---
title: "Cookies, storage and consent categories for your site"
description: "List the cookies and browser storage the Noxtica SDK writes, map each to a consent category, disclose them in your cookie policy and set DNT and GPC behaviour."
canonical_url: "https://noxtica.com/docs/compliance/cookies-and-storage/"
markdown_url: "https://noxtica.com/docs/compliance/cookies-and-storage/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "compliance"
section_title: "Compliance & Legal"
site: "Noxtica"
language: "en"
source: markdown
---

# Cookies, storage and consent categories for your site

A privacy or web owner uses this page to disclose what the Noxtica browser SDK writes on a visitor's device. It lists each cookie and storage entry with its store, lifetime, writer and consent category. It also explains how Do Not Track (DNT) and Global Privacy Control (GPC) signals change what the collector accepts.

The tables are an engineering inventory, not legal advice. Your counsel decides how to classify each entry under the rules that apply to you. The cookie notice for Noxtica's own websites is at [Cookies](https://noxtica.com/cookies/).

## What it is

Availability: depends on your plan, role and the modules enabled for your organisation.

`<sk>` below is the Site Key of your domain. The SDK has two scripts. The **core** script runs on every page. The **extensions** script runs after your page allows it. The core writes no cookie, no localStorage and no IndexedDB. It writes per-tab sessionStorage entries and nothing else. Everything persistent comes from the extensions.

### Cookie and storage inventory

| Name | Store | Lifetime | Written by | Consent category |
| --- | --- | --- | --- | --- |
| `nox_fp_<sk>` | Cookie, localStorage, IndexedDB | 400 days | Extensions | `deviceId` |
| `nox_itp_canary_<sk>` | Cookie, localStorage, IndexedDB | 400 days | Extensions | `deviceId` |
| `nox_tri_<sk>` | Cookie, localStorage, IndexedDB | 400 days | Extensions | `deviceId` |
| `nox_kv_<sk>` | IndexedDB database that holds the three keys above | Same as the keys | Extensions | `deviceId` |
| `nox_lock_<sk>` | localStorage | At most 30 seconds | Extensions | `deviceId` |
| `nox_buf_<sk>` | IndexedDB | Undelivered events dropped after 72 hours | Extensions | `analytics` |
| `noxtica.session.<sk>.token` | sessionStorage | Until the tab closes | Core | None, security session state |
| `noxtica.session.<sk>.protect.<action>` | sessionStorage | Until the tab closes, read once and removed | Core | None, security session state |
| `noxtica.session.khanvm`, `noxtica.session.gpuvm` | sessionStorage | Until the tab closes | Extensions | None |
| `__noxtica_khan_accel_v1` | sessionStorage | Until the tab closes | Extensions | None |
| `nx_replay_tab_id`, `nx_replay_session_v1` | sessionStorage | Until the tab closes, or 30 minutes idle by default | Extensions | `replay` |
| `cookietest`, `_nox_test` | Cookie, localStorage, sessionStorage | Removed in the same call | Extensions | None |

What each entry holds:

- `nox_fp_<sk>` is the device record: the device identifier, the last-submit time and the state schema version. The localStorage and IndexedDB copies also keep the last check result (score, risk level, confidence, flags). From SDK 3.8.1 the cookie copy holds only the schema version, the device identifier and the last-submit time, as URI-encoded JSON.
- `nox_itp_canary_<sk>` is a purge canary, a timestamp that tells the SDK a browser purged its storage.
- `nox_tri_<sk>` is a token refresh interval hint.
- `nox_lock_<sk>` is a cross-tab lock. It is used when the browser has no Web Locks API, and it is not written while persistent storage is closed.
- `nox_buf_<sk>` buffers real-user-monitoring and console-log events until they are delivered.
- `noxtica.session.<sk>.token` caches the session token so later pages in the same tab skip a round trip.

### Cookie attributes

The three device cookies `nox_fp_<sk>`, `nox_itp_canary_<sk>` and `nox_tri_<sk>` are written by script with these attributes.

| Attribute | Value |
| --- | --- |
| Lifetime | 400 days |
| Path | `/` |
| Domain | Not set, so the cookie is host-only |
| SameSite | `Lax` |
| Secure | Added on https pages |
| HttpOnly | Not set. A script writes the cookie and the SDK reads it back to restore storage that a browser purged. |

### Consent categories

| Category | What a grant enables | Storage it governs |
| --- | --- | --- |
| `deviceId` | Persistent device storage and the persistent device-recognition token. | The three device keys, `nox_kv_<sk>` and `nox_lock_<sk>`. |
| `analytics` | Real-user monitoring, error detail, console-log capture, the interaction tracker and the durable event buffer. | `nox_buf_<sk>`. |
| `replay` | Session replay recording and upload. | `nx_replay_tab_id`, `nx_replay_session_v1`. |
| `behavioral` | Behavioral signals, pointer and touch tracks, geolocation, cookie contents, the extension probe, favicon detection and the WebRTC probe. | No storage entry. |

In a gated consent mode (`api` or a cookie mode), nothing persistent is written until `deviceId` is granted and the domain's persistent device recognition setting is on. Before that, the three device keys are held in memory and sessionStorage under the same names. When `deviceId` is withdrawn, the SDK deletes the three keys from localStorage and cookies and deletes the IndexedDB database `nox_kv_<sk>`. In the `not_required` mode the extensions write the device record as soon as they load, unless your page denies `deviceId`. See [Consent modes](https://noxtica.com/docs/sdk/consent/).

### Third-party network contacts

| Contact | When it happens |
| --- | --- |
| `challenges.cloudflare.com` | The SDK loads Cloudflare Turnstile when the server requests a challenge. |
| `stun.l.google.com` on port 19302 | The WebRTC probe uses this public STUN server. It runs when the `behavioral` category is allowed and the probe is enabled for your domain. |

### DNT and GPC

The SDK reports a visitor's browser signal in `getConsent().privacySignal`: `gpc` when `navigator.globalPrivacyControl` is true, `dnt` when `doNotTrack` is `1` or `yes`, otherwise `null`. Browsers send `Sec-GPC: 1` or `DNT: 1` on requests.

The collector acts on the signal according to the domain's DNT/GPC policy. Real-user monitoring, error detail, console logs and the interaction tracker follow the policy you set in Web Analytics & Privacy → Consent & Privacy. Session replay has its own DNT/GPC policy per domain in Web Analytics & Privacy → Capture Policies. New domains start on **Honor** in the Consent & Privacy decision, and the Capture Policies form starts on **Honor** too. With **Honor** and a signal present:

| Lane | What the collector does |
| --- | --- |
| Real-user monitoring | Refuses with HTTP 403 and "RUM not enabled for this domain". |
| Error detail | Refuses with HTTP 403 and `rum_error_detail_dnt_gpc_honored`. |
| Console logs | Refuses with HTTP 403 and `console_logs_dnt_gpc_honored`. |
| Session replay | Refuses with HTTP 403 and `replay_dnt_gpc_honored`. |
| Interaction tracker | Answers HTTP 200 with `{"ok":true,"eventsProcessed":0,"reason":"dnt_gpc_honored"}` and processes nothing. |

With **Documented override** the lane is not refused for the signal. For real-user monitoring, an override needs the approved legal basis `rum_observability` and your acknowledgement. This page does not state that a signal stops the core security check.

## Prerequisites

- A domain with the SDK installed. See [Install and browser runtime](https://noxtica.com/docs/browser-runtime/).
- Your consent mode chosen for the domain. See [Consent modes](https://noxtica.com/docs/sdk/consent/).
- The administrator role to read the CSP & storage tab and to save a consent decision.
- Your counsel's classification of each entry for your jurisdiction.

## Steps

### 1. Open the generated storage table

1. Open Backoffice → Integrations & API → Script & Consent.
2. Select your domain if the page asks for one, then the **CSP & storage** tab.
3. Read the table "Cookies and browser storage written by the collector". Backoffice generates it from the SDK source.

### 2. Choose the rows for your setup

1. If you run the core script alone, disclose the sessionStorage rows marked Core.
2. If you load the extensions, add the rows that match the categories you grant.
3. Add `nox_buf_<sk>` when you grant `analytics`, and the replay rows when you grant `replay`.

### 3. Map categories to your consent tool

Connect your consent tool to the four categories with `client.setConsent`. The mapping is your decision. Example:

```javascript
const client = window.noxticaClient;
const state = (allowed) => (allowed ? 'granted' : 'denied');

cmp.onConsentChanged((choices) => {
	client.setConsent({
		deviceId: state(choices.preferences),
		analytics: state(choices.statistics),
		replay: state(choices.statistics),
		behavioral: state(choices.marketing),
	});
});
```

### 4. Publish the disclosure

Copy the inventory into your cookie policy. State for each row the name, store, lifetime and purpose. Name the third-party contacts that apply to your setup.

### 5. Set the DNT and GPC policy

1. Open Web Analytics & Privacy → Consent & Privacy. Domains that still need a decision are listed. A domain whose decision is already recorded does not appear.
2. In the row of a listed domain, choose the **DNT/GPC policy**. Keep **Honor** unless your counsel advises otherwise. Session replay has a separate **DNT/GPC policy** in Web Analytics & Privacy → Capture Policies.
3. Save and complete the step-up check. A documented override also needs the legal basis and the acknowledgement.

### 6. Set your own console preference

Open Backoffice → Settings. In **Privacy & cookies**, switch **Analytics, session replay and device recognition** on or off for your own account. Turning it off stops collection and deletes what was stored on that device.

## Verify it works

With the consent mode `api` and nothing granted, check the page in your browser developer tools.

- Application → Cookies shows no `nox_` cookie.
- `Object.keys(localStorage).filter((k) => k.startsWith('nox_'))` returns an empty array.
- sessionStorage shows `noxtica.session.<sk>.token`.
- After you grant `deviceId` and load the extensions, the three device cookies appear with `Path=/`, `SameSite=Lax` and a 400-day lifetime, and no `Domain` attribute.
- After you withdraw `deviceId`, the three keys and the `nox_kv_<sk>` database disappear.
- With a browser GPC signal on and the policy on Honor, a real-user-monitoring request returns HTTP 403, and a replay upload is refused.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| A `nox_fp_<sk>` entry exists before consent. | The domain mode is `not_required`, or the entry is the sessionStorage copy held before `deviceId` is granted. | Check the mode with `getConsent().mode`. Choose a gated mode if visitors must decide first. |
| No device cookie appears after consent. | The extensions did not load, or persistent device recognition is off for the domain. | Check `noxtica:extensions-loaded` and the domain setting. |
| `nox_buf_<sk>` is missing. | `analytics` is not granted, or no monitoring event was buffered. | Grant `analytics`. |
| Monitoring requests return HTTP 403 for some visitors. | The policy is Honor and the visitor's browser sends a GPC or DNT signal. | This is intended. Choose a documented override when your counsel approves it. |
| A proxy breaks consent enforcement. | The loader adds an `nxc` query parameter to collector requests. A proxy that removes it makes the collector count nothing as granted. | Keep `nxc` in proxies and rewrite rules. |
| The cookie is larger than expected on an older loader. | Before SDK 3.8.1 the cookie also held the last check result. | Update the loader. |

## Related

- [Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/): how consent modes and categories work in the SDK.
- [Install and browser runtime](https://noxtica.com/docs/browser-runtime/): install tags, the Content Security Policy and the consent matrix.
- [Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/): the per-domain consent decision.
- [Privacy and compliance controls in Backoffice](https://noxtica.com/docs/compliance/overview/): map of every privacy page.
- [Cookies](https://noxtica.com/cookies/) and [Privacy Policy](https://noxtica.com/privacy/): the public legal documents for Noxtica's own sites.