> For the complete documentation index, see [llms.txt](https://manual.bubble.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manual.bubble.io/help-guides/data/user-accounts/cookies-set-by-bubble.md).

# Cookies set by Bubble

{% hint style="info" %}
This article covers the cookies used by apps built on Bubble, not the cookies used by the Bubble editor.
{% endhint %}

### What are cookies?

Cookies are small pieces of data that apps and websites store in a user's browser. They let an app save information on the user's device and read it again later, for example when the user comes back the next day. That makes a range of useful features possible:

<table><thead><tr><th width="153.98828125">Purpose</th><th>What cookies do</th></tr></thead><tbody><tr><td>Remembering information</td><td>Store details like a remembered email address or preferences such as language and currency, without the user needing to create an account or log in.</td></tr><tr><td>Session management</td><td>Keep track of a user's activity while they use the app, so they can stay logged in as they move between pages or keep items in a shopping cart.</td></tr><tr><td>Tracking and analytics</td><td>Collect data on how people use a site, so its owners can analyze behavior, improve the user experience, and show more relevant content.</td></tr><tr><td>Security</td><td>Help authenticate users and protect against unauthorized access or fraudulent use of login credentials.</td></tr></tbody></table>

#### Cookies across browsers and devices

Cookies are stored by the browser, so they don't follow a user from one browser or device to another. For example, if a visitor who isn't logged in picks a language in your app on their laptop, that choice is only saved in that browser. If they open your app on their phone, or in a different browser on the same laptop, they'll need to pick it again.

Cookies can also be deleted, either by the user or automatically by the browser as part of its storage or privacy settings.

### Types of cookies in a Bubble app

The cookies in a Bubble app fall into two categories:

| Type                  | Who sets them                                                  | How you control them                                                        |
| --------------------- | -------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Cookies set by Bubble | Bubble, to handle users and logins                             | With an app setting and two workflow actions. See Bubble's default cookies. |
| Third-party cookies   | Plugins, analytics services, custom code, and embedded content | Depends on the service. Bubble can't control them.                          |

#### Third-party cookies

Other services can add cookies to a user's device too. If you add an analytics service like Google Analytics, for example, whether through a plugin or a code snippet, that service may set cookies of its own. The same goes for things like embedded videos, chat widgets, and payment forms.

Bubble can't give you control over cookies that a plugin or another service sets. If that matters for your app, install the plugin and test it in run mode to see which cookies it adds. That can help you decide whether it fits your privacy and data management requirements.

<details>

<summary>How to see which cookies your app sets</summary>

You can check the cookies on any page with your browser's developer tools:

1. Open your app in run mode.
2. Open the developer tools. In most browsers, you can right-click the page and select **Inspect**.
3. Find the cookie list. In Chrome and Edge, it's under the **Application** tab, in **Storage – Cookies**. In Firefox and Safari, it's under the **Storage** tab.
4. Select your app's domain to see every cookie set on it, including cookies from plugins and other services.

</details>

### Bubble's default cookies

By default, Bubble sets a few essential cookies for every visitor to your app. They're used for authentication and key platform features, such as keeping a user logged in and linking a visitor's data to their account when they sign up.

<table><thead><tr><th width="188.76953125">Cookie</th><th>Purpose</th></tr></thead><tbody><tr><td>Session ID</td><td>Identifies the user's session.</td></tr><tr><td>Session signature</td><td>Protects the session from being tampered with.</td></tr><tr><td>User identifier</td><td>Identifies the logged-in user for authentication.</td></tr></tbody></table>

These cookies are also what lets Bubble create a temporary user for visitors who haven't signed up yet, so you can store things like a shopping cart before they create an account.

Article section: Temporary users

#### Disabling Bubble's default cookies

You can stop Bubble from setting cookies on new visitors with the [*Do not set cookies on new visitors by default*](#user-content-fn-1)[^1] setting. It's off by default, and you need to turn it on for each app separately.

{% stepper %}
{% step %}

#### Open the general settings

Go to the **Settings** tab and open the **General** section.
{% endstep %}

{% step %}

#### Turn on the setting

Check *Do not set cookies on new visitors by default*.

<figure><img src="https://34394582-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M5sbzwG7CljeZdkntrL%2Fuploads%2FfXAzzX4S4KKPP1LJpdxG%2Fdo-not-set-cookies.png?alt=media&amp;token=a3a14b12-8fa1-4a7d-a162-a913389d0119" alt="The Do not set cookies on new visitors by default setting."><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

Keep in mind that turning off the default cookies can limit how your app works for visitors who haven't logged in:

<table><thead><tr><th width="308.9375">What changes</th><th>What it means</th></tr></thead><tbody><tr><td>No temporary users for new visitors</td><td>Data you save on the current user before they log in only lasts until they close the browser tab.</td></tr><tr><td>No transfer of data on signup</td><td>You can't carry data, such as the items in a shopping cart, over to the user's new account when they sign up.</td></tr></tbody></table>

Bubble still sets its cookies in these situations:

| Situation                                                       | What happens                                                                                                                                  |
| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| The [**Opt-in to cookies**](#user-content-fn-2)[^2] action runs | Bubble sets its cookies and creates a temporary user, just as it would have automatically, but only for the visitor who triggered the action. |
| The user signs up or logs in                                    | Bubble can't keep a user logged in without cookies, so it sets them regardless of the setting.                                                |

To remove Bubble's cookies again, use the **Opt-out from cookies** action. It deletes the cookies Bubble has set and logs the user out if they're logged in.

Together, the setting and the two actions let you build your own cookie consent flow. For example, you can show a consent banner to new visitors and run **Opt-in to cookies** or **Opt-out from cookies** depending on what they choose. Keep in mind that these actions only cover Bubble's own cookies, not cookies set by plugins or other services.

**Reference**: [Account actions](/core-resources/bubble-workflows/bubble-actions/account-actions.md)

#### Default cookies and app performance

Setting cookies on a new visitor takes a small amount of [server-side and client-side](#user-content-fn-3)[^3] work, which slows the page load down slightly. The difference is small, but turning the default cookies off may still be worth considering if your app:

* Doesn't need cookies for visitors who aren't logged in (see what changes above)
* Depends on the fastest possible page load, for example for SEO[^4]
* Gets a lot of traffic, and you want to keep workload[^5] as low as possible

Keep your users in mind: turning off the default cookies can make your app slightly faster, but it may come at the cost of the user experience.

#### Default cookies and regulations

Laws in many regions regulate how websites and apps use cookies. In the EU, for example, the ePrivacy Directive and GDPR set rules for when you need a user's consent. Many of these rules treat cookies that are strictly necessary for an app to work differently from cookies used for things like analytics or marketing.

We recommend reading up on the rules that apply to your app, your industry, and your users' regions, and remembering that cookies set by plugins and other services count too.

{% hint style="warning" %}
This article isn't legal advice. If you're unsure which rules apply to your app, talk to a legal professional.
{% endhint %}

Article series: Compliance

### Cookies and subdomains

If you move your app to a subdomain, your users may run into login problems, such as errors saying "incorrect credentials" or "session expired."

This usually happens because the existing cookies for the old domain conflict with the new subdomain. To fix it, your users need to clear your app's cookies in their browser.

#### Clearing your app's cookies

To clear the cookies for your app, a user can follow the steps below. The exact steps vary slightly from browser to browser.

{% stepper %}
{% step %}

#### Open the browser settings

Open the browser's settings menu. Cookie settings are usually found in the privacy or security section.
{% endstep %}

{% step %}

#### Find cookie management

Look for the settings for cookies and site data.
{% endstep %}

{% step %}

#### Find the app's domain

Search the list for your app's domain name.
{% endstep %}

{% step %}

#### Delete the cookies

Select the cookies for the domain and delete them. This removes any stored login information and session data for your app.
{% endstep %}

{% step %}

#### Log in again

Go back to the app and log in. The previous errors should be gone.
{% endstep %}
{% endstepper %}

Clearing cookies is usually only needed after you've changed your app's domain. Letting your users know about the change ahead of time can help avoid confusion.

### FAQ: Cookies set by Bubble

<details>

<summary>Does Bubble set cookies on every visitor to my app?</summary>

By default, yes. Bubble sets a few essential cookies on every visitor, including those who haven't signed up or logged in. You can turn this off with the *Do not set cookies on new visitors by default* setting in the **Settings** tab.

</details>

<details>

<summary>Will users still be able to log in if I turn off the default cookies?</summary>

Yes. Bubble needs cookies to keep users logged in, so it sets them when a user signs up or logs in, even with the setting turned on.

</details>

<details>

<summary>Does turning off the default cookies also stop cookies from plugins?</summary>

No. The setting and the **Opt-in to cookies** and **Opt-out from cookies** actions only cover the cookies Bubble sets. Plugins, analytics services, and other third-party code can still set their own cookies.

</details>

<details>

<summary>How do I let users choose whether to accept cookies?</summary>

Turn on *Do not set cookies on new visitors by default*, then show your own consent banner or popup. Run the **Opt-in to cookies** action when a user accepts, and **Opt-out from cookies** if they decline or change their mind. If your app uses plugins that set cookies, you'll need to handle those separately.

</details>

<details>

<summary>Do I need a cookie banner?</summary>

It depends on where your users are and what cookies your app uses. Many regulations, such as the EU's ePrivacy Directive and GDPR, require consent for cookies that aren't strictly necessary. This isn't legal advice, so check the rules that apply to your app, and talk to a legal professional if you're unsure.

</details>

<details>

<summary>Why are users getting "session expired" errors after I changed my domain?</summary>

If you moved your app to a subdomain, the cookies for the old domain can conflict with the new one. Ask your users to clear your app's cookies in their browser, then log in again. See Clearing your app's cookies above.

</details>

[^1]: When you turn on *Do not set cookies on new visitors by default*, Bubble doesn't set cookies or create temporary users for visitors who haven't logged in.\
    \
    Reference: Do not set cookies on new visitors by default

[^2]: The *Opt-in to cookies* action tells Bubble to set its default cookies for the user who triggers the action.

[^3]: *Server-side* refers to work happening on Bubble's server, and *client-side* refers to work happening on the user's device.\
    \
    Article: Client-side and server-side

[^4]: *SEO* (search engine optimization) is the practice of improving a page so it ranks higher in search engines. How fast a page loads is one of many factors search engines consider.

[^5]: *Workload* is the metric Bubble uses to measure how much server work it takes to power your app. This can affect your hosting costs.

    Article series: Pricing and workload\
    Article series: Optimizing for workload