Cookies, storage and consent categories for your site

A privacy or web owner uses this page to disclose what the Noxtica browser SDK writes on a visitor’s device. It lists each cookie and storage entry with its store, lifetime, writer and consent category. It also explains how Do Not Track (DNT) and Global Privacy Control (GPC) signals change what the collector accepts.

The tables are an engineering inventory, not legal advice. Your counsel decides how to classify each entry under the rules that apply to you. The cookie notice for Noxtica’s own websites is at Cookies.

What it is

Availability: depends on your plan, role and the modules enabled for your organisation.

<sk> below is the Site Key of your domain. The SDK has two scripts. The core script runs on every page. The extensions script runs after your page allows it. The core writes no cookie, no localStorage and no IndexedDB. It writes per-tab sessionStorage entries and nothing else. Everything persistent comes from the extensions.

Cookie and storage inventory

What each entry holds:

• nox_fp_<sk> is the device record: the device identifier, the last-submit time and the state schema version. The localStorage and IndexedDB copies also keep the last check result (score, risk level, confidence, flags). From SDK 3.8.1 the cookie copy holds only the schema version, the device identifier and the last-submit time, as URI-encoded JSON.
• nox_itp_canary_<sk> is a purge canary, a timestamp that tells the SDK a browser purged its storage.
• nox_tri_<sk> is a token refresh interval hint.
• nox_lock_<sk> is a cross-tab lock. It is used when the browser has no Web Locks API, and it is not written while persistent storage is closed.
• nox_buf_<sk> buffers real-user-monitoring and console-log events until they are delivered.
• noxtica.session.<sk>.token caches the session token so later pages in the same tab skip a round trip.

Cookie attributes

The three device cookies nox_fp_<sk>, nox_itp_canary_<sk> and nox_tri_<sk> are written by script with these attributes.

Consent categories

In a gated consent mode (api or a cookie mode), nothing persistent is written until deviceId is granted and the domain’s persistent device recognition setting is on. Before that, the three device keys are held in memory and sessionStorage under the same names. When deviceId is withdrawn, the SDK deletes the three keys from localStorage and cookies and deletes the IndexedDB database nox_kv_<sk>. In the not_required mode the extensions write the device record as soon as they load, unless your page denies deviceId. See Consent modes.

Third-party network contacts

DNT and GPC

The SDK reports a visitor’s browser signal in getConsent().privacySignal: gpc when navigator.globalPrivacyControl is true, dnt when doNotTrack is 1 or yes, otherwise null. Browsers send Sec-GPC: 1 or DNT: 1 on requests.

The collector acts on the signal according to the domain’s DNT/GPC policy. Real-user monitoring, error detail, console logs and the interaction tracker follow the policy you set in Web Analytics & Privacy → Consent & Privacy. Session replay has its own DNT/GPC policy per domain in Web Analytics & Privacy → Capture Policies. New domains start on Honor in the Consent & Privacy decision, and the Capture Policies form starts on Honor too. With Honor and a signal present:

With Documented override the lane is not refused for the signal. For real-user monitoring, an override needs the approved legal basis rum_observability and your acknowledgement. This page does not state that a signal stops the core security check.

Prerequisites

• A domain with the SDK installed. See Install and browser runtime.
• Your consent mode chosen for the domain. See Consent modes.
• The administrator role to read the CSP & storage tab and to save a consent decision.
• Your counsel’s classification of each entry for your jurisdiction.

Steps

1. Open the generated storage table

1. Open Backoffice → Integrations & API → Script & Consent.
2. Select your domain if the page asks for one, then the CSP & storage tab.
3. Read the table “Cookies and browser storage written by the collector”. Backoffice generates it from the SDK source.

2. Choose the rows for your setup

1. If you run the core script alone, disclose the sessionStorage rows marked Core.
2. If you load the extensions, add the rows that match the categories you grant.
3. Add nox_buf_<sk> when you grant analytics, and the replay rows when you grant replay.

3. Map categories to your consent tool

Connect your consent tool to the four categories with client.setConsent. The mapping is your decision. Example:

const client = window.noxticaClient;
const state = (allowed) => (allowed ? 'granted' : 'denied');

cmp.onConsentChanged((choices) => {
	client.setConsent({
		deviceId: state(choices.preferences),
		analytics: state(choices.statistics),
		replay: state(choices.statistics),
		behavioral: state(choices.marketing),
	});
});

4. Publish the disclosure

Copy the inventory into your cookie policy. State for each row the name, store, lifetime and purpose. Name the third-party contacts that apply to your setup.

5. Set the DNT and GPC policy

1. Open Web Analytics & Privacy → Consent & Privacy. Domains that still need a decision are listed. A domain whose decision is already recorded does not appear.
2. In the row of a listed domain, choose the DNT/GPC policy. Keep Honor unless your counsel advises otherwise. Session replay has a separate DNT/GPC policy in Web Analytics & Privacy → Capture Policies.
3. Save and complete the step-up check. A documented override also needs the legal basis and the acknowledgement.

6. Set your own console preference

Open Backoffice → Settings. In Privacy & cookies, switch Analytics, session replay and device recognition on or off for your own account. Turning it off stops collection and deletes what was stored on that device.

Verify it works

With the consent mode api and nothing granted, check the page in your browser developer tools.

• Application → Cookies shows no nox_ cookie.
• Object.keys(localStorage).filter((k) => k.startsWith('nox_')) returns an empty array.
• sessionStorage shows noxtica.session.<sk>.token.
• After you grant deviceId and load the extensions, the three device cookies appear with Path=/, SameSite=Lax and a 400-day lifetime, and no Domain attribute.
• After you withdraw deviceId, the three keys and the nox_kv_<sk> database disappear.
• With a browser GPC signal on and the policy on Honor, a real-user-monitoring request returns HTTP 403, and a replay upload is refused.

Troubleshooting

Related

• Consent modes, GPC and Google Consent Mode: how consent modes and categories work in the SDK.
• Install and browser runtime: install tags, the Content Security Policy and the consent matrix.
• Legal basis register and receipts: the per-domain consent decision.
• Privacy and compliance controls in Backoffice: map of every privacy page.
• Cookies and Privacy Policy: the public legal documents for Noxtica’s own sites.