Cookie consent across subdomains and multiple domains

A consent choice is stored in a cookie or in local storage, and where it can be read depends on how it was stored. A cookie set with Domain=example.com is readable on every subdomain (www, shop, blog), so one choice can cover all of them. A cookie set without a Domain attribute is host-only and stays on the exact host that set it, and local storage is always limited to one origin. Separate domains (example.com and example.de) can never share a cookie. Whether you should share the choice is a separate question: it makes sense when the same organization runs the subdomains for the same purposes and the banner says the choice covers them.

How does cookie scope work?

MDN's reference for the Set-Cookie header sums up the rule:

• Domain set: the cookie is available to that domain and all its subdomains. A response from shop.example.com can set Domain=example.com, and the cookie is then sent to www.example.com and blog.example.com too.
• Domain omitted: the cookie is host-only, returned only to the host that set it, not to its subdomains.
• Limits: the value must be the server's own domain or a parent of it, never a sibling (shop cannot set a cookie for blog) and never a public suffix such as com, co.uk or github.io.

Local storage, which some consent tools use as well, belongs to an origin: scheme, host and port. https://www.example.com and https://shop.example.com have separate storage, and so do http and https versions of the same host.

When does sharing make sense?

Sharing one choice across subdomains is reasonable when:

• the same company is the controller on every subdomain;
• the subdomains use the same categories and roughly the same tools;
• the banner tells visitors that the choice applies to the listed sites;
• withdrawal on one subdomain withdraws everywhere.

Asking again is better when a subdomain is run by a different company (a franchisee, a partner shop on your domain), when it uses very different trackers (a marketing-heavy shop under a quiet documentation site), or when it targets a different audience. Consent under the GDPR must be specific and informed; a choice made on docs.example.com does not inform anyone about advertising on shop.example.com if the banner never mentioned it.

How do you share consent across subdomains?

If your consent tool lets you set the cookie domain, set it to the parent domain on every subdomain, use the same configuration and categories everywhere, and make sure the banner text names the scope ("Your choice applies to example.com, shop.example.com and blog.example.com"). The numbered steps below the article walk through it.

Two technical traps:

1. Duplicate cookies. If the tool used to store a host-only cookie and now stores a domain cookie with the same name, the browser sends both. Clear the old one on deployment or rename the cookie, otherwise visitors may see a stale choice.
2. Different versions. If one subdomain runs a newer banner version with an extra category, a shared choice made under the older version does not cover the new category. Ask again for the new purposes.

What about separate domains?

Cookies cannot cross registrable domains. example.com cannot set or read a cookie for example.de or example-shop.com. Approaches that used to work, like a hidden iframe from a central domain, rely on third-party cookies, which Safari and Firefox restrict and which privacy settings often block. Two workable options:

• Ask on each domain. The simplest and most transparent. Each domain has its own banner, log and policy.
• Pass the choice in a link. When you link from one domain to another, the destination can read a parameter in the URL and store the same choice locally, if the visitor followed your own link. This is more work and must not carry identifiers that track the visitor.

For most businesses, asking once per domain is the right trade: visitors rarely move between country domains, and the consent record stays simple.

How do you test it?

Clear all site data for the parent domain, open www, choose Reject all, then open each subdomain in the same browser. With sharing, no banner should appear and the trackers should stay off. Check in the Application panel that the consent cookie has the parent domain in its Domain column. Then withdraw on one subdomain and check the others. Checking cookies before consent has the full DevTools routine.

What goes in the consent log?

Record which host the choice was made on and which hosts it covers. If you keep consent records per site, make sure a choice made on one subdomain can be traced when an authority asks about another.

How Cookiequiet handles subdomains

Cookiequiet stores the choice in a first-party cookie on the exact host, plus local storage, so each subdomain and each domain asks once, which is the conservative default. Paid plans let extra domains (www, staging, country domains) sit under one website, with one configuration and one consent log: 1 on Starter, at €3 per website per month, and up to 5 on Pro, at €9. Setup is one script tag on each host, before your other scripts; see pricing for what each plan includes.