Claude.ai and Anthropic's websites set three groups of cookies: necessary cookies for sign-in, security and your settings, analytics cookies from Segment, Google and LinkedIn, and marketing cookies from Google, Meta, Reddit, TikTok and X. On 16 October 2026, Anthropic's own cookie list had 42 entries: 24 necessary, 6 analytics and 12 marketing. Only the necessary group is set without your opt-in. Claude Code, the terminal tool, sets no cookies of its own.
It signs you in through the browser once, then keeps its own credential on your machine. That split also answers the searches for "free Claude premium cookies": a shared login cookie is someone else's account, and Anthropic's terms forbid sharing one.
Where Claude Code meets your browser
Claude Code is Anthropic's agentic coding tool. It runs in your terminal, inside VS Code and JetBrains IDEs, and through a web interface at claude.ai/code. It can read your codebase, edit files, execute commands, handle git workflows and submit pull requests, all through natural language.
When you use Claude Code through the web interface, or sign in from the CLI, your browser interacts with claude.ai. That interaction sets cookies. Some are strictly necessary for authentication and security. Others measure usage or support Anthropic's marketing.
For developers using Claude Code, these cookies matter for two reasons. First, if you build websites that embed Anthropic's services or link to Claude, you need to know which cookies belong to Anthropic's domains and which belong to yours. Second, if your organisation uses Claude Code on a team or enterprise plan, your IT and security teams need to know what is stored in the browser and what is stored by the CLI.
Every cookie Anthropic lists for claude.ai
Anthropic publishes its cookie list in its Privacy Center article on the cookies Anthropic uses. The cookies fall into three categories: necessary, analytics and marketing. The tables below follow the list as it read on 16 October 2026. The page shows no fixed revision date, so check it before you rely on a single duration.
Necessary cookies
These cookies keep Claude Code and claude.ai working. They handle authentication, remember your preferences and protect against security threats. Anthropic classes them as necessary, so they cannot be refused.
| Cookie | Purpose | Set by | Lifespan |
|---|---|---|---|
sessionKey | Authentication: keeps you logged in | First-party (.claude.ai, .anthropic.com) | 1 month |
sessionKeyV2 | Authentication | First-party (.claude.ai, .anthropic.com) | 1 hour |
activitySessionId | Authentication: tracks the active session | First-party (claude.ai) | 12 hours |
CH-prefers-color-scheme | Stores your dark or light mode preference | First-party (claude.ai) | 1 year |
lastActiveOrg | Remembers your last active organisation | First-party (claude.ai) | 1 year |
console-sidebar-expanded | Sidebar preference | First-party (.claude.ai, .anthropic.com) | 1 year |
user-sidebar-visible-on-load | Sidebar preference | First-party (.claude.ai) | 1 year |
__ssid | Security identifier | First-party (.claude.ai) | 13 months |
anthropic-device-id | Device identification for security | First-party (claude.ai) | 10 months |
anthropic-consent-preferences | Stores your cookie consent choices | First-party (.claude.ai) | 1 year |
__stripe_mid | Stripe fraud prevention | Stripe (third-party) | 1 year |
__cf_bm | Cloudflare bot management | Cloudflare (third-party) | 30 minutes |
cf_clearance | Cloudflare challenge clearance | Cloudflare (third-party) | 1 year |
| Google security cookies | Functionality and security | Google (third-party, .google.com) | Various |
intercom-device-id-* | Support chat device identification | Intercom (third-party) | 9 months |
intercom-id-* | Support chat preferences | Intercom (third-party) | 1 week |
intercom-session-* | Support chat session | Intercom (third-party) | 1 week |
__Secure-ROLLOUT_TOKEN | Embedded video functionality | YouTube (third-party) | 6 months |
__Secure-YEC | Embedded video security | YouTube (third-party) | 13 months |
__Secure-YENID | Embedded video security | YouTube (third-party) | 13 months |
__Secure-YNID | Embedded video preferences | YouTube (third-party) | 6 months |
VISITOR_INFO1_LIVE | Security and advertising, listed as necessary | YouTube (third-party) | 6 months |
VISITOR_PRIVACY_METADATA | Embedded video functionality | YouTube (third-party) | 6 months |
YSC | Embedded video security | YouTube (third-party) | Session |
Anthropic lists the seven YouTube cookies on the anthropic.com and claude.com domains, where videos are embedded, rather than on claude.ai. The sessionKey cookie is the one that keeps you signed in to claude.ai in the browser. It is not what Claude Code uses once it is installed: the CLI keeps a separate credential, covered in the next section.
Analytics cookies
Anthropic uses analytics cookies to measure how people interact with claude.ai and Claude Code's web interface. These are not strictly necessary and can be refused through Anthropic's cookie preferences panel.
| Cookie | Purpose | Set by | Lifespan |
|---|---|---|---|
ajs_anonymous_id | Anonymous visitor identification for analytics | First-party (claude.ai) | 1 year |
ajs_user_id | Identified user tracking for analytics | First-party (claude.ai) | 1 year |
li_giant | LinkedIn conversion tracking | LinkedIn (third-party) | 7 days |
oribi_cookie_test | LinkedIn conversion analytics test | LinkedIn (third-party) | Session |
oribili_user_guid | LinkedIn analytics user identifier | LinkedIn (third-party) | 1 year |
ln_or | LinkedIn analytics | LinkedIn (third-party) | 1 day |
| Google Analytics cookies | Performance and usage analytics | Google (third-party) | Various |
The ajs_anonymous_id and ajs_user_id cookies come from Segment, a customer data platform. They assign a persistent identifier to track sessions and usage patterns across visits. If you decline analytics cookies through Anthropic's consent panel, these should not be set.
Marketing cookies
Claude.ai also sets marketing cookies from major advertising platforms. These help Anthropic measure the effectiveness of its ad campaigns and reach potential users.
| Cookie | Purpose | Set by | Lifespan |
|---|---|---|---|
_fbp | Meta Pixel: tracks visits for ad targeting | Facebook (third-party) | 90 days |
_fbc | Meta click identifier for conversions | Facebook (third-party) | 2 years |
_rdt_uuid | Reddit ad conversion tracking | Reddit (third-party) | 1 year |
_rdt_cid | Reddit targeted marketing | Reddit (third-party) | 1 year |
_ttclid | TikTok click identifier | TikTok (third-party) | 90 days |
guest_id | X (Twitter) visitor identification | X (third-party, .twitter.com) | 348 days |
guest_id_ads | X (Twitter) targeted marketing | X (third-party, .twitter.com) | 348 days |
guest_id_marketing | X (Twitter) targeted marketing | X (third-party, .twitter.com) | 348 days |
personalization_id | X (Twitter) personalised content | X (third-party, .twitter.com) | 348 days |
muc | X (Twitter) targeted marketing | X (third-party, .t.co) | 400 days |
muc_ads | X (Twitter) targeted marketing | X (third-party, .t.co) | 400 days |
| Google Advertising cookies | Targeted marketing | Google (third-party) | Various |
Most of these marketing cookies sit on the .anthropic.com and claude.ai domains. The X cookies sit on twitter.com and t.co. None of them is needed for Claude Code to work, and Anthropic lists them for targeted marketing. Under the GDPR and the ePrivacy Directive, these require opt-in consent before being placed.
How Claude Code logs in, and why cookies are not its credential
Claude Code's CLI does not store cookies. On first launch, running claude opens a browser window where you sign in to your claude.ai account. The browser handles the login and sets the claude.ai cookies, including sessionKey and __cf_bm. It then hands a code back to Claude Code, through a local callback or a code you paste into the terminal.
From there, Claude Code keeps its own login. According to Anthropic's Claude Code authentication documentation, the credential lives in the encrypted macOS Keychain on a Mac, and in ~/.claude/.credentials.json with file mode 0600 on Linux and Windows. The CLI calls the API with that credential, not with a browser cookie.
Two separate stores: the browser's cookies and Claude Code's login
This has two practical effects. Clearing your browser cookies signs you out of claude.ai in that browser, but Claude Code stays signed in until its own login expires or you run /logout. When the stored login is within three days of expiry, Claude Code warns at startup: Your login expires in 3 days · run /login to renew.
For a security audit, both places count. Browser storage holds sessionKey, activitySessionId, __cf_bm and the other necessary cookies. The Keychain entry or the credentials file holds the CLI's login, and it deserves the same protection as an API key.
There are no free Claude Pro or premium cookies
Posts that offer "free Claude premium cookies" or "Claude Pro cookies" share a copied sessionKey value. Importing one into your browser does not unlock a free plan. It logs you in to another person's claude.ai account, with their chats, files and billing, for as long as that session lasts.
Anthropic's Consumer Terms rule this out. They say you may not share your account login information or credentials, or make your account available to anyone else, and that the account holder is responsible for everything done under it. The owner of the account can also see every conversation you have while you use their session, and can end it at any time. A browser extension that promises to import such cookies needs permission to read and write your cookies, which is the same access it would need to copy your own login. The shared cookie would not help with Claude Code either, because the CLI keeps its own credential.
The free route is the Free plan on claude.ai with your own account. Claude Code needs your own Pro, Max, Team or Enterprise plan, a Claude Console account or a cloud provider such as Amazon Bedrock.
What Anthropic's cookies mean for your own website
If you are reading this as a website owner rather than a Claude Code user, the question is different: do Anthropic's cookies appear on your site?
They will not, unless you embed content from anthropic.com or claude.ai. The cookies listed above are scoped to Anthropic's own domains and to the third parties it uses. Your visitors will not receive sessionKey or _fbp from Anthropic just by visiting your website.
It becomes relevant if your site uses AI-powered features built on Anthropic's API. The API itself is server-to-server and does not set browser cookies. But if your implementation sends users to claude.ai to sign in, as some OAuth-based integrations do, cookies are set on Anthropic's domain during that redirect.
For your own site's consent obligations, what matters is the cookies your domain sets, not those set by third-party sites your users might also visit. Use a cookie scanner to audit your own domain and check that your consent banner covers everything your site actually places.
How Anthropic asks for cookie consent
Anthropic offers cookie controls through a "Your privacy choices" option in the Learn More menu on claude.ai and a "Privacy Choices" link in the anthropic.com footer. You can accept or decline analytics and marketing cookies there, or send a global privacy control signal from your browser. Necessary cookies cannot be turned off. Anthropic's cookie policy adds that it does not respond to browser "Do Not Track" signals.
The anthropic-consent-preferences cookie stores your choice for one year. This is a standard approach: the consent record itself is treated as a necessary cookie, since it remembers your decision.
For European users, Article 5(3) of the ePrivacy Directive requires consent before non-essential cookies are set. The CNIL and other European data protection authorities enforce that rule actively. The CNIL fined Google EUR 150 million at the end of 2021 for making refusal harder than acceptance. On 1 September 2025 it fined Google EUR 325 million over ads shown between Gmail emails and the consent collected for ad cookies when users created a Google account. Accepting everything on claude.ai allows marketing and analytics cookies from six companies: Google, LinkedIn, Meta, Reddit, TikTok and X.
Anthropic's cookie list at a glance
The three tables reduce to one comparison. If you want to set Claude next to another AI assistant, ChatGPT's cookies are listed group by group in OpenAI's own policy.
| Group | Entries on Anthropic's list | Companies involved | Set before you choose? |
|---|---|---|---|
| Necessary | 24 | Anthropic, Cloudflare, Stripe, Intercom, Google, YouTube | Yes, they cannot be refused |
| Analytics | 6 | Segment (first-party), Google, LinkedIn | No, only after you accept |
| Marketing | 12 | Google, Meta, Reddit, TikTok, X | No, only after you accept |
What developers should know
If you use Claude Code daily, these are the practical points.
Your browser session on claude.ai runs on sessionKey, with a one-month expiry. Clearing your browser cookies signs you out of claude.ai, not out of Claude Code. Safari's tracking prevention limits cookie duration for cookies written by page scripts to seven days. A sign-in cookie that claude.ai's own server sets in a Set-Cookie header, as sign-in cookies usually are, is not shortened by that limit.
The __cf_bm cookie from Cloudflare expires after 30 minutes and is refreshed on each request. It exists to distinguish human users from bots. If you see Cloudflare challenges when accessing claude.ai, clearing this cookie and cf_clearance may help.
On team and enterprise accounts, the lastActiveOrg cookie remembers which organisation you last used. If you switch between personal and team accounts, this cookie decides which one loads by default in the browser.
For those building applications on the Anthropic API: the API does not set cookies. It uses API keys or OAuth tokens passed in headers. Cookies only enter the picture when a browser is involved, either through claude.ai directly or during the browser sign-in that Claude Code uses once. If you publish what Claude builds for you, read Claude artifacts and cookie compliance next.
Quick answers about Claude cookies
Does Claude Code set cookies on my computer?
Claude Code's CLI does not set cookies. When it opens your browser to sign you in, claude.ai sets cookies in the browser, including sessionKey and security cookies from Cloudflare and Stripe. The CLI then keeps its own login in the macOS Keychain or in ~/.claude/.credentials.json.
Can I use Claude Code without accepting marketing cookies?
Yes. Marketing cookies from Google, Meta, Reddit, TikTok and X are not required for Claude Code to work. You can decline them through the "Your privacy choices" option on claude.ai without affecting your login.
Does the Anthropic API set cookies on my website visitors?
No. The Anthropic API is a server-to-server channel that uses API keys or OAuth tokens in HTTP headers. It does not place cookies in your visitors' browsers. Only direct interaction with claude.ai or anthropic.com sets cookies.
How long does the Claude Code login last?
The sessionKey cookie lasts one month and controls your claude.ai session in the browser. Claude Code's own login is separate: it shows "Your login expires in 3 days" at startup before it lapses, and you renew it with /login.
What third-party cookies does Claude.ai set?
Anthropic's list names Cloudflare (bot management), Stripe (fraud prevention), Intercom (support chat), Google (security, analytics and ads), YouTube (embedded videos), LinkedIn (conversion tracking), and Meta, Reddit, TikTok and X (marketing).
Can I use a shared Claude Pro cookie?
No. A shared "premium" cookie is another person's logged-in claude.ai session. Anthropic's Consumer Terms forbid sharing account login information or making an account available to anyone else, and the account owner can see and end the session at any time.
Should I list Claude Code cookies in my website's cookie policy?
Only if your website sets them. If your site redirects users to claude.ai or embeds content from Anthropic's domains, disclose the cookies that result. If you use the Anthropic API server-to-server with no browser redirect, no Anthropic cookies are set on your domain.
See which cookies your own site sets
Whether you use Claude Code or any other AI tool, your consent banner can only cover the cookies you know about. Kukie.io's Cookie scanner lists every cookie a page sets by name, origin and purpose, so your visitors get a real choice about each category.
