day limit

Safari keeps a cookie that a script writes for seven days at most. After that, Safari visitors see the banner again, however long you set the cookie to last. A cookie that your own server sets is not limited this way.

To keep the choice for the full period, give Cookiemark a path on your own site that sets the cookie. Enter it under Settings, Set the cookie from your own server, for example /cookie.php. After every choice, the script sends a POST request to that path with the choice as JSON. Your server answers by setting cookiemark_consent with the same content.

<?php
// cookie.php on your own site: stores the Cookiemark choice as a first-party cookie.
$data = json_decode(file_get_contents('php://input'), true);
if (!is_array($data) || !isset($data['v'], $data['id'], $data['ts'])) {
    http_response_code(400);
    exit;
}
$choice = [
    'necessary'   => true,
    'preferences' => ($data['preferences'] ?? false) === true,
    'statistics'  => ($data['statistics'] ?? false) === true,
    'marketing'   => ($data['marketing'] ?? false) === true,
    'v'           => (int) $data['v'],
    'id'          => preg_replace('/[^0-9a-f-]/i', '', (string) $data['id']),
    'ts'          => (int) $data['ts'],
];
setcookie('cookiemark_consent', json_encode($choice), [
    'expires'  => time() + 182 * 86400, // the same period as "Ask again after"
    'path'     => '/',
    'secure'   => true,
    'httponly' => false, // the Cookiemark script has to read it
    'samesite' => 'Lax',
]);
http_response_code(204);

Three details matter. The cookie must not be HttpOnly, because the script reads it. Its value must be the JSON of the choice, URL-encoded, which PHP does for you. And the expiry should match Ask again after. Test it in Safari after you publish, and treat the example above as a starting point, not finished code.

The list on your cookie policy page

Your cookie policy has to tell visitors which cookies your site uses. Put this line on that page, where the list should go:

<div data-cookiemark-declaration></div>

The script fills it with a short explanation, the visitor's current choice with their consent ID and the date, buttons to change or withdraw that choice, and a table per category with each cookie's name, provider, purpose and expiry. It uses the visitor's language and your own texts for the categories, and it notes when the list was last published.

Because the list comes from what you publish, it never falls behind your banner. Two attributes change what it shows:

On a page that adds the element after it loads, call Cookiemark.renderDeclaration() once it is there.