Skip to main content
Cookie Gate
Category: Cookie Types

Load Balancing Cookies

Also known as: Session Persistence Cookies, Sticky Session Cookies, Load Balancer Cookies, Cookie Affinity, Session Affinity Cookies
Simply put

Load balancing cookies are small technical files a website uses to make sure your requests keep going to the same server when a site runs on multiple servers behind a load balancer. This keeps your session working consistently, for example so you stay logged in or your actions are not lost as you move around the site. They exist to support the technical operation of the service rather than to track you across sites or for marketing.

Formal definition

Load balancing cookies establish session persistence (also called sticky sessions or session affinity) by allowing a load balancer to correlate a client to a specific backend server across successive requests. The cookie is typically set and managed either by the load balancer itself (load balancer-generated persistence) or by the web application, and its inspection generally requires a Layer 7 (HTTP/HTTPS) load balancer capable of reading and setting cookies. Because these cookies serve a purely technical function required to deliver a service the user has requested, they are generally treated as strictly necessary and, in most EU and UK jurisdictions, may fall within the consent exemption under the ePrivacy Directive and its national implementations for cookies strictly necessary to provide a requested service. This exemption is not automatic: it depends on the cookie's actual purpose and scope, and any personal data processed via such cookies remains subject to the GDPR. Where a load balancing cookie is combined with, or repurposed for, analytics, tracking, or other non-essential functions, the consent exemption would generally not apply. This entry describes the technical role of these cookies and does not resolve the fact-specific classification question, which depends on implementation and on the applicable regulator's guidance in each jurisdiction.

Why it matters

Load balancing cookies are a frequent point of confusion in cookie audits and consent mapping because they are technical infrastructure rather than tracking tools, yet they still involve setting information on a user's device and so fall within the scope of the ePrivacy rules governing storage and access. Privacy teams cataloguing every cookie a site sets need to classify them correctly: mislabelling a load balancing cookie as an analytics or advertising cookie may trigger unnecessary consent prompts, while over-broadly treating any cookie as exempt risks missing cookies that have been repurposed for non-essential functions.

The practical significance is that, in most EU and UK jurisdictions, cookies that are strictly necessary to deliver a service the user has requested may fall within the consent exemption under the ePrivacy Directive and its national implementations. A load balancing cookie whose sole purpose is to keep a user's requests routed to the same backend server generally fits this description. However, the exemption is not automatic and depends on the cookie's actual purpose and scope. Where such a cookie is combined with, or repurposed for, analytics or tracking, the exemption would generally not apply, and getting this determination right matters for both compliance posture and user experience.

Any personal data processed through these cookies remains subject to the GDPR even where the ePrivacy consent exemption applies, so the two regimes must be considered separately. This entry describes the technical role of load balancing cookies and does not resolve the fact-specific classification question, which depends on implementation and on the applicable regulator's guidance in each jurisdiction.

Who it's relevant to

Privacy officers and data protection professionals
Those building and maintaining cookie inventories need to classify load balancing cookies accurately. In most EU and UK jurisdictions these may fall within the strictly necessary consent exemption, but this depends on the cookie's actual purpose and scope, and any personal data involved remains subject to the GDPR. Verify that the cookie has not been combined with or repurposed for non-essential functions before treating it as exempt.
Web developers and infrastructure engineers
Teams running applications across multiple servers behind a load balancer implement these cookies to maintain session persistence. They should be aware that cookie affinity typically requires a Layer 7 load balancer, and that they can choose between load balancer-generated persistence cookies and application-managed session cookies. Documenting the cookie's purpose and scope supports downstream compliance classification.
Legal counsel and compliance teams
Counsel advising on cookie compliance should treat the classification of load balancing cookies as fact-specific rather than settled. The strictly necessary exemption under the ePrivacy Directive's national implementations is not automatic, its availability varies by jurisdiction and regulator guidance, and it does not displace GDPR obligations for any personal data processed. Flag cases where such cookies may have been repurposed.
Marketing and analytics teams
Those managing tracking technologies should understand that load balancing cookies serve a purely technical routing function and are distinct from analytics, advertising, and marketing cookies. They should not assume that a technical cookie can carry tracking functionality without changing its compliance treatment, as combining the two would generally remove any consent exemption.

Inside Load Balancing Cookies

Session persistence identifier
Load balancing cookies typically store a value that ties a user's session to a particular backend server, ensuring subsequent requests are routed consistently (often called 'sticky sessions' or session affinity).
Server or node reference
The cookie commonly holds a reference to the specific server, instance, or pool member handling the session, which the load balancer reads to maintain routing continuity.
Short-lived, functional scope
These cookies are generally set for the duration of the session or a limited period and serve an operational purpose rather than tracking users across sites or building profiles.
Strictly necessary characterisation
Load balancing cookies are frequently treated as strictly necessary or essential because they are required to deliver the service the user has requested, which in most EU jurisdictions may bring them within the ePrivacy consent exemption. Whether the exemption applies depends on the specific facts and how the cookie is used.
Potential personal data considerations
Even where a load balancing cookie is exempt from consent under the ePrivacy rules, any personal data it processes (for example, where a value can be linked to an individual) remains subject to the GDPR, so a lawful basis and transparency obligations may still apply.

Common questions

Answers to the questions practitioners most commonly ask about Load Balancing Cookies.

Do load balancing cookies require consent under EU law?
Load balancing cookies are generally treated as strictly necessary in most EU jurisdictions, because they are used solely to distribute traffic across servers to deliver the service the user has requested. Under the ePrivacy Directive's national implementations, such cookies typically fall within the consent exemption for cookies strictly necessary to provide a service explicitly requested by the user. However, this exemption is not automatic: it depends on the cookie doing nothing beyond load balancing. If the same identifier is repurposed for analytics, profiling, or other non-essential functions, the exemption may no longer apply and consent may be required. You should assess the actual behaviour of the cookie rather than rely on its label.
Because load balancing cookies are exempt from consent, does that mean they fall outside data protection rules entirely?
No. It is important to keep the two legal regimes separate. Exemption from the ePrivacy consent requirement concerns only the placing of and access to information on the user's device. Any personal data processed through a load balancing cookie, such as data that can identify a user or their session, remains subject to the GDPR where it applies. That means obligations such as having a lawful basis for the processing, providing transparency information, and applying data minimisation and retention limits can still be relevant even though prior consent is not needed for the cookie itself. Exemption from one regime does not remove obligations under the other.
How should load balancing cookies be described in a cookie notice or policy?
Even where a load balancing cookie is exempt from consent, transparency obligations may still apply, particularly where personal data is processed. In practice this often means listing the cookie in your cookie inventory or policy, typically under a strictly necessary or essential category, and describing its purpose, the data it holds, and its duration. Describing it accurately supports both ePrivacy transparency expectations and GDPR information requirements where the latter applies. The precise disclosure expectations can vary between the EU, the UK, and other regimes, so you should align the wording with the guidance relevant to your operating jurisdictions.
Should load balancing cookies be blocked until a user gives consent through a CMP?
Where a load balancing cookie is genuinely strictly necessary, it does not generally need to be blocked pending consent, since it is typically set as an essential cookie to deliver the requested service. Many consent management platforms allow you to classify cookies so that essential cookies load immediately while non-essential categories are held back until consent is given. The key implementation task is to verify that the cookie is correctly categorised and that it is not silently performing additional functions that would move it outside the essential category. Misclassification is a common source of compliance risk, so the categorisation should reflect the cookie's actual use.
What should be checked to confirm a load balancing cookie is not doing more than load balancing?
A practical review usually involves examining what value the cookie stores, how long it persists, whether the identifier is shared with or accessible to any analytics, advertising, or third-party systems, and whether the same value is used to link user behaviour over time or across sessions. A cookie limited to routing a session to a consistent backend server, often expiring at the end of the session, is more likely to remain within the strictly necessary category. If the identifier is reused for measurement, personalisation, or profiling, that additional purpose should be assessed separately and may trigger consent and further GDPR obligations. The assessment depends on the specific implementation, which a generic definition cannot resolve for you.
Do consent record-keeping obligations apply to load balancing cookies?
Where a cookie is exempt from consent, there is generally no consent to record for that cookie, because no consent is being relied upon. Consent logging obligations are primarily relevant to cookies and similar technologies for which consent is the lawful mechanism. That said, if you rely on the strictly necessary exemption, it can be prudent to document your reasoning for classifying the cookie as essential, so you can demonstrate the basis for not seeking consent if questioned. This is a matter of accountability and internal record-keeping rather than formal consent logging, and the appropriate level of documentation may vary by jurisdiction and by your own risk assessment.

Common misconceptions

Load balancing cookies always require prior consent because they are cookies.
In most EU jurisdictions, cookies that are strictly necessary to provide a service the user has requested may fall within the ePrivacy consent exemption. Load balancing cookies used purely for session affinity are commonly regarded as falling in this category, though the exemption depends on the specific facts and how the cookie is deployed.
Because a load balancing cookie may be exempt from consent, no privacy obligations apply at all.
The ePrivacy consent exemption and the GDPR are distinct regimes. Being exempt from consent for placing the cookie does not remove any GDPR obligations that apply to personal data the cookie processes, such as identifying a lawful basis, providing transparency, and applying appropriate retention. Requirements also differ across the EU, the UK, and US state frameworks.
Labelling a cookie as 'load balancing' automatically makes it exempt.
The classification depends on the cookie's actual function, not its name or category label. If a cookie described as load balancing were also used for analytics, tracking, or other non-essential purposes, that additional use would generally require consent in most EU jurisdictions.

Best practices

Assess each load balancing cookie by its actual function to confirm it is genuinely limited to session affinity before treating it as strictly necessary, rather than relying on its label.
Document the basis for any consent exemption you rely on, including why the cookie is necessary to deliver the requested service, so you can demonstrate your reasoning if questioned.
Treat the ePrivacy placement question and any GDPR processing of personal data as separate analyses, and identify a lawful basis and transparency measures where the cookie handles personal data.
Limit the scope, content, and lifespan of the cookie to what is operationally required, avoiding values or reuse that would extend it into tracking or profiling functions.
Describe load balancing cookies in your cookie notice or policy so users are informed, even where consent is not required, to support transparency obligations that may apply.
Review classifications against current guidance in each relevant jurisdiction (for example the EU, the UK, and applicable US states), since enforcement positions evolve and exemption interpretations can differ.