Does the tt_csrf_token cookie need consent?

Usually not. tt_csrf_token is in the Essential category, and strictly necessary cookies are exempt from consent under the ePrivacy Directive and PECR. It must still be listed in your cookie policy.

How long does the tt_csrf_token cookie last?

tt_csrf_token usually lasts until the browser closes. The exact lifetime depends on the site's settings and the version of the script that sets it.

Who sets the tt_csrf_token cookie?

tt_csrf_token is set by TikTok. It is in the Essential category.

How do I block or delete the tt_csrf_token cookie?

Visitors can delete tt_csrf_token in their browser's cookie settings, although the website may not work properly without it. A consent banner lists it under Essential, which is always active, so it is not blocked.

Essential

tt_csrf_token cookie

Set by TikTok.

What it does

TikTok CSRF protection token.

Cookie name: tt_csrf_token
Category: Essential
Provider: TikTok
Duration: session
Data source: Kukie.io

Consent

Usually not needed

tt_csrf_token is in the Essential category. Strictly necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive, as long as the cookie is really needed for the service the visitor asked for. It still belongs in your cookie policy.

GDPR and ePrivacy (EU): Exempt from prior consent under the strictly necessary exemption (Article 5(3) of the ePrivacy Directive), as long as tt_csrf_token is really needed for the service the visitor asked for. It must still be listed in your cookie policy.
UK GDPR and PECR: Exempt from consent under PECR Regulation 6(4) when strictly necessary. It must still be listed in your cookie policy.
CCPA and CPRA (California): No opt-out is needed for a strictly necessary cookie, but tt_csrf_token must be disclosed in your privacy policy.

Managing tt_csrf_token with a consent banner

A consent banner lists tt_csrf_token in its cookie table under Essential, the category that is always active. Because it is strictly necessary, it works without an opt-in, and listing it keeps your cookie policy accurate. Kukie.io's cookie scanner finds it when it scans your website.

Learn more about script blocking

Related cookies