# Piwik sets Cookies without consent stg\_

**URL:** <https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507>\
**Category:** Privacy\
**Created:** [January 19, 2024, 1:47pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507 "2024-01-19T13:47:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://community.piwik.pro/u/Martin)\
**Post date:** [January 19, 2024, 1:47pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/1 "2024-01-19T13:47:39Z")

</div>

Hi all,

im setting up my new Piwik Analytics. My setup is managed by Usercentrics consent manager.  
I have custom triggers and setting for a cookieless variant and when consent is given the deanonymize function comes in place. The following sites I fire the Piwik Pro Tag with pk\_id and pk\_ses active.

The code for anonymous

/\*  
var \_paq = \_paq || ;  
\_paq.push([“setUserIsAnonymous”, true]);  
\_paq.push([“disableCookies”]);  
\_paq.push([“trackPageView”]);  
\_paq.push([“enableLinkTracking”]);  
\_paq.push([“setDomains”, [“.xxxxxx”]]);  
(function() {  
var u = “[https://xxxxx.piwik.pro/](https://xxxxx.piwik.pro/)”;  
\_paq.push([“setTrackerUrl”, u + “ppms.php”]);  
\_paq.push([“setSiteId”, “xxxxxxxx”]);  
var d = document,  
g = d.createElement(“script”),  
s = d.getElementsByTagName(“script”)[0];  
g.type = “text/javascript”;  
g.async = true;  
g.defer = true;  
g.src = u + “ppms.js”;  
s.parentNode.insertBefore(g, s);  
})();

The setting runs BUT the following cookies are set by Piwik and return after deleting them :

|stg\_externalReferrer  
|stg\_last\_interaction  
|stg\_returning\_visitor  
|stg\_traffic\_source\_priority|

I even tried a different PC and browser but they still appear.

Thanks Martin

---

<div class="post-metadata">

**Author:** ![anthonybartczak](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/anthonybartczak/32/2430_2.png) [@anthonybartczak](https://community.piwik.pro/u/anthonybartczak)\
**Post date:** [January 19, 2024, 1:50pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/2 "2024-01-19T13:50:16Z")

</div>

Hi @Martin,

These cookies are optional and are added based on certain conditions used in the Tag Manager.

This article explains which conditions are responsible for setting those cookies:

> **[Cookies created for visitors by Piwik PRO | Data and cookies | Piwik PRO help...](https://help.piwik.pro/support/privacy/cookies-created-for-visitors-by-piwik-pro/)**
>
> When visitors come to your website with Piwik PRO installed, Piwik PRO will set cookies in their browser. Which cookies are created depends on the privacy settings and features you use. Although it’s possible to collect data cookie-free, the minimum...

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://community.piwik.pro/u/Martin)\
**Post date:** [January 19, 2024, 2:08pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/3 "2024-01-19T14:08:39Z")

</div>

So its

You use a multiplicity condition in a trigger and these two settings are turned off: Administration \> Sites & apps \> Privacy \> Ask visitors for consent (off) and Administration \> Sites & apps \> Privacy \> Use visitor cookies (off)

i guess.

That is absolutely not legal … if my setup says no cookies and anonymize the user … and cookies are set without me able to controll them … absolut no go.

How do i fix this?  
Consent is given by my thirdparty Usercentrics and of course a trigger often has multiple conditions.

---

<div class="post-metadata">

**Author:** ![anthonybartczak](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/anthonybartczak/32/2430_2.png) [@anthonybartczak](https://community.piwik.pro/u/anthonybartczak)\
**Post date:** [January 19, 2024, 2:18pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/4 "2024-01-19T14:18:07Z")

</div>

> [@Martin](#):
>
> and of course a trigger often has multiple conditions.

In your case only the `stg_last_interaction` is created because of using the multiplicity condition.

The multiplicity condition actually implies something else than a trigger having multiple conditions.

 ![obraz](https://europe1.discourse-cdn.com/flex005/uploads/piwikpro/original/2X/a/a29faacf751d6affb91e7832c7c30ae0debe7bb1.png)

You are also using functionalities that utilize `stg_externalReferrer`, `stg_returning_visitor`, `stg_traffic_source_priority`.

These are created if you use other trigger conditions described in the previously attached article (e.g. returning-visitor condition).

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://community.piwik.pro/u/Martin)\
**Post date:** [January 19, 2024, 2:41pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/5 "2024-01-19T14:41:09Z")

</div>

The only trigger that uses “many times during a session” - which sounds like nearly every trigger - is the all pages trigger, which is not in use.

my only settings for now are datalayer variables that listen to DL pushes from the consent manager and a click listener for shadowroot. and there is no option for multiplicity is this cases.

I really have no clue how Piwik is matching this all up.

Still, no matter what my trigger is … if my tracking code says no cookies at all … then why the hell should the tag manager set some.

---

<div class="post-metadata">

**Author:** ![anthonybartczak](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/anthonybartczak/32/2430_2.png) [@anthonybartczak](https://community.piwik.pro/u/anthonybartczak)\
**Post date:** [January 19, 2024, 2:51pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/6 "2024-01-19T14:51:10Z")

</div>

> [@Martin](#):
>
> The only trigger that uses “many times during a session” - which sounds like nearly every trigger - is the all pages trigger, which is not in use.
> 
> my only settings for now are datalayer variables that listen to DL pushes from the consent manager and a click listener for shadowroot. and there is no option for multiplicity is this cases.

You can send me your account name/URL, so I can check which tags/triggers create these cookies. Either here or in a private message.

> [@Martin](#):
>
> Still, no matter what my trigger is … if my tracking code says no cookies at all … then why the hell should the tag manager set some.

The tracking/analytics part should be treated as a separate part of the product in my opinion. You can run the tag manager without the need of tracking visitors, e.g. to display some banners or add other content to your website. Or use the consent manager without using it’s anonymizing/deanonymizing capabilities. You can also use the tracking code without using Piwik PRO Tag Manager - e.g. by embeding the code on your website or using any other tag manager. The product is pretty modular.

You can choose which functionalities (conditions in this case) you want to enable or disable and based on that either remove or add cookies to your website.

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://community.piwik.pro/u/Martin)\
**Post date:** [January 19, 2024, 2:57pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/7 "2024-01-19T14:57:11Z")

</div>

I sent you a private message. Thanks

---

<div class="post-metadata">

**Author:** ![anthonybartczak](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/anthonybartczak/32/2430_2.png) [@anthonybartczak](https://community.piwik.pro/u/anthonybartczak)\
**Post date:** [January 19, 2024, 3:24pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/8 "2024-01-19T15:24:17Z")

</div>

Try disabling this setting in the Administration module (privacy settings).

 ![obraz](https://europe1.discourse-cdn.com/flex005/uploads/piwikpro/original/2X/7/77beeb8a80eb6f89db299c7a7973f127b00fd272.png)

In general, when using a 3rd party consent manager I would advise to leave the Piwik PRO Consent Manager on, enable `Use a custom consent form` and [connect them](https://help.piwik.pro/support/privacy/how-can-i-integrate-a-third-party-cookie-consent-tool-with-piwik-pro/). This way you can still use the automatic anonymization/deanonymization mechanism which is based on the analytics consent type.

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://community.piwik.pro/u/Martin)\
**Post date:** [January 19, 2024, 3:43pm UTC](https://community.piwik.pro/t/piwik-sets-cookies-without-consent-stg/3507/9 "2024-01-19T15:43:24Z")

</div>

Thanks very much, I could solve the issue with disabling the cookie in the admin panel.  
For now my developers are packed to the roof so there is no near slot to bring the code you mentioned onto the side. but using 2 custom scripts does the charm .

Thanks