Does the __RequestVerificationToken cookie need consent?

Usually yes. __RequestVerificationToken is a functional cookie, and unless it is strictly necessary for a feature the visitor asked for, it needs consent before it is set.

How long does the __RequestVerificationToken cookie last?

__RequestVerificationToken usually lasts until the browser closes. The exact lifetime depends on the site's settings and the version of the script that sets it.

Who sets the __RequestVerificationToken cookie?

__RequestVerificationToken is set by Microsoft, from Microsoft Corporation. It is in the Functional category.

How do I block or delete the __RequestVerificationToken cookie?

Visitors can delete __RequestVerificationToken in their browser's cookie settings. On your own website, a consent banner can keep the script that sets it waiting until the visitor accepts functional cookies. Kukie.io's banner does this for known trackers by default, and for any other script you tag with its category.

Functional

__RequestVerificationToken cookie

Set by Microsoft.

What it does

This is an anti-forgery cookie set by web applications built using ASP.NET MVC technologies. It is designed to stop unauthorised posting of content to a website, known as Cross-Site Request Forgery.

Cookie name: __RequestVerificationToken
Category: Functional
Provider: Microsoft
Vendor: Microsoft Corporation
Duration: session
Data source: Open Cookie Database (opens in a new tab)

Consent

Usually needed

__RequestVerificationToken is in the Functional category. Functional cookies usually need the visitor's consent, unless the cookie is strictly necessary for something the visitor asked for, such as remembering a language they just chose.

GDPR and ePrivacy (EU): Consent is needed before setting __RequestVerificationToken, unless it is strictly necessary for a feature the visitor asked for, such as remembering a language they just chose.
UK GDPR and PECR: The same as in the EU: consent first, unless the cookie qualifies for the strictly necessary exemption.
CCPA and CPRA (California): Disclose __RequestVerificationToken in your privacy policy. If the data it stores is shared with third parties, honour opt-out requests, including the Global Privacy Control signal.

Managing __RequestVerificationToken with a consent banner

A consent banner can keep the script that sets __RequestVerificationToken waiting until the visitor accepts functional cookies. Kukie.io's cookie scanner finds __RequestVerificationToken and sorts it into a category. The banner holds back known trackers by default, and any other script you tag with its category waits too.

Learn more about script blocking

Related cookies