This notice explains the cookies and other similar technologies associated with the Text app, LiveChat, and related widgets (the “Services”). It is intended for Clients who configure the Services, their agents, and users who interact with a Client through a widget. The Client’s configuration can affect which technologies are used. This notice should be read with the Client’s own privacy notice and Text’s Privacy Policy.
Which Service Cookies and other technologies are described here
The table below describes each Service Cookie, browser storage entry, and other technology used by the widget. The Client's configuration can affect which of them are used.
Name | Documented function | Set or used when | Domain and duration |
__lc_cid | A unique customer identifier (customer_id) generated by the Services. Used to recognize a returning visitor and restore conversation history | Set by Text's authentication server when the widget obtains a customer token | .accounts.livechatinc.com |
__lc_cst | A cryptographic token used to verify customer identity and support a secure interaction or Client SSO | Set by Text's authentication server when the widget obtains a customer token | .accounts.livechatinc.com |
__oauth_redirect_detector | A temporary technical cookie that may detect redirect loops in certain authorization flows | Set by Text during authorization flows | .accounts.livechatinc.com |
@@lc_auth_token:<org> | Customer access token | Set by Text's authentication server when the widget obtains a customer token | Local storage |
<org>:state | Widget interface state, such as message drafts, widget visibility, dismissed greetings and invitations, and mute settings | Set by Text during customer interaction with the widget | Local storage |
side_storage_<org> | Visitor data synchronized with the Services | Set by Text when the widget synchronizes visitor data | Local storage |
_livechat_has_visited | First-visit flag. Used in technical logs | Set by Text on the customer’s first visit where the widget loads | Local storage |
@@lc_privacy_policy:<org> | Records that the visitor has closed the privacy policy banner | Set by Text when the customer closes the banner in the widget | Local storage |
@@lc_tab_id:<org> | Browser tab identifier | Set by Text's authentication server when the widget obtains a customer token | Session storage |
<org>:state | Temporary data about files being uploaded | Set by Text when the customer uploads a file in the chat | Session storage |
Page context | Page URL and title, and the referrer when the widget first loads | Set by Text each time the customer moves to a new page | Runs on the Client's pages, nothing stored on the device, sent to the Services |
Page interaction signals | Signals about how the visitor interacts with the page, such as elements clicked (including the visible text of a clicked link or button) and text selected | Set by Text's authentication server when the widget obtains a customer token | Runs on the Client's pages, nothing stored on the device, sent to the Services |
Form submissions | Submitted values of predefined field types on an allowlist, such as contact details (name, email address, phone number) | Only after the customer submits a form | Runs on the Client's pages, nothing stored on the device, sent to the Services |
JavaScript API and session variables | Data the Client chooses to send to the Services, such as shopping cart contents. The Client decides what is sent and is responsible for it | Only when configured by the Client | Runs on the Client's pages nothing stored on the device sent to the Services |
Technical data | IP address, user agent, time zone, and the first-visit flag | When the widget loads and communicates with the Services | Runs on the Client's pages, nothing stored on the device, sent to the Services |
Text sets __lc_cid and __lc_cst with a lifetime of 2 years. Some browsers apply shorter limits (for example, Chrome currently caps cookies at 400 days), so the expiry date shown in the browser may differ.
All local and session storage entries are kept in the secure.livechatinc.com frame origin, not on the Client's domain.
"<org>" is the Client's organization identifier, which may include a group identifier where the Client uses groups.
These cookies help:
load and display the widget on the Client's website or application
keep chat sessions active
recognize returning customers
restore conversation history
support secure customer and teammate interactions across sessions
Are these cookies necessary for the widget to appear
The answer depends on when each cookie is set and which feature the Client has enabled. The identifiers above can support session continuity, recognition of a returning visitor, conversation history and authentication, including Client SSO. Consider them necessary for the widget to load or appear on the Client's website or application properly, and to support customer identification, secure sessions, widget functionality, and Client SSO (Single Sign-On).
They aren't used by Text for advertising, cross-site tracking, or third-party behavioral targeting. Clients should classify these cookies based on their own setup and applicable privacy laws.
If these cookies are blocked or disabled, an affected feature may fail or start again as a new session. Depending on the configuration, the visitor may need to sign in again, lose access to earlier conversation history, or be unable to continue an authenticated chat.
If these cookies are blocked, disabled, or deleted, after they have been placed, some functionality may be unavailable or behave unexpectedly. Depending on the Client’s implementation, this may include:
customers being asked to authenticate more frequently
Agent’s sessions ending unexpectedly
returning visitors not being recognized
conversation history not being restored
widgets behaving as if the visitor is new
certain security protections becoming unavailable
Clients should carefully evaluate the impact of blocking essential Service Cookies when configuring their consent mechanism.
What happens when an Agent blocks cookies
Agent-facing authentication and session technologies may be required to keep a person signed in and protect access to the Services. Blocking or deleting them may cause:
repeated sign-in requests
loss of authenticated sessions
interrupted workflows
reduced functionality of certain features
The exact impact depends on the browser configuration and the functionality being used.
Do these cookies contain personal data
The cookies themselves don't store direct personal data such as names or email addresses. However __lc_cid contains a unique identifier generated by the Services, which may be linked to a visitor, their activity within the Client’s environment, and information associated with their profile, such as contact details submitted in the chat or through forms on the Client's website. An authentication token such as __lc_cst can also relate to an identifiable person or account, even if the cookie does not contain a name or email address in readable form. Treat these values and related records as potentially personal data and protect them accordingly, based on your independent assessment and applicable legal requirements.
Who uses data associated with Service cookies
The Client may determine how its widget is deployed and why it communicates with visitors. Text processes information to provide and secure the Services under the applicable agreement. Text may also process certain Services Data for its own operational purposes as described in its Privacy Policy. The precise roles depend on the processing activity and the Client’s configuration. The Client should describe its own implementation to website visitors.
Who receives these cookies
Depending on the Client’s implementation, Service Cookies may be stored in the browser of:
visitors interacting with a Client's website or application through the widget
authenticated customers using Client SSO
Agents accessing the Services, or
other users interacting with the Services made available by the Client
The cookies used may differ depending on the functionality enabled by the Client and the way the Services are implemented.
Who processes data related to these cookies
Data related to these cookies may be processed by the Client using the Services and Text as the service provider.
Text processes this data to:
provide and secure the Services
maintain authenticated sessions
enable Client SSO
support widget functionality
maintain reliability and security of the Services
operate and adapt the widget's behavior on the Client's website
associate page interaction and form data with the visitor's profile to support the Client's communication with the visitor
Text doesn't use these cookies for advertising, third-party data sales, or cross-Client user targeting.
Are these cookies used for analytics, advertising, marketing profiling, or product improvement
__lc_cid, __lc_cst and __oauth_redirect_detector concern technical, authentication, security, and core service functionality.
They are not used to target individual end users across unrelated Clients for third-party advertising, cross-site advertising, cross-Client targeting or independent marketing profiling of end-users.
The identifier stored in __lc_cid allows the widget to recognize returning customers and continue their conversation history within a Client's environment. This is part of how the chat functions. It lets a customer pick up an existing conversation, and it is not used for analytics, profiling, or measurement purposes. Once the widget obtains a customer token, the page interaction signals and form submission data described in the table above are sent to the Services together with this identifier, so that they can be associated with the visitor's profile for the Client's use within the Services.
Do these cookies and technologies require user consent
The answer depends on the purpose of each storage or access operation and the law applicable to the visitor. In the EEA and UK, an exemption may apply to storage or access strictly necessary to transmit a communication or provide a service expressly requested by the user. The fact that a vendor calls a cookie essential, or that a particular widget implementation needs it to load, does not by itself settle that legal test. Other technologies, including optional analytics or personalization, may require prior consent.
Clients should assess the actual behavior of their configured widget, give clear information and implement any required choices before nonessential technologies operate. They should also assess the legal basis for subsequent processing of personal data.
In many jurisdictions, cookies required for authentication, security, or core service functionality may not require opt-in consent. Because the widget cannot load or appear without __lc_cid and __lc_cst, Clients should consider this when assessing whether these cookies fall within an exemption from consent under applicable law.
Each Client should independently assess its obligations applicable under laws, including, where relevant, GDPR, the ePrivacy Directive, CCPA, or other applicable local laws.
Clients are responsible for:
classifying cookies used on their websites or apps
implementing appropriate consent mechanisms
maintaining compliant Cookie Policies and Privacy Notices
What should Clients tell their visitors
A Client’s notice should identify the technologies that its deployment actually uses, the party setting or accessing them, their specific purposes, duration, category, and the choices available. It should explain any effect of declining optional technologies and link to the Client’s consent settings when relevant. The Client should verify the widget’s behavior before stating that a particular cookie is indispensable or that blocking it prevents the widget from appearing. Therefore, the Clients using the Services should disclose these cookies and the other technologies listed in the table above in their Cookie Policy or equivalent privacy documentation. Where applicable, this documentation should include:
cookie names
purposes
expiration periods
cookie categories
information about the service provider
whether the cookies are required for the provision of the Services
Clients should also make sure their disclosures accurately reflect the way they use and configure the Services within their own environment. For implementation details, see here.
How do the widget scripts collect information from the Client's website
In addition to Service Cookies, certain functionalities of the Services may use other technologies, such as local storage, session storage, browser APIs, and scripts, to support the performance, reliability, security, and functionality of the Services. These technologies may be subject to rules concerning information stored on or accessed from a device. Separately, the Services can process information that visitors voluntarily submit in a chat through the widget or through designated forms on the Client's website, such as predefined contact details, including a name, email address, or phone number, and limited technical interaction data. The field values are not themselves cookies.
These technologies may interact with designated forms and other elements on the Client's website that support the relevant functionality of the Services. They operate passively and do not modify the behavior, appearance, or functionality of the Client's website or forms. Form data is processed only after a visitor submits the relevant form. The functionality is designed to process only predefined and supported form fieldsClients should avoid collecting payment card details, passwords, one-time codes or other sensitive information through unsupported fields.
How does Client SSO work
Implementation details are available here.
Where can I learn more
For additional information, please refer to:
Cookie Policy: Information about the categories of cookies and similar technologies used by Text, their purposes, retention, and cookie preference management.
Privacy Policy: Information about how Text processes Personal Data, legal bases for processing, recipients, international data transfers, retention periods, and your privacy rights.
Client Authorization documentation: Technical implementation details regarding Client SSO and Service Cookies.