_pin_unauth Cookie: What It Is, Who Sets It, and Consent Rules

What the _pin_unauth Cookie Does on Your Site

The _pin_unauth cookie is a first-party advertising cookie that the Pinterest Tag sets on your domain to identify a visitor whom Pinterest is unable to match to a Pinterest account. The _pin_unauth cookie is "a first party cookie placed by the Pinterest tag when we are unable to match the user", according to the Pinterest Business help on tag parameters and cookies. The Pinterest Tag creates the _pin_unauth cookie on your site domain, and the cookies of the tag stay "persistent for one year from when you install the tag", according to the same help article.

The _pin_unauth cookie is the first-party twin of the _pinterest_ct_ua cookie, which Pinterest sets as a third-party cookie. The _epik cookie joins both after a visitor arrives from a Pinterest ad.

Who Sets the _pin_unauth Cookie

The Pinterest Tag sets the _pin_unauth cookie with JavaScript on your root domain, and the Pinterest Tag "creates and accesses cookies in a first-party context on your site domain", according to the Pinterest Business help. A TermsFeed check in Chrome on 17 October 2026 found the _pin_unauth cookie right after the first pintrk('page') call, with SameSite=Lax and no click on a Pinterest ad.

The _pin_unauth value is a Base64 text. Decoded, the value starts with uid=, followed by the ID of the browser.

Read how Pinterest, Inc. handles the data in the Pinterest Tag privacy policy, and sign the Pinterest Ad Data Terms before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the _pin_unauth Cookie Need Consent?

Yes, the _pin_unauth cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up the Pinterest Tag, such as the fp_cookie option and enhanced match.

The ePrivacy Directive requires consent before a site sets the _pin_unauth cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the _pin_unauth cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the _pin_unauth cookie. The CCPA treats the data the _pin_unauth cookie collects for cross-context behavioral advertising as sharing. Offer visitors a way to opt out of sale and sharing, such as a "Do Not Sell or Share My Personal Information" link or the alternative opt-out link the CCPA regulations allow. Honor Global Privacy Control (GPC) signals as opt-out requests. Sharing the data of a consumer under 16 needs opt-in consent instead: from the consumer from 13 to 15 years, and from a parent under 13.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the _pin_unauth Cookie Until Visitors Accept

Block the _pin_unauth cookie by holding back the Pinterest Tag base code until the visitor accepts advertising cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place the Pinterest Tag in the advertising category. Check whether an exemption applies to your own use of the Pinterest Tag in the consent rules for the _pin_unauth cookie.

The Pinterest Tag writes no _pin_unauth cookie while the base code waits as a tagged script, and Pinterest receives no page visit from a visitor who declines.

<script type="text/plain" data-cookie-consent="targeting">
  !function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(
    Array.prototype.slice.call(arguments))};var
    n=window.pintrk;n.queue=[],n.version="3.0";var
    t=document.createElement("script");t.async=!0,t.src=e;var
    r=document.getElementsByTagName("script")[0];r.parentNode.insertBefore(t,r)}}("https://s.pinimg.com/ct/core.js");
  pintrk('load', 'YOUR_TAG_ID');
  pintrk('page');
</script>

Block the _pin_unauth Cookie With the Pinterest Tag Consent Call

Call pintrk('setconsent', true) once the visitor accepts advertising cookies, and call pintrk('setconsent', false) when the visitor declines or withdraws consent. Pinterest sends no events for the visitor while consent is set to false, according to the Pinterest Business help on the base code. Pinterest deletes the first-party cookies and storage of the session as well.

Hold back the whole base code as well. The consent call alone still loads core.js from Pinterest for a visitor who declined.

<script type="text/plain" data-cookie-consent="targeting">
  pintrk('setconsent', true);
</script>

Stop the _pin_unauth Cookie in the Pinterest Tag Code

Add 'fp_cookie': false to the options of pintrk('load', ...) to delete the first-party cookies of the Pinterest Tag, according to the Pinterest Business help on the base code. The option fp_localStorage set to false stops the first-party local storage of the tag.

The options stop the first-party cookies only. The Pinterest Tag still sends every page visit to ct.pinterest.com, so the tag needs consent with fp_cookie set to false as well.

How to Verify That the _pin_unauth Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The _pin_unauth cookie must not appear in the list until you accept advertising cookies.

How Long the _pin_unauth Cookie Lasts

The _pin_unauth cookie lasts 1 year (365 days). Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

The cookies of the Pinterest Tag stay "persistent for one year from when you install the tag", according to the Pinterest Business help on tag parameters and cookies. A TermsFeed check in Chrome on 17 October 2026 measured an expiry of 1 year (365 days) for the _pin_unauth cookie.

Cookies That Work Together With _pin_unauth

The Pinterest Tag sets 8 other cookies next to the _pin_unauth cookie in its current setup.

Scripts and Requests of the Pinterest Tag That Come With the _pin_unauth Cookie

The catalog lists 2 scripts, pixels, and data endpoints of the Pinterest Tag, which a cookie scanner or the Network tab of Chrome DevTools shows next to the _pin_unauth cookie. Block the main script, and the requests in the table stop with the main script.

_pin_unauth Cookie FAQs

Is _pin_unauth a necessary cookie?

No, the _pin_unauth cookie is not a strictly necessary cookie. Firstly, your site works the same for a visitor who refuses the _pin_unauth cookie. Secondly, Pinterest uses the cookie to measure ads for visitors it fails to match, a purpose the ePrivacy Directive exemption does not cover. Thirdly, the Pinterest Ad Data Terms require advertisers to get consent for the cookies of the tag.

What is the difference between _pin_unauth and _pinterest_ct_ua?

The _pin_unauth cookie is a first-party cookie on your domain, and the _pinterest_ct_ua cookie is "the same as _pin_unauth, but as a third party cookie", according to the Pinterest Business help. Both cookies serve the same purpose, and only the domain differs.

Does pintrk setconsent false delete the Pinterest cookies?

Yes, pintrk('setconsent', false) deletes the first-party cookies and storage of the Pinterest Tag for the session, according to the Pinterest Business help on the base code. Firstly, Pinterest sends no events for the visitor. Secondly, the tag removes the _pin_unauth cookie and the other first-party cookies. Thirdly, the call needs the base code on the page, because the pintrk function comes from the base code.

How long does the _pin_unauth cookie last?

The _pin_unauth cookie lasts 1 year (365 days). Pinterest documents 1 year for the cookies of the tag, and Safari deletes the cookie earlier, after 7 days of Safari use without an interaction with your site.