What is the __RequestVerificationToken cookie?no consent needed
Set by ASP.NET (The website (Microsoft ASP.NET)). Expires after Session.
Strictly necessary — it can load freely
Cookies essential to the service are exempt from consent under ePrivacy Art. 5(3) — but __RequestVerificationToken must still be disclosed in your cookie policy.
Purpose
Anti-forgery token that protects forms against cross-site request forgery (CSRF).
Cookie details
- Cookie name
__RequestVerificationToken- Service
- ASP.NET
- Provider
- The website (Microsoft ASP.NET)
- Category
- Strictly Necessary
- Duration
- Session
- Consent
- Not required
GDPR requirements
Strictly necessary cookies are essential for the website to function and cannot be switched off. They are set only in response to actions made by you — such as logging in or filling forms. No consent is required.
For __RequestVerificationToken to be compliant, it must be:
- May be set as soon as the visitor arrives — no consent needed
- Still disclosed in your cookie policy, with what it does and why it is necessary
- Not shown as a toggle in your consent banner
How to handle it
- 1Let it load freely
No consent gate is needed for this cookie.
- 2Disclose it
List it in your cookie policy as strictly necessary for ASP.NET.
- 3Keep it out of the toggles
Strictly necessary cookies shouldn't be switchable in your consent UI.
Other ASP.NET cookies
is __RequestVerificationToken on your site?scan it in 2 minutes
Free scan · see every cookie before and after consent