Analytics

_pk_ses.< appID>.< domainHash>

Module: Analytics
Expires after: 30 minutes (can be changed)
Expires: Automatically
Type: First-party cookie

About: Shows an active session of the visitor. If the cookie isn't present, the session has finished over 30 minutes ago and it was counted in a pk_id cookie.

_pk_id.< appID>.< domainHash>

Module: Analytics
Expires after: 13 months (can be changed)
Extends: No
Type: First-party cookie

About: Used to recognize visitors and hold their various properties.

Value: <visitorID>.<cookieCreationTimestamp>.<visitsCount>.<currentVisitTimestamp>.<lastVisitTimestamp>.<lastEcommerceOrderTimestamp>

• visitorID: Value is generated via JavaScript when not provided otherwise.
• cookieCreationTimestamp: Cookie creation time.
• visitsCount: 0 means there are no previous visits.
• currentVisitTimestamp: Current time. Refreshed with every user action.
• lastVisitTimestamp: Time of the last visit. Empty if there are no previous visits. It is also used to increase the number of visits (together with the cookie pk_ses).
• lastEcommerceOrderTimestamp: Time of the last ecommerce order. Empty if there are no ecommerce orders.

_pk_cvar

Module: Analytics
Expires after: 30 minutes (can be changed)
Extends: No
Type: First-party cookie

About: Holds custom variables that were set during the previous page view. It's not enabled by default. Requires calling the storeCustomVariablesInCookie() method on the Javascript tracker object.

Value: Custom variable keys and values.

app_id

Module: Analytics
Expires after: 365 days
Expends: Automatically
Type: First-party cookie

About: Used to pass a site or app ID between Piwik PRO's modules: Analytics, Tag Manager, Audience Manager, Consent Manager, Administration.

Value: A site or app ID.

piwik_auth (deprecated)

Module: Analytics (versions below 16.0.0)
Expires after: 24 minutes (can be changed)
Expends: Automatically
Type: First-party cookie

About: Stores session information for Piwik PRO's user interface (UI). As long as this cookie is valid and contains a login and a token_auth parameter, a visitor is considered as a logged-in visitor, and a PIWIK_SESSID cookie will be refreshed.

Value: login=<userLogin>:token_auth=< tokenHash>:_=<signature>

• userLogin: User's login.
• tokenHash: md5 hash created from a login and a token_auth parameter.
• signature: Checksum

PIWIK_SESSID (deprecated)

Module: Analytics (versions below 16.0.0)
Expires after: 24 minutes (can be changed)
Extends: No
Type: First-party cookie

About: Stores a PHP session ID.

Value: A unique session identifier.

Tag Manager

_stg_debug / stg_debug

Module: Tag Manager
Expires after: 14 days
Expends: Automatically
Type: First-party cookie

About: Determines if the Tag Manager's debugger should be displayed. A cookie is removed after you close the debugger.

Value: 1 when debug mode is turned on.

Created if: You use a stg_debug query parameter in the URL.

stg_traffic_source_priority

Module: Tag Manager
Expires after: 30 minutes
Expends: Automatically
Type: First-party cookie

About: Stores the type of traffic source that explains how the visitor reached your website.

Value:

• 1: Direct
• 2: Referral
• 3: Social media
• 4: Organic search
• 5: Campaign

Created if: You use the traffic source condition in a trigger.

stg_last_interaction

Module: Tag Manager
Expires after: 365 days
Expends: Automatically
Type: First-party cookie

About: Determines whether the last visitor's session is still in progress or a new session has started.

Value: A timestamp of the last interaction a visitor had on your website.

Created if: You use a multiplicity condition in a trigger.

stg_returning_visitor

Module: Tag Manager
Expires after: 365 days
Expends: Automatically
Type: First-party cookie

About: Determines if the visitor has already been to your website - they are returning visitors.

Value: A timestamp of the last interaction a visitor had on your website.

Created if: You use a returning-visitor condition in a trigger.

stg_fired__< appID>

Module: Tag Manager
Expires after: The session ends. (Fixed idle time or after a browser is closed.)
Extends: No
Type: First-party cookie

About: Determines if the combination of a tag and trigger was fired during the current visitor's session.

Value: A timestamp of the moment when a tag is fired.

Created if: You use a multiplicity condition in a trigger, and a trigger is set to fire a tag once per session. A cookie is created after the tag is fired.

stg_utm_campaign

Module: Tag Manager
Expires after: The session ends. (Fixed idle time or after a browser is closed.)
Extends: No
Type: First-party cookie

About: Stores a name of the campaign that directed the visitor to your website.

Value: An encoded value of an utm_campaign query parameter.

Created if: You use the campaign condition in a trigger, and a visitor enters your website from a campaign with an utm_campaign query parameter.

stg_pk_campaign

Module: Tag Manager
Expires after: The session ends. (Fixed idle time or after a browser is closed.)
Extends: No
Type: First-party cookie

About: Stores a name of the campaign that directed the visitor to your website.

Value: An encoded value of a pk_campaign query parameter.

Created if: You use the campaign condition in a trigger, and a visitor enters your website from a campaign with a pk_campaign query parameter.

stg_externalReferrer

Module: Tag Manager
Expires after: The session ends. (Fixed idle time or after a browser is closed.)
Extends: No
Type: First-party cookie

About: Stores an URL of a website that referred a visitor to your website.

Value: The window.location.origin value for a referral website.

Created if: You use the external referrer condition in a trigger, and a visitor enters your website from a referral website.

_stg_opt_out_simulate

Module: Tag Manager
Expires after: 365 days
Expends: Automatically
Type: First-party cookie

About: Used to simulate the behavior of the opt-out snippet in the debugger. It turns off all tracking tags in the tested domain.

Value:

• true: Opt-out simulation is turned on.
• false: Opt-out simulation is turned off.

Created if: You turn on opt-out simulation in debug mode.

_stg_optout

Module: Tag Manager
Expires after: 365 days
Expends: Automatically
Type: First-party cookie

About: Used to turn off all tracking tags in the tested domain.

Value:

• true: A visitor opts out of tracking.
• false: A visitor agrees to tracking.

Created if: A visitor opts out of tracking. (You use an opt-out snippet.)

stg_global_opt_out (deprecated)

Module: Tag Manager
Expires after: 365 days
Expends: Automatically
Type: Third-party cookie

About: Used to turn off all tracking tags on websites that belong to one Piwik PRO account.

Value:

• 1: A visitor opts out of tracking.
• 0: A visitor agrees to tracking.

Created if: A third-party cookie is set when a visitor opts out of tracking. (You use a global opt-out snippet.)

Local storage

In addition to cookies, Piwik PRO uses local storage in the visitor's browser to stack some information. Here's what is kept in that storage.

ppms_webstorage

Module: Tag Manager, Consent Manager and Analytics

About: Prevents visitor's data loss that may happen because of some mechanisms used by browsers, for example, Safari's ITP.

Value: A stringified object that contains information about created cookies for each module. It stores data about each created cookie, such as a key, value, expiry date, path, domain, and more. This is the same data that was used to create a cookie.

Created if: Each time a cookie is set in the visitor's browser.

Removed if: A ppms_webstorage item isn't removed automatically. But a visitor can delete it manually. Single entries in the object are removed after a corresponding cookie expires.

ppms_data_store

Module: Audience Manager

About: Stores information from forms on your website. After a visitor submits a form, the data is passed to Audience Manager. But if a form redirects a visitor to another page, data may be lost. Therefore form data is kept in the local storage as a backup. (A page where a visitor is redirected needs to have a form tracker, otherwise Piwik PRO can't collect form data).

Value: A JSON encoded object that contains:

• payload: AES encrypted form data.
• aes: RSA encrypted AES key (for payload)
• Iv: initialization vector (for payload)

Removed if: After the form tracker sends data to the server. It can happen right after a visitor submits a form or after a new page loads in their browser.