Strictly NecessaryNo consent needed
What is the csrftoken cookie?no consent needed
Set by Django (The website (Django)). Expires after 1 year.
Strictly necessary — it can load freely
Cookies essential to the service are exempt from consent under ePrivacy Art. 5(3) — but csrftoken must still be disclosed in your cookie policy.
Purpose
Protects forms against cross-site request forgery (CSRF).
Cookie details
- Cookie name
csrftoken- Service
- Django
- Provider
- The website (Django)
- Category
- Strictly Necessary
- Duration
- 1 year
- Consent
- Not required
GDPR requirements
Strictly necessary cookies are essential for the website to function and cannot be switched off. They are set only in response to actions made by you — such as logging in or filling forms. No consent is required.
For csrftoken to be compliant, it must be:
- May be set as soon as the visitor arrives — no consent needed
- Still disclosed in your cookie policy, with what it does and why it is necessary
- Not shown as a toggle in your consent banner
How to handle it
- 1Let it load freely
No consent gate is needed for this cookie.
- 2Disclose it
List it in your cookie policy as strictly necessary for Django.
- 3Keep it out of the toggles
Strictly necessary cookies shouldn't be switchable in your consent UI.
Other Django cookies
is csrftoken on your site?scan it in 2 minutes
Free scan · see every cookie before and after consent