Does the m_user cookie need consent?

In the EU and the UK, yes. m_user is a marketing cookie and needs consent before it is set under the GDPR, the ePrivacy rules and PECR. Under the CCPA and CPRA, visitors can opt out of its use for cross-context behavioural advertising.

How long does the m_user cookie last?

m_user usually lasts 90 days. The exact lifetime depends on the site's settings and the version of the script that sets it.

Who sets the m_user cookie?

m_user is set by Facebook. It is in the Marketing category.

How do I block or delete the m_user cookie?

Visitors can delete m_user in their browser's cookie settings. On your own website, a consent banner can keep the script that sets it waiting until the visitor accepts marketing cookies. Kukie.io's banner does this for known trackers by default, and for any other script you tag with its category.

Marketing

m_user cookie

Set by Facebook.

What it does

Used to authenticate your identity on Facebook's mobile website. Contents: Email, User ID, authentication value, version, user agent capability, creation time, Facebook version indicator

Cookie name: m_user
Category: Marketing
Provider: Facebook
Duration: 90 days
Data source: Open Cookie Database (opens in a new tab)

Consent

Needed in the EU and the UK

m_user is in the Marketing category. In the EU and the UK, it needs the visitor's consent before it is set. Under California's CCPA, visitors can opt out of the sale or sharing of their personal information, including for cross-context behavioural advertising.

GDPR and ePrivacy (EU): Prior consent is needed before setting m_user. Advertising and tracking cookies are never covered by the strictly necessary exemption.
UK GDPR and PECR: Consent is needed before setting m_user.
CCPA and CPRA (California): Setting m_user for cross-context behavioural advertising counts as sharing personal information: offer a "Do Not Sell or Share My Personal Information" opt-out and honour the Global Privacy Control signal.

Managing m_user with a consent banner

A consent banner can keep the script that sets m_user waiting until the visitor accepts marketing cookies. Kukie.io's cookie scanner finds m_user and sorts it into a category. The banner holds back known trackers by default, and any other script you tag with its category waits too.

Learn more about script blocking

Related cookies