Browser Storage and Identifiers
The Biskoui SDK uses first-party browser storage on the website where it is installed. It does not set third-party cookies on a Biskoui domain.
Storage
| Record | Normal mode | Cross-subdomain mode | Purpose |
|---|---|---|---|
| Session ID | sessionStorage | sessionStorage | Groups events from one browser tab. |
| Accepted services | localStorage | Parent-domain cookie | Restores the consent choice. |
| Consent metadata | localStorage | Parent-domain cookie | Stores the configuration fingerprint and expiry. |
| Consent Mode state | localStorage | localStorage and parent-domain cookie | Initializes Consent Mode before the SDK loads. |
| Visitor ID | localStorage when required | Parent-domain cookie when required | Links consent changes and revocation. |
biskoui_consent_v1 | Optional host-only cookie | Optional parent-domain cookie | Exposes consent to the website's backend. |
Only use cross-subdomain mode when the affected subdomains share the same consent configuration and trust boundary. See Cross-Subdomain Consent.
Identifiers
The session ID is random, limited to one browser-tab session, and sent with consent and engagement events.
Biskoui creates a visitor ID only after at least one optional service is accepted. A first-time rejection does not create one. If a returning visitor rejects all services, Biskoui records the revocation and removes the identifier from browser storage.
Neither identifier represents consent and neither should be used by a backend to determine whether a service is allowed.
Consent data
Consent has a fixed expiry that is not extended by page loads. See Consent Validity.
Internal SDK storage names and formats may change. Applications should not read
them directly. For server-side use, enable the documented
biskoui_consent_v1 cookie, which is
disabled by default.