> ## Documentation Index > Fetch the complete documentation index at: https://dokumentation.websale.de/llms.txt > Use this file to discover all available pages before exploring further. # Cookies used > All cookies that WEBSALE V8s sets itself: name, validity, content, condition, and security attributes. The basis for the cookie list in your privacy policy. WEBSALE V8s sets cookies to provide certain shop functions. This page lists all cookies that the shop sets itself, with name, validity, content, and the condition under which each is created. It is the basis for the cookie list in your privacy policy. Cookies set by embedded third-party services are not listed here. For those, see the note below. ## Which domain the cookies apply to The shop always sets its cookies for the main domain from the configuration, never for subdomains. | Main domain in the configuration | Cookies apply to | | - | - | | `www.meinshop.de` | `www.meinshop.de` | | `meinshop.de` | `meinshop.de`, without `www` | > [!WARNING] > > Embedded JavaScripts and other elements from third-party providers, for example from tracking or advertising service providers, often set their cookies across subdomains in the form `.meinshop.de`. This means they also apply to `m.meinshop.de` and any other subdomain. WEBSALE has no influence on this; it is the responsibility of the third-party provider and the merchant. > > Transferring data to third parties via cookies or tracking methods is a sensitive matter. As long as the third party does not declare and maintain a handling of personal data that is recognized as transparent by the EU data protection authorities, you should refrain from any data transfer to these third parties. You are liable. Coordinate the use of cookies with your data protection officer. > [!NOTE] > > The cookies listed here are either strictly necessary or tied to a function that you enable yourself. Strictly necessary cookies are permitted without a specific consent request. For the others, the visitor's consent is decisive, see below. > > This page does not replace legal advice. In the following tables, `` stands for your shop ID and `` for the identifier of the subshop, usually the language name. ## Cookies that are always set These three cookies are created on every shop visit, regardless of the configuration. | Cookie | Validity | Content | Purpose | | - | - | - | - | | `ws8___sid` | Until the browser is closed | The session ID | Enables links without session information in the address | | `websale_ac` | 2 years | The string `yes` | Detects whether the browser accepts cookies | | `ws8_securetoken__` | Until the browser is closed | A security token | Protects against man-in-the-middle and similar attacks, transmitted only via SSL | The security token is only created in SSL mode. On logout, the session cookie and security token are cleared immediately. ## Advertising success and affiliate programs These cookies are only created if the shop was opened with a referrer or an affiliate program is connected. | Cookie | Validity | Content | Set when | | - | - | - | - | | `ws___ref` | 30 days, configurable via `RefererCookieDays` | The referrer with which the shop was opened | The shop was opened with a referrer | | `ws___subref` | 30 days, configurable via `RefererCookieDays` | The subreferrer in plain text | A subreferrer was also passed | | `ws___affiliate_pid` | 30 days, configurable via `AffiliateCookieDays` | The partner ID through which the customer came to the shop | At least one affiliate program is connected | | `ws___affiliate_code` | 30 days, configurable via `AffiliateCookieDays` | The type of affiliate program as a number | At least one affiliate program is connected | | `ws___taf` | From `CookieDays` in the `TellAFriend` section | The encrypted reference to the referring customer | The recommendation function is used | The code for the affiliate program is stored in a separate cookie because several affiliate programs can run at the same time. Within the validity period, a purchase is assigned to the matching partner; this is part of the terms of use for affiliate programs. > [!NOTE] > > The recommendation cookie, `ws___taf`, is missing from the previous documentation and is added here. It is only set if consent has been given and `CookieDays` is greater than zero, and it is explicitly deleted after a successful order. Guide: Running your own affiliate program · Connecting the shop to an existing affiliate program · Tracking advertising success with referrer and subreferrer ## Convenience functions These cookies are only created if you enable the corresponding function. | Cookie | Validity | Content | Set when | | - | - | - | - | | `ws_basket_` | `KeepBasketDays` plus a 10-day safety margin | The unique identifier under which the shopping cart is stored | The cookie shopping cart is used | | `ws___welcome_cookie` | 30 days, configurable via `WelcomeCookieDays` | A hash value of the customer index | The welcome function is enabled | | `ws___design_cookie` | 30 days, configurable via `DesignCookieDays` | Encrypted and compressed key-value pairs | The template uses `DC-CookieData_set()` | | `ws_logintoken_…` | From the automatic login configuration | A login token | Automatic login is enabled | > [!NOTE] > > The automatic login cookie is missing from the previous documentation and is added here. > > The shopping cart cookie is the only one without a subshop identifier in its name. It therefore applies to all subshops of the same shop. > [!WARNING] > > Browsers limit the design cookie to 4 kilobytes. If you write more into it via `DC-CookieData_set()`, the browser silently discards the cookie. > [!NOTE] > > `KeepBasketDays` is clamped to the range of 5 to 90 days when read. Smaller values are raised to 5, larger values are reduced to 90. The cookie's validity is deliberately 10 days longer so that the shopping cart does not disappear before its server-side retention period ends. > > The cookie shopping cart disables itself in three cases: when the IDS interface is active, when a customer account has been taken over via superuser, and when the shopping cart is saved in the customer account. In these cases, the cookie is not created at all. Guide: Using the cookie shopping cart · Welcome back function · Onsite personalization · Reference: DC-CookieData\_set ## Redirects | Cookie | Validity | Content | Set when | | - | - | - | - | | `ws___redirect_info` | 30 days, overwritten directly after the redirect | A code for the type of redirect | The special handling for products and categories that are no longer available is used | The cookie records that a redirect has taken place so that the shop can display the appropriate notice on the target page. It is cleared on the next visit. Guide: SpecialHandling of products and categories that are no longer available ## Consent to data processing These cookies are only created if you have enabled the `AgreementCookies` section. | Cookie | Validity | Content | Meaning | | - | - | - | - | | `websale_useragreement` | 10 years, configurable | The string `yes` | The visitor has submitted a declaration at all. As long as this cookie is missing, the shop shows the consent layer | | `websale_useragreement__` | 10 years | `yes` or `no` | The visitor's decision for exactly one service | In the name of the second cookie, `` stands for the service identifier from the `shop.config`, and `` for one of the three values `optin`, `optoutchecked`, or `optoutunchecked`. > [!NOTE] > > The previous documentation states the string `yes` as the content of both cookies. The service cookie actually contains `yes` or `no`, depending on whether the visitor consented or objected. This is corrected here. > [!WARNING] > > Because the type is part of the cookie name, a later change to a service's `Type` or `ID` causes the shop to look for a differently named cookie and not find it. All consents previously given for this service are then treated as nonexistent, and the layer opens again for all visitors. > [!NOTE] > > If the shop is opened from within the WEBSALE app, the shop sets these cookies based on the decision in the operating system's tracking framework. In this case, a fixed validity of one year applies, not the configured one. This is added here. Guide: Consent to data processing · Materials: Consent to data processing ## Security attributes The previous documentation only lists the SameSite attribute. The shop also sets HttpOnly and Secure. This overview is added here. | Cookie | HttpOnly | Secure and SameSite | | - | - | - | | `ws8___sid` | Yes | Only in SSL-only mode | | `ws8_securetoken__` | Yes | Always | | `ws___taf` | Yes | Only in SSL mode | | `websale_ac` | No | Only in SSL-only mode | | `websale_useragreement` and the service cookies | No | Always when opened from the app | | All others | No | No | `HttpOnly` means that JavaScript cannot read the cookie. `Secure` means that the browser only sends it over HTTPS. You usually don't need either attribute in your privacy policy, but they help with troubleshooting and security audits. Guide: Session management · Reference: shop.config, Basic section ## Related topics - [Cookies](https://dokumentation.websale.de/en/v8s/einstellungen/cookies.md) - [Consent to data processing (cookies)](https://dokumentation.websale.de/en/v8s/einstellungen/einwilligung-zur-datenverarbeitung-cookies.md) - [Session management](https://dokumentation.websale.de/en/v8s/einstellungen/session-verwaltung.md) - [Advertising success tracking with referer and subreferer](https://dokumentation.websale.de/en/v8s/marketing-funktionen/werbeerfolgskontrollen-mit-referer-und-subreferer.md) - [Products and categories that are no longer available](https://dokumentation.websale.de/en/v8s/seo/nicht-mehr-verfuegbare-produkte-und-kategorien.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.