Cookies & storage

In short

• Cookies: two first-party cookies with random IDs only, set after analytics consent.
• Consent: read automatically from OneTrust, Google Consent Mode v2 and most banners; for any other tool, set window.dalton.consent.
• Browser storage: the experiment cache and a device ID, kept regardless of consent so visitors keep their variant.

This page is the reference for what Dalton writes to the browser, and how to declare it in your cookie banner. What Dalton collects, and how to allow it in a strict Content Security Policy, are on Privacy & security.

Cookies vs. storage at a glance

Dalton uses two storage mechanisms with different rules:

	What it is	When it's written	Cleared after
Browser storage (localStorage + sessionStorage)	Experiment cache and device ID	Always, so the right variation shows on every page view	24 hours (dalton_device: until cleared)
Cookies	Random session & device IDs	Only after analytics/performance consent	24 hours

Because the experiment data lives in localStorage/sessionStorage, visitors see a consistent experience during their session, even before they accept cookies. Cookies are only used to recognise the same session across cookie-aware contexts, and are written only once analytics consent is granted.

Cookies set by Dalton

All cookies are first-party (set on your own domain), Secure, and SameSite=Lax. They are written only after analytics/performance consent (see Consent handling).

Cookie	Purpose	Data stored	Duration
dalton_session_id_<customer_id>	Keeps the visitor in the same experiment variation across page views	Random session ID + the experiment/variation IDs the visitor is enrolled in	24 hours
dalton_device	Tells new visitors from returning ones, for the New / Returning audience	Random device ID (UUID)	24 hours

What's in them

These cookies contain only randomly generated identifiers and experiment assignments. No names, emails, IP addresses or cross-site identifiers.

Browser storage set by Dalton

These entries hold the experiment cache and a random device ID. They are written regardless of consent, and they let Dalton apply the right variation straight away on later page views. See Consent.

Key	Location	Purpose	Duration
dalton_session	localStorage + sessionStorage	Cached experiment assignments and variation content for the current session	24 hours
dalton_device	localStorage + sessionStorage	Random device ID, to tell new visitors from returning ones	Until cleared
dalton_st_redirected_<id>	sessionStorage	Prevents a URL split test from redirecting the same visitor more than once per session	Session

Expired entries are removed automatically the next time Dalton runs.

Consent handling

Dalton detects consent automatically and supports almost every cookie banner out of the box. Cookies are only written once analytics/performance consent is granted. Browser storage (above) is always available so the experience stays consistent.

Dalton recognises consent from, among others:

• OneTrust — performance/analytics category (C0002)
• Google Consent Mode v2 — analytics_storage: "granted" on the dataLayer
• Trustpilot cookie compliance events
• Common consent cookies (e.g. cookieconsent_status, ot_eu_consent, cookielawinfo-checkbox-analytics)

When OneTrust is present, Dalton respects only OneTrust's decision.

If your banner isn't detected automatically

If you use a custom or less common consent tool, set the consent flag yourself once the visitor accepts analytics cookies:

// Grant consent (allows Dalton to write its cookies)
window.dalton = window.dalton || {};
window.dalton.consent = true;

Set it back to false to stop new cookies from being written. Dalton re-checks this flag continuously, so it takes effect immediately when your banner state changes.

---

Declare Dalton in your cookie banner

If you maintain a manual cookie declaration, add Dalton's cookies under your Analytics / Performance category so they are governed by the visitor's analytics consent:

Cookie	Category	Type	Duration
dalton_session_id_<customer_id>	Analytics / Performance	First-party	24 hours
dalton_device	Analytics / Performance	First-party	24 hours

• OneTrust: map both cookies to the Performance Cookies (C0002) group. No code changes are needed — Dalton reads the OneTrust decision automatically.
• Google Consent Mode: no action needed; Dalton honours analytics_storage automatically.
• Custom tools: declare the cookies as above and signal consent with window.dalton.consent as shown in Consent handling.

Most scanners also detect the localStorage/sessionStorage entries listed under Browser storage; declare them in the same Analytics / Performance category if your tool tracks storage.

Questions?

For privacy or security questions, email team@getdalton.com or see our Privacy & security overview and full Privacy Policy.