What the agent stores, for your cookie notice
The agent runs in your pages, so what it writes is written on your site, and your cookie notice is where your visitors learn of it. This page is what to put there, what each item is for, and how to turn each off. It is not legal advice: whether a use needs consent is your counsel's call, and the references at the end are where that call usually starts.
#What it writes
| Name | Where | What it holds | How long | Off with |
|---|---|---|---|---|
_abid | A first-party cookie, SameSite=Lax, Secure over HTTPS | The receipt: the verdict of the browser's last identification, signed, which your edge and server check on its next requests | Ten minutes | sessionCookie: false: then no edge or server guard has a verdict to read |
antibot:visitor | localStorage | The visitor hint: which visitor this browser was, signed by the service, so a returning browser is compared with its own visitor first | Until the next answer replaces it; honoured for 400 days | rememberVisitor: false, which also drops one kept before |
_abvh | A cookie set by the first-party proxy alone, HttpOnly, on its identify path only | The same hint, kept where a browser keeps a script's storage only days | 400 days | rememberVisitor: false |
antibot:result | sessionStorage or localStorage, only if you choose either as cache | The last result, so get() can answer without a round trip | 30 minutes, or the cacheTtlMs you set | The default, cache: "memory", keeps it in the page alone |
__antibot_webrtc | sessionStorage | What the browser's WebRTC path reported this tab: the public addresses it was seen from, and how many candidates of each kind | The tab, five minutes at most | webrtc: false |
__antibot_rtt | sessionStorage | A round-trip timing your first-party proxy started, for the tab's next identification to carry | The tab, four minutes at most | No proxy timing, no item |
__antibot_clicks, __antibot_driven | sessionStorage | Whether the tab's last eight clicks landed dead centre on their target; whether a page was left by a browser driver's script | The tab; clicks speak for 30 minutes | — |
antibot.gpu | sessionStorage | The graphics vendors WebGPU reported, so later pages do not ask again | The tab | — |
antibot | IndexedDB | A signing key the page itself cannot export, for receipts bound to it | Until site data is cleared | Only with bindReceipt: true, off by default |
Two more are written and removed at once, to learn whether storage works at
all (private modes refuse it): __antibot in localStorage, and an IndexedDB
database antibot-probe.
Nothing is written for any site but yours: the cookies are your site's own, and the hint names a visitor of your environment alone.
#What it reads
Characteristics of the device and browser, as every device-intelligence agent
does — the browser, its version and what it supports, the screen, fonts,
graphics, audio, time zone and languages — and how the page is used: the
statistics of pointer and keystroke timing, never a key, a character or a
pointer position kept (behavioral biometrics).
Each attribute is in a result's
raw_device_attributes.
#Keeping nothing past the tab
Antibot.load({ apiKey: "pk_live_…", rememberVisitor: false, sessionCookie: false })Then the agent writes only what lives and dies with the tab. What it costs: a returning browser is recognised by its device alone, with less confidence once its rendering drifts; and with no receipt, an edge or a server guard judges its requests without the browser's verdict, as it would a client that ran no agent.
#Where consent questions usually start
- The ePrivacy Directive, Article 5(3): storing information on a device, or reading what is stored there, needs consent unless it is strictly necessary for a service the user explicitly asked for. The European Data Protection Board's Guidelines 2/2023 on its technical scope read it to cover reading a device's characteristics with a script, fingerprinting included, and not cookies alone.
- The Article 29 Working Party's Opinion 04/2012 on the cookie consent exemption treats user-centric security cookies — its example is detecting repeated failed attempts to sign in — as exempt when they serve a service the user asked for.
- The GDPR, Recital 47: processing strictly necessary to prevent fraud is a legitimate interest of the controller; Recital 49 says the same of network and information security.
So deployments commonly place the agent on the flows it protects — sign-in, sign-up, checkout, a form — as strictly necessary security, and load it elsewhere only once consent is given. For what the service does with the data it receives, you are the controller and LayerSift your processor, under the data processing agreement; how long it keeps what, and what you can have erased, is in privacy.