A zombie cookie is a type of persistent cookie that is automatically re-created after a user deletes it, usually by restoring itself from a backup copy kept somewhere outside the normal browser cookie store. Because it keeps coming back, it is hard to detect and remove, and it is closely associated with privacy and security concerns.
Why it matters: Users who clear their cookies expect to stop being tracked. Zombie cookies undermine that choice and can conflict with privacy rules such as the GDPR, which require informed, freely given consent. They have some legitimate uses, such as preventing cheating in online games, but they can also be abused to track people or support malicious activity.
In practice: Zombie cookies can come back from several places:
- Browser local storage or other storage mechanisms ordinary users rarely see.
- Older technologies such as Flash local shared objects.
- Copies held on the server and sent back to the client.
- Code injected through cross-site scripting (XSS).
Testers check what data a site stores across all browser storage areas, not just cookies, and confirm that clearing site data truly removes it.
Examples:
- Deleting all cookies for a site, reloading the page and finding an identical tracking ID has reappeared.
- Discovering that an ID removed from cookies is still held in local storage and copied back on the next visit.
- Reviewing a third-party script that rebuilds deleted cookies, during a privacy or security test.
Common pitfalls:
- Checking only the cookie list in developer tools and missing copies kept in other storage areas.
- Treating cookie regeneration as harmless when users have withdrawn consent, which may breach privacy law.
Are zombie cookies illegal? Not in themselves, but using them to track users who have deleted cookies or withdrawn consent can breach privacy regulations such as the GDPR.
What is the difference between a zombie cookie and a supercookie? The terms overlap. A supercookie is stored outside the normal cookie store, while a zombie cookie specifically re-creates itself after deletion, often using such hidden storage.
