--- title: Visitor identity, sessions and storage slug: visitor-identity-and-storage description: How Personizely recognizes visitors: the first-party cookie and browser storage, 1-year default lifetime, sessions, Shopify consent and subdomains. docTags: createdAt: 2026-10-17T09:54:49.819Z --- Personizely recognizes a visitor by a random ID stored in a first-party cookie on your domain, together with data kept in the visitor's browser storage. A visitor is therefore one browser on one device: the same person on their phone and their laptop counts as two visitors until they're [Identifying visitors](docId\:Q2m71k4qe54obA5WmAvBT). This page explains when a visitor is new, what a session is, how long the cookie lasts, how consent on Shopify changes things, and how visitors behave across subdomains. **Available on:** all platforms. Consent handling differs on Shopify (see [Consent](docId\:pQ7hXClMZqGdoDSHsUCZ5)). ## How a visitor is recognized 1. **First page view.** If the browser has no Personizely visitor ID, the visitor is new. Personizely creates a visitor profile and stores its ID in a first-party cookie. 2. **Later page views and visits.** The snippet reads the ID from the cookie, so the visitor keeps their history, profile fields, remembered traffic-source values and campaign assignments. 3. **Every page view extends the cookie.** The cookie's expiry is renewed when the visitor views a page, so it runs for the full [lifetime](docId\:pQ7hXClMZqGdoDSHsUCZ5) after their most recent page view, not after their first visit. On Shopify, Personizely recognizes the visitor consistently with Shopify's own storefront analytics where that's available, so a visitor counted by Shopify and by Personizely is the same visitor. Logged-in Shopify customers are also identified by their customer account (see [Identifying visitors](docId\:Q2m71k4qe54obA5WmAvBT)). A visitor counts as **new** again when any of these happen: - They clear their cookies or site data, or use a private window. - They use a different browser or device. - The cookie expires because they haven't viewed a page for longer than the cookie lifetime. Opening your site in several tabs at once on a first visit doesn't create duplicate visitors. ## Sessions A **session** (also called a visit) lasts while the visitor has your site open in at least one browser tab. It ends when they close every tab of your site. Opening your site again after that starts a new session. - **There's no inactivity timeout.** A tab left open overnight is still the same session the next morning. This differs from Google Analytics, which ends a session after 30 minutes of inactivity, so session counts won't match GA. - **Tabs share the session.** A tab opened while another tab of your site is open joins the same session. - **Reloading or navigating doesn't end a session.** These features use the session: | Feature | What "session" means for it | | ---------------------------------------------------------------------------- | -------------------------------------------------- | | First visit filter, **is now** | True for every page of the visitor's first session | | Visit history filter | Counts sessions | | Page view, Goal, Event and Widget history, **During this session** | Counts only within the current session | | [Frequency rule](docId\:hmqkmmX7AxOR2P7e07VaF) rule, **for current session** | Pauses the widget until the session ends | | [Website data (ply.setData and plyData)](docId\:F8Z6F1Bhw44oDyzHQoPE_) | Lasts for the session | ## What's stored in the browser Personizely uses a **first-party cookie and browser storage** on your domain. No third-party cookies are used. | Storage | Holds | Lasts | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | First-party cookie | The visitor ID | The cookie lifetime (default 1 year), renewed on each page view | | Browser storage, persistent | A copy of the visitor's profile used for targeting and [Dynamic text (personalization variables)](docId\:EEz3US75criNjfndB--uS): remembered traffic-source values, first and last visit times, and profile fields the visitor has provided, such as email or name; campaign assignments; widget state such as frequency counters | Until the visitor clears site data | | Browser storage, session | Session ID and session events, location used by `{geo.*}` dynamic text, company data, website data | Until the session ends | For the list of cookies to declare in a consent banner or cookie policy, see [Cookies and consent](docId:-HA6dgPmpYmb7x6UZQ_t2). The visitor's full profile and history are stored on Personizely's servers against the visitor ID. Clearing the browser doesn't delete them; it only means the browser is no longer linked to that profile. To delete a visitor's data, see [GDPR and data deletion](docId\:n9IY1MR4GVbcJYNY1ZR6G). ## Cookie lifetime | Option | What it does | Values / default | | --------------------------------------------- | ----------------------------------------------------------- | ---------------------------------------------------- | | **Cookie lifetime** (**Settings → Tracking**) | How long a visitor is remembered after their last page view | 1 year (default), 2 years, 3 years, 4 years, 5 years | A longer lifetime keeps returning visitors in their A/B test arms and keeps their history for longer. Check your privacy policy and local rules before raising it: some regulators expect analytics cookies to last no more than 13 months. A change applies to cookies written from then on, which is every visitor's next page view. ## Consent - **Shopify:** Personizely follows the visitor's choice in Shopify's customer privacy settings. A visitor who declines analytics consent gets no visitor cookie. Widgets and campaigns still run, but the visitor is recognized only for the current browser session, so each new session counts as a new visitor and may be assigned a different variation. Their events are recorded without their IP address. - **Other platforms:** Personizely doesn't read your consent banner. If your policy requires consent first, load the snippet only after the visitor accepts. See [Cookies and consent](docId:-HA6dgPmpYmb7x6UZQ_t2) for details and what to declare in your cookie policy. ## Domains and subdomains - **Subdomains share the visitor.** The cookie is set on your main domain, so `example.com`, `www.example.com` and `shop.example.com` see the same visitor ID. - **Sessions and browser storage are per subdomain.** Browsers keep storage separate for each subdomain. Moving from `www.example.com` to `shop.example.com` starts a separate session there, and campaign assignments, widget frequency and website data are kept separately on each. See [How visitors are assigned to variations](docId\:sAtUYHXtt2H5eBGuGVFDv). - **Different domains are different visitors.** `example.com` and `example.co.uk` can't share a cookie, so a visitor moving between them is a new visitor on the second domain, unless they're identified there by email. - **Shopify checkout.** The visitor's campaign variations travel with the cart, so checkout and order attribution work even though checkout runs on Shopify's domain. ## Behavior details and limitations - **Cross-device recognition needs identification.** Profiles merge when the same email or phone is identified on two devices, but each browser keeps its own cookie and its own campaign assignments. - **Browser privacy features.** Some browsers limit how long cookies set by scripts can last. Safari's tracking prevention, for example, can delete them after 7 days without a visit. Those visitors may become new visitors sooner than the cookie lifetime. - **Bots aren't visitors.** The snippet doesn't run for recognized bots, so they don't get an ID or count toward your visitor quota. See [Traffic filtering and bots](docId\:MWdeRj4GbBA4xc9hEv_mn). - **No visitor ID while disabled.** With `?ply_disable=1` or while tracking is paused, the snippet doesn't run, so no cookie is written. ## Examples - **Long consideration cycles:** a furniture store with 6-week purchase cycles keeps the default 1-year lifetime, so visitors who return after a month are still in the same test arm. - **Separate blog subdomain:** a store with `blog.example.com` and `www.example.com` targets returning visitors by "First visit is now" in a **don't match** group. A reader of the blog who goes to the store counts as returning, because the visitor is shared, but starts a new session on the store. ## Troubleshooting - **The same person appears as many visitors** → they use several devices or browsers, or browse in private windows. Identification by email merges their profiles. - **Returning visitors are treated as new** → the cookie was cleared or capped by the browser, or the visitor moved to a different domain. - **Session counts are lower than in Google Analytics** → Personizely sessions have no 30-minute inactivity timeout. ## Related - [Identifying visitors](docId\:Q2m71k4qe54obA5WmAvBT) - [How targeting works](docId\:pUBcmS1M98xB8Mg8L99D_) - [How visitors are assigned to variations](docId\:sAtUYHXtt2H5eBGuGVFDv) - [Cookies and consent](docId:-HA6dgPmpYmb7x6UZQ_t2) - [Frequency rule](docId\:hmqkmmX7AxOR2P7e07VaF) - [GDPR and data deletion](docId\:n9IY1MR4GVbcJYNY1ZR6G)