With regards to Collect Tracking Code: What are the different cookies dropped for unknown visitors?

Question

Referring to what was explained here How to track unidentified users in web and Mobile analytics on Collect Tracking Code and the cookies that are being dropped for unknown visitors.

Indeed, I can see on my client's website, 3 different cookies dropped by igodigital: igodigitalstdomain, igodigitaltc2 and igodigitalst_[MID].

From the explanation in the mentioned post, I can understand that igodigitaltc2 is the one responsible for assigning UserID and session ID. It must then be a first party cookie. But does someone have more info on the 2 others?

1. What are their role/function?
2. When are they assigned and how long do they last? (It appears to me that they disappear after a certain period of time)
3. Are they first or third party cookie?

I'd like to understand what is the implication of each cookie for GDPR purposes.

Thank you so much for your help,

Answer 1

All the three cookies are 3rd party cookies (you can verify it by seeing them being set on the igodigital.com domain). Given the recent development around 3rd party cookies getting increasingly blocked, I would expect Salesforce to be working towards a solution migrating these to 1st party cookies. However, they do still have some time, as Google has said that they don't plan to implement third-party cookie restrictions until 2022.

On naming, content and expiration, please find more details below:

1. igodigitaltc2 - this cookie contains the user's unique ID. It has an expiration of 10 years.
2. igodigitalst_[MID] ([MID] refers to the BU from which the Web Collect tracking script is executed) - this cookie contains the users unique session identifier, and expires after 1 hour.
3. igodigitalstdomain - this cookie contains a website identifier, and expires after 1 hour.

Do observe, that the unique ID is an internal guid formed ID. It will not change to the ID provided in setUserInfo call - this mapping is not reflected in any cookie.