Category: Tracking Technologies
Flash Cookies
Also known as: LSO, Local Shared Object, Local Shared Objects, LSOs
Simply put
Flash cookies, also called Local Shared Objects (LSOs), are small data files that websites using Adobe Flash Player could store on a visitor's computer. Historically they were used to hold data and track user activity, and because they were stored differently from ordinary browser cookies, they were harder for users to find and delete. Because Adobe Flash Player reached end-of-life on 31 December 2020, this technology is now largely obsolete.
Formal definition
A Flash cookie, technically a Local Shared Object (LSO), is a data file that a website containing Adobe Flash content could write to a user's local device via Adobe Flash Player, functioning as a client-side persistence mechanism analogous to but separate from HTTP cookies. LSOs were notable because they were managed by the Flash runtime rather than the browser, could persist independently of browser cookie controls, and could be used to re-create or 'respawn' deleted cookies, raising distinct tracking and consent concerns. Adobe Flash Player reached end-of-life on 31 December 2020, and modern browsers no longer support it, so Flash cookies are largely obsolete in current practice; note that from a compliance standpoint, the placing of and access to such information on a user's device would generally fall within ePrivacy rules in the EU (with associated GDPR obligations for any resulting personal data processing), in the same way as other non-cookie storage and tracking technologies, though the applicable rules and their enforcement vary by jurisdiction and are outside the scope of this definition.
Why it matters
Flash cookies, or Local Shared Objects (LSOs), matter historically because they demonstrated how tracking could occur outside the browser's own cookie controls. Because LSOs were managed by the Adobe Flash runtime rather than the browser, they could persist even after a user cleared their ordinary browser cookies, and they could be used to re-create or 'respawn' deleted cookies. This made them difficult for users to find and delete and raised distinct concerns about transparency, user control, and the effectiveness of consent choices.
Who it's relevant to
Privacy officers and data protection professionals
Flash cookies are primarily of historical and contextual relevance. They remain a useful reference point for understanding why non-cookie storage and tracking technologies are treated under the same rules as ordinary cookies, and why persistent client-side storage that evades browser controls raises heightened transparency and consent concerns. In current practice the technology is largely obsolete.
Web developers and technical teams
Because Adobe Flash Player reached end-of-life on 31 December 2020 and modern browsers no longer support it, developers are unlikely to encounter active Flash cookie functionality today. Awareness of LSOs is mainly relevant when auditing or decommissioning legacy systems that once relied on Flash content.
Legal counsel and compliance teams
Flash cookies illustrate that consent and disclosure obligations can extend beyond literal HTTP cookies to any technology used to place or access information on a user's device. This principle continues to apply to contemporary technologies such as local storage, SDKs, pixels, and fingerprinting, even though Flash cookies themselves are now largely obsolete. The specific obligations and their enforcement vary by jurisdiction.
Inside LSO
Local Shared Objects (LSOs)
The technical name for Flash cookies, these are data files stored by Adobe Flash Player on a user's device. Unlike standard HTTP cookies, they were managed by the Flash plugin rather than the browser, and could store larger volumes of data outside the browser's ordinary cookie controls.
Storage outside browser cookie controls
Flash cookies were typically stored in Flash-specific directories, which meant that clearing browser cookies did not necessarily delete them. This separation from standard browser mechanisms is central to why they raised distinct privacy concerns.
Respawning / 'zombie' cookie behaviour
Flash cookies were historically used to recreate or 'respawn' deleted HTTP cookies, restoring tracking identifiers after a user had attempted to clear them. This use case attracted particular regulatory and public scrutiny.
Legal treatment as device storage/access
Because Flash cookies involve storing and accessing information on a user's terminal equipment, they fall within the scope of the ePrivacy Directive's rules on device storage in most EU jurisdictions, in the same way as HTTP cookies and similar technologies such as local storage, pixels, and SDKs. Where they process personal data, the GDPR also applies.
Obsolescence following Flash end-of-life
Adobe Flash Player reached end-of-life on 31 December 2020, and Adobe stopped supporting and distributing it thereafter. As a result Flash cookies are now largely obsolete, and the technology is generally no longer available in modern browsers, though the persistence and respawning techniques they illustrated remain relevant to understanding other client-side storage methods.
Common questions
Answers to the questions practitioners most commonly ask about LSO.
Are Flash cookies exempt from consent because they are a different technology from standard HTTP cookies?
No. Although Flash cookies (Local Shared Objects) are stored by the Adobe Flash Player rather than by the browser's ordinary cookie mechanism, EU rules on storing or accessing information on a user's device are generally technology-neutral. In most EU jurisdictions the ePrivacy rules apply to Flash cookies in the same way they apply to standard cookies, pixels, local storage, and similar technologies. The relevant question is typically the purpose (for example analytics or advertising) rather than the storage format. It is also worth noting that Adobe Flash Player reached end-of-life on 31 December 2020, so Flash cookies are now largely obsolete and encountering them in current deployments is uncommon.
Does deleting browser cookies also remove Flash cookies?
Not necessarily. Flash cookies were historically stored separately from browser cookies, so clearing cookies through browser settings did not always delete Local Shared Objects. This separation is one reason Flash cookies were sometimes associated with so-called respawning, where deleted browser cookies were restored from a Flash-stored copy. Such practices raise concerns under both the ePrivacy rules on device access and, where personal data is involved, the GDPR. Because Adobe Flash Player reached end-of-life on 31 December 2020, this persistence issue is now largely historical, though legacy systems may still warrant review.
How should we handle Flash cookies during a cookie audit of an existing site?
Given that Adobe Flash Player reached end-of-life on 31 December 2020 and modern browsers no longer support it, most current audits will not find active Flash cookies. However, an audit may still identify legacy code, references, or documentation referring to Local Shared Objects. Where such references are found, the practical step is generally to confirm whether any Flash-dependent functionality remains and, if so, to plan its removal or migration. Any historic consent records or data collected via Flash cookies should be reviewed against your current retention and record-keeping obligations. This is a factual and technical exercise; specific compliance conclusions will depend on your circumstances and applicable jurisdiction.
If our legacy application still references Flash cookies, what are the implementation options?
Because the Flash Player is at end-of-life and unsupported by current browsers, the typical implementation path is to migrate any functionality that previously relied on Flash cookies to supported alternatives, such as standard cookies or browser local storage, and to remove obsolete Flash code. Whichever mechanism replaces it will generally fall under the same consent and disclosure rules, so the replacement should be integrated with your consent management platform and classified by purpose. This entry does not prescribe a specific technical migration approach; that will depend on your architecture and should be assessed alongside legal and security input.
Should a consent management platform (CMP) still account for Flash cookies?
In most current deployments a CMP will not need to manage Flash cookies, since the Flash Player reached end-of-life on 31 December 2020 and is no longer supported. Where legacy systems are involved, any storage technology that persists information on or reads it from a user's device should in principle be brought within the scope of the CMP and classified by purpose. A CMP supports consent management but does not by itself guarantee compliance; legal judgment remains necessary to determine how any residual technologies are treated.
What should we do about data or consent records historically collected through Flash cookies?
Historic data collected via Flash cookies should be treated like any other legacy personal data: reviewed for whether a valid basis existed, checked against your retention schedule, and deleted or documented accordingly. Consent logs from that period, if retained, may still be relevant to demonstrating past processing. Because the technology is now obsolete following the 31 December 2020 end-of-life of the Flash Player, the practical focus is usually remediation and documentation rather than ongoing collection. The appropriate action depends on facts not covered by this definition and may vary by jurisdiction, so specific advice should be sought where uncertainty exists.
Common misconceptions
Clearing your browser cookies removes Flash cookies as well.
Flash cookies were stored by the Flash plugin outside standard browser cookie storage, so clearing browser cookies did not necessarily delete them. This independence from browser controls was a defining characteristic and a key source of privacy concern.
Because they were not HTTP cookies, Flash cookies fell outside cookie consent rules.
In most EU jurisdictions the ePrivacy Directive's rules apply to any storage of or access to information on a user's device, not only to HTTP cookies. Flash cookies, like local storage, pixels, and SDKs, generally fell within the same consent framework where they were used for non-essential purposes.
Flash cookies are still a live tracking concern practitioners need to configure for today.
Adobe Flash Player reached end-of-life on 31 December 2020 and is largely obsolete, and Flash cookies are generally no longer functional in modern browsers. The concept remains relevant mainly as historical context and as an illustration of persistent-storage and respawning techniques that can appear in other technologies.
Best practices
Treat any client-side storage that persists or respawns identifiers, including legacy Flash cookies and modern equivalents such as local storage and SDKs, as within scope of ePrivacy device-storage rules in the EU where used for non-essential purposes.
Audit legacy systems and archived tracking implementations for residual Flash-based storage or respawning logic, and remove or remediate it given that Adobe Flash Player reached end-of-life on 31 December 2020.
Do not rely on browser cookie clearing as evidence that all tracking data has been removed; document the full range of storage mechanisms in use and how each can be cleared.
Avoid respawning or 'zombie' techniques that restore identifiers after a user deletes them, as these undermine the freely given, informed, and revocable nature of consent expected in most EU jurisdictions.
Where non-essential storage technologies are used, obtain prior consent through a compliant consent mechanism in EU jurisdictions, and align with the applicable opt-out approach under US state privacy laws such as the CCPA/CPRA, noting that requirements differ by jurisdiction.
Maintain records of the storage technologies deployed and the legal basis for each, and consult legal or data protection advisers where interpretation of scope is uncertain, since tooling supports but does not replace legal judgment.
