---
title: "Do Temporary Session Identifiers (Session IDs) Require Consent Under GDPR?"
description: "When a session ID triggers the ePrivacy consent requirement and when it does not, and how Sealmetrics builds its session identifier: an in-browser device-characteristics hash, never stored on the device, re-keyed daily on the server."
canonical_url: "https://docs.sealmetrics.com/legal/gdpr-and-eprivacy/do-session-ids-require-consent"
lang: "en"
date_generated: "2026-09-21T08:45:24.602Z"
source_hash: "b7781f1f9586ff92cf0ca931fa9691b75de6fef990c153cb60c0f51929a5794b"
content_type: "trust-and-legal"
owner: "legal"
llm_priority: "critical"
source_file: "compliance/GDPR-and-ePrivacy/do-session-ids-require-consent.mdx"
publisher: "Sealmetrics"
---

# Do Temporary Session Identifiers (Session IDs) Require Consent Under GDPR?

Canonical page: https://docs.sealmetrics.com/legal/gdpr-and-eprivacy/do-session-ids-require-consent

A common question around privacy-compliant analytics is whether **temporary Session IDs** fall under “tracking technologies” that require user consent.
The short answer: **it depends on how the Session ID is implemented**.

**Info:**
Any statement on this page about how Sealmetrics meets a criterion is a **self-assessment**, not a certification. No supervisory authority certifies or validates analytics tools, and Sealmetrics holds no third-party security certification. This page is general regulatory analysis, not legal advice.

## When Session IDs *Do* Require Consent

A temporary Session ID **requires consent** if:

- It is **stored in a cookie** or similar persistent storage
- It can be used to **recognize a user over time**
- It can be combined with other identifiers to **reconstruct a profile**
- It is used for **tracking across multiple domains**

In these cases, the Session ID becomes a **personal identifier**, making consent mandatory under:

- **GDPR** ([Article 4(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679))
- **ePrivacy Directive** ([Article 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058))
- Local guidelines ([CNIL](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies-solutions-pour-les-outils-de-mesure-daudience), [AEPD](https://www.aepd.es/guias/guia-cookies.pdf), [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/)…)

## When Session IDs *Do Not* Require Consent

Regulators such as **CNIL (France)** and **AEPD (Spain)** explicitly allow “cookie-less session identifiers” for **audience measurement**, *as long as* they meet **strict conditions**:

### Conditions for Consent-Free Session IDs

- **Used exclusively for audience measurement** (no marketing / profiling)
- **No cross-site tracking**
- **Not persistent** → disappears after the browser session ends
- **Not stored in cookies or localStorage**
- **Cannot be combined with other identifiers** to re-identify the user
- **No fingerprinting techniques**

If all these requirements are met, the Session ID is considered **non-identifying**, and consent is not required.

## How Sealmetrics Ensures Compliance

**How the identifier is built.** The tracker computes, in the browser, a hash of standard device characteristics — user agent, timezone, languages, screen resolution, colour depth, dark-mode and reduced-motion preferences, CPU core count and device memory — combined with the site's account ID. That hash is a **device fingerprint**: it is stable for the same browser. It is never written to the device (no cookie, no localStorage, no sessionStorage). On the server, before anything is stored, it is re-keyed with a server secret and a daily salt; the salt rotates every day and is destroyed on rotation, so the stored identifier changes daily and two days of the same device cannot be re-linked — not even by Sealmetrics. The raw hash is never stored. The live session lasts 2 hours of inactivity in server memory; the daily pseudonym is kept in the per-hit log for 1 day. See [What We Track vs What We Don't](/security-privacy/what-we-track#6-session-identifier).

Against the conditions above:

- ✔ Used exclusively for audience measurement — no marketing or profiling
- ✔ No cross-site tracking — the account ID is part of the hash, so the same browser yields different identifiers on different sites
- ✔ Nothing stored on the device — no cookies, localStorage or sessionStorage
- ✔ No persistent stored identifier — the stored value changes every day and cannot be linked across days
- ✔ No personal identification — no IP, user ID or other identifier is stored alongside it

**Fingerprinting condition — stated plainly.** The identifier is computed from device characteristics read in the browser, so Sealmetrics does not claim "no fingerprinting techniques" in absolute terms. What it does claim is that no fingerprint is stored or persists: the hash is never stored as sent, and the stored value is re-keyed daily with a salt that is then destroyed. Reading those browser properties is also an "access" to terminal equipment under Art. 5(3), so the consent exemption rests on the audience-measurement criteria described in [Analytics Cookies: Consent Exemption Requirements](/compliance/analytics-cookies-exemption), not on nothing being read.

Session IDs are used only within the active session to group hits — never to track or identify users across days.

## Summary

| Scenario | Requires Consent? | Why |
|---------|-------------------|------|
| Session ID stored in a cookie | **Yes** | Persistence = identification |
| Temporary ID without cookies | **No** | Cannot identify the user |
| Cross-site session tracking | **Yes** | Considered profiling |
| Sealmetrics session tracking | **No** (self-assessed) | Nothing stored on the device; stored identifier re-keyed daily and not linkable across days |

---

**The identifier is never stored on the device, the stored value is re-keyed every day, and it never joins hits across days — the basis of Sealmetrics' self-assessment against the audience-measurement exemption criteria.**

## Primary sources

- ePrivacy Directive 2002/58/EC — Art. 5(3): consent to store or access terminal-equipment data — [eur-lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058)
- GDPR (Regulation 2016/679) — Art. 4(1) defines personal data; Recital 26 excludes anonymous data — [eur-lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)
- EDPB Guidelines 2/2023 — technical scope of Art. 5(3): what counts as storage or access — [edpb.europa.eu](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en)
- CNIL — audience-measurement exemption, including the session-identifier conditions — [cnil.fr](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies-solutions-pour-les-outils-de-mesure-daudience)
- AEPD — Guía sobre el uso de las cookies, analytics-cookie exemption conditions — [aepd.es](https://www.aepd.es/guias/guia-cookies.pdf)

## Related documentation

- [GDPR and Cookieless Analytics](/compliance/gdpr-cookieless-analytics) — the wider GDPR case for cookieless, non-identifying measurement.
- [Does Sealmetrics comply with CNIL guidelines?](/compliance/cnil-self-assessment) — the CNIL first-party session-ID exemption in detail.
- [CNIL Self-Assessment: Sealmetrics Compliance](/compliance/cnil-self-assessment) — the session-ID condition assessed criterion by criterion.
- [Legal FAQ — Sealmetrics Compliance Questions](/compliance/compliance-overview/legal-faq) — how the Session ID and Source ID are computed and used.
- [How Attribution Works Without a User-ID](/security-privacy/attribution-without-userid) — attribution without persistent user identifiers.