Understanding Cookies

What Are Cookies?

Zeotap CDP relies on browser cookies to recognise a visitor across page views, associate that visitor with the user identifiers you send from your site, and — where consented — coordinate identity with advertising partners through cookie syncing. This page explains the two categories of cookie Zeotap CDP writes or reads (first-party and third-party), lists every cookie by name and lifecycle, describes how to verify your setup in the browser, and covers what changes for third-party cookies under Google Chrome’s Privacy Sandbox rollout.

Prerequisites

Before inspecting cookie behaviour on your site, confirm that the Zeotap JavaScript SDK is embedded on the page you want to inspect and that a consent choice has been recorded through your CMP. Partner cookie syncing requires prior activation — contact your Zeotap Customer Success Manager to enable a partner or change the priority order.

Cookies split into two categories based on which domain sets them:

First-party cookie — set by the domain the visitor is currently on. First-party cookies remember login state, session data, and preferences for that site. Example: an online shopping site writes a first-party cookie so items stay in the cart between page loads.
Third-party cookie — set by a domain other than the one the visitor is on. Third-party cookies support cross-site tracking and advertising. Example: an ad network embedded on a news site writes a third-party cookie to recognise the same visitor on a different publisher’s site.

Common use cases

Zeotap CDP and its customers use cookies for:

Session management — keeping a visitor logged in, retaining cart contents, holding server-side session data.
Personalisation — storing preferences, themes, and settings so the site can tailor the experience per visitor.
Tracking — recording interactions to understand behaviour, preferences, and trends for measurement and marketing.

Sync cookies with partners

You can select partners from the list of integrated partners below to cookie sync across your sources. Cookie sync is pre-configured against the write key of every source under your organisation. These channel cookies are mapped to the Zeotap cookie and any user identifiers sent by you. The cookie syncs are fired as image pixels or iframe tags. However, in the case of web image pixels, our pixel can sync with only one partner per call. Therefore, we choose the first priority among the list shared. Cookie syncing relies on third-party cookies, so it operates only in browsers and sessions where third-party cookies are available. For details, see Third-Party Cookies in Modern Browsers. For developer-level details of how the Web JS SDK performs cookie syncing, see the cookie syncing FAQ.

Partner Name
Google Marketing Platform (DDP)
Appnexus
ADFORM
TAPAD
The Trade Desk
Teads
Adobe
Videology
Widespace
WEBORAMA - IT
KETCHUP
ACTIVE AGENT
YAHOO
SMART DATA MARKETPLACE
SUNMEDIA
SFR
LOTAME
THE ADEX
NEUSTAR
RICHAUDIENCE
SALESFORCE
TUBEMOGUL
Newco
M-PLATFORM
Oracle
AMAZON
WINDTREITALY
TABOOLA
FREEWHEEL
PUBMATIC
ZEE5
TELEFMX
NEODATA
MAGNITE
IPONWEB
QUANTCAST

Zeotap CDP fires the sync as an image pixel or an iframe tag. A web image pixel can sync with one partner per call, so Zeotap picks the highest-priority partner from your configured list. Cookie syncing is pre-configured against the write key of every source in your organisation. The partners you can sync with are listed below. To control cookie sync consent per individual partner, configure partnerConsentKeyMap during SDK initialisation. A minimal configuration looks like:

zeotap.init('YOUR_WRITE_KEY', {
  useConsent: true,
  checkForCMP: false,
  partnerConsentKeyMap: {
    "22": "google_cookie_sync_consent",
    "35": "meta_cookie_sync_consent"
  }
});

To activate cookie syncing, add a new partner, or change the priority order, contact your Zeotap Customer Success Manager.

How Does Zeotap CDP Use Cookies?

Cookies are one of the preferred methods for maintaining a user identifier in the browser, both known and anonymous. This identifier is associated with all inbound events captured by the Zeotap JavaScript tag as users interact with your websites. The following table summarises the cookies that Zeotap CDP sets or reads:

Cookie	Cookie Type	Name as per Cookie Storage	Purpose	Default Expiry
ZI	First-party	`zpstorage_{{Base64.encode(API_KEY)}}zi`	Client ID used to recognise a user by device, browser, or domain-generated options	365 days 7 days (Safari)
Identity	First-party	`zpstorage_{{Base64.encode(API_KEY)}}identity`	Stores user identities such as hashed email, cell number, login ID, and unhashed `fpuid`	365 days 7 days (Safari)
ZS	First-party	`zpstorage_{{Base64.encode(API_KEY)}}zs`	Session ID unique per device, browser, domain, or session	60 minutes 7 days (Safari)
GDPR Consent	First-party	`euconsent-v2`	Stores GDPR consent string set by TCF-compliant CMP	7 days (Safari)
GA Client ID	First-party	`{{cookie prefix as per SDK Configurations}}_ga`	Reads Google Analytics Client ID	7 days (Safari)
GA User ID	First-party	`{{cookie name as per SDK Configurations}}`	Reads GA User ID for POST calls (all or post-login only)	7 days (Safari)
IDP	First-party	`IDP`	Login-based currency cookie	365 days 7 days (Safari)
Zcookieid	Third-party	`zc`	Zeotap user identifier set via smart pixel endpoint	730 days
Capping Cookie	Third-party	`zsc`	Limits frequency of cookie syncs with channel partners (e.g. DoubleClick)	1 day
User Consent	Third-party	`zuc`	Stores non-TCF consent at account level	365 days

zc, zsc and zuc are third-party cookies set against the Zeotap domain. They are unavailable in browsers or sessions where third-party cookies are blocked. See Third-Party Cookies in Modern Browsers.

For the full cookie lifecycle — including exactly when each cookie is set and cleared — see the canonical cookie reference in the Web JS SDK FAQ.

The Web JS SDK consent object supports exactly two behaviour flags: track, which controls event tracking and governs the first-party ZI, Identity and ZS cookies, and cookieSync, which controls cookie syncing. Any additional keys you pass are treated as brand consent keys and do not affect SDK cookie behaviour.

An identify consent flag exists only in the native Android, iOS and React Native SDKs. It is not part of the Web JS SDK consent object.

Identities persisted in browser storage can be removed with unsetUserIdentities(), for example when a user logs out.

Third-Party Cookies in Modern Browsers

Support for third-party cookies varies by browser:

Safari blocks third-party cookies by default through Intelligent Tracking Prevention (ITP).
Firefox blocks known cross-site tracking cookies and isolates all other third-party cookies to the site that created them (Total Cookie Protection), enabled by default through Enhanced Tracking Protection (ETP). In practice, third-party cookies cannot be used across sites.
Chrome continues to support third-party cookies. In July 2024, Google announced that it would not deprecate third-party cookies in Chrome. In April 2025, Google confirmed that it is maintaining its current approach and will not roll out a standalone consent prompt; users manage third-party cookies through Chrome’s Privacy and Security settings. There is no fixed date for the removal of third-party cookies from Chrome.

In October 2025, Google also retired most Privacy Sandbox APIs, including Topics, Protected Audience and the Attribution Reporting API. Individual users can block third-party cookies in any browser, either through browser settings or by using private or Incognito browsing modes.

Zeotap Third-Party Cookies in These Environments

Zeotap sets three third-party cookies against the Zeotap domain (see the table above):

ZC (zc) — user identification and the ID extension feature.
ZSC (zsc) — caps the number of cookie sync calls per session.
ZUC (zuc) — account-level consent storage for non-TCF setups.

In browsers or contexts where third-party cookies are blocked, these cookies cannot be set or read.

What Happens Where Third-Party Cookies Are Unavailable

In browsers and contexts where third-party cookies are blocked or restricted — Safari, Firefox (where they are isolated to the site that created them), private or Incognito sessions, or any browser where the user has disabled them — the following applies:

Cookie syncing does not operate. Cookie sync depends on the third-party zc cookie set against the Zeotap domain, so sync pixels cannot set or read it in these environments.
First-party identification continues to work. The first-party ZI, Identity and ZS cookies are set on your own domain and are unaffected.
Existing identifiers persist until expiry. Identifiers already stored remain usable until their Time-to-Live (TTL) elapses.

Cookie syncing FAQ — the canonical cookie reference, including the full set/cleared lifecycle of each cookie.
setConsent API reference — the Web JS SDK consent object and its track and cookieSync flags.
Consent Configuration Options — how consent behaviour is configured at SDK initialisation.
unsetUserIdentities API reference — removing persisted identities from browser storage.
Persistence in Cookie Storage — where the SDK persists identity data.
Zeotap’s perspective on the cookieless future — further reading on first-party data strategy.

​What Are Cookies?

​Prerequisites

​Cookie types

​Common use cases

​Sync cookies with partners

​How Does Zeotap CDP Use Cookies?

​Cookie Lifecycle and Consent

​Third-Party Cookies in Modern Browsers

​Zeotap Third-Party Cookies in These Environments

​What Happens Where Third-Party Cookies Are Unavailable

​Related Resources

What Are Cookies?

Prerequisites

Cookie types

Common use cases

Sync cookies with partners

How Does Zeotap CDP Use Cookies?

Cookie Lifecycle and Consent

Third-Party Cookies in Modern Browsers

Zeotap Third-Party Cookies in These Environments

What Happens Where Third-Party Cookies Are Unavailable

Related Resources