What cookie does Zest set? I need the name for our privacy policy and security review

[zapalblizh]

Our security team wants the exact cookie name, contents, and attributes before we roll out a consent banner. Does Zest write anything besides the consent state, like telemetry or session IDs? And can our backend read the choice server-side?

[reatlat]

Zest writes exactly one cookie: zest_consent. No telemetry, no session ID. The cookie holds the choice and a timestamp, that's it.

The value is URL-encoded JSON with the decision timestamp and the four category flags:

{
  "version": "1.0",
  "timestamp": 1730000000000,
  "categories": {
    "essential": true,
    "functional": false,
    "analytics": false,
    "marketing": false
  }
}

Attributes: path=/, SameSite=Lax, Secure on HTTPS, expires from your expiration setting (default 365 days, with a Safari caveat described in the docs). Zest.reset() expires it immediately.

Yes, your backend can read it on every request, which is the reliable way to build an audit log. Zest.getConsentProof() returns the same payload from JS if you'd rather ship it to your server yourself.

Full reference: https://cookiezest.com/docs/configuration/#how-long-consent-lasts