Skip to navigation
DocsStorefrontPrivacy

Cookies

BigCommerce storefronts set first-party cookies on the storefront domain by default. The cookies differ between Catalyst and Stencil storefronts, so each is documented in its own section below. Additional cookies may be introduced by scripts configured in Script Manager, subject to each shopper’s consent choices.

This page describes the default cookie behavior of Catalyst and Stencil storefronts. It is not legal advice. Store owners are solely responsible for ensuring their storefront’s use of cookies complies with all applicable privacy laws in the jurisdictions where they operate. We recommend consulting qualified legal counsel to assess your specific compliance requirements.

Catalyst cookies

Catalyst sets no third-party cookies itself.

CookiePurposeCategoryExpiry
c15t-consentStores the shopper’s consent preferences (necessary, functionality, marketing, measurement) and the timestamp when preferences were last set. Contains only binary accept/decline values per category.EssentialPersistent (browser-managed)
authjs.anonymous-session-tokenJWT token for anonymous shopper sessions. Carries the anonymous cart ID and guest session data. The __Secure- prefix is added automatically on HTTPS.EssentialSession
authjs.session-tokenJWT token for authenticated shopper sessions, managed by NextAuth. Set when a shopper signs in.EssentialSession
catalyst.visitorIdUnique visitor identifier used for BigCommerce native analytics events (visit started, product viewed). Set at the proxy level on every request, respects the shopper’s consent selection.Analytics400 days
catalyst.visitIdSession-scoped visit identifier. Every page visit extends/slides the expiration of this cookie an additional 30 minutes.Analytics30 minutes (sliding)
catalyst.productViewsThe products already reported with a ProductViewed event in the current visit, so each product is reported once per visit. Tied to the current catalyst.visitId and refreshed with it. Respects the shopper’s consent selection.Analytics30 minutes (sliding)
currencyCodeThe shopper’s selected currency. Persists the selection across pages and visits.FunctionalSession
force-refreshSet when a shopper signs out, so the next page load refreshes client-side state for the signed-out session. Set to false once the refresh runs.EssentialSession
toast-notificationCarries a one-time notification message (for example, a success or error message after a form submission) from the server to the next page render.Essential1 second

Stencil cookies

Stencil storefronts set the following cookie as a bot-detection signal.

CookiePurposeCategoryExpiry
SHOP_RENDER_VERIFICATION_TOKENServer-signed token used as a bot-detection signal. Confirms the browser executed client-side JavaScript. Contains no personal data.Essential15 minutes (fixed, does not refresh)

Categories follow the same taxonomy used by BigCommerce’s Script Manager and the Catalyst consent manager. Both sections above use them:

  • Essential — Required for core storefront functionality. These cookies are always set and cannot be declined.
  • Functional — Support shopper preferences such as currency selection. Set when the shopper makes a relevant choice.
  • Analytics — Used for aggregate analytics on storefront traffic. Subject to the shopper’s consent selection when cookie consent is enabled.
  • Marketing — Used for targeted advertising and campaign tracking. Subject to the shopper’s consent selection when cookie consent is enabled.

These category labels reflect Catalyst’s internal taxonomy and are not a legal determination of whether a cookie requires consent under GDPR, CCPA, or any other applicable law. Store owners are responsible for correctly categorizing their own scripts and for verifying that their cookie usage meets the requirements of all relevant regulations. Consult qualified legal counsel if you are unsure how to classify a specific cookie.

Resources