The cookie policy shows a last-update date of July 23, 2026 (written 2026.07.23). This document does not say when that version took effect, how users are told of changes, or whether earlier versions remain relevant.
Supporting quotations
Last Update 2026.07.23.
Not stated here
No effective date, change-notice method or version history appears in this document.
Data Access & Collection · Context
What counts as a cookie in this policy
Surfshark uses the word cookies as a collective term covering cookies, pixels, web beacons and other similar technologies, so statements in this policy about cookies cover all of them. A cookie is described as a small string of data transferred to your device for identification purposes, and Surfshark says cookies help it provide, protect and improve its Services and Website.
Supporting quotations
Most sites on the internet, including Surfshark’s, use cookies, pixels, web beacons, and other similar technologies (collectively called “cookies”)
to help provide, protect, and improve our Services and Website
A cookie is a small string of data that transfers to your device for identification purposes.
Qualifications & exceptions
The collective definition is stated for this policy only.
Use & Processing · Company practice
Why Surfshark says it uses cookies
Surfshark lists several reasons for using cookies: keeping the Website working efficiently and securely, detecting and preventing fraud, remembering your preferences and recognizing you as a returning visitor, analyzing your habits to personalize content, gathering statistics on Website traffic and usage, and displaying customized advertisements more relevant to your interests.
Supporting quotations
detect and prevent fraud effectively
Cookies also enable us to remember your preferences and recognize you as a returning visitor, tailoring your browsing experience by analyzing your habits and personalizing content.
we gather statistical information on Website traffic and usage, and to display customized advertisements that are more relevant to your interests
Qualifications & exceptions
This passage gives overall reasons only; it does not say which individual cookie serves which reason (the cookie tables in section 3 and the categories in section 2 do that in part).
Not stated here
The last sentence is grammatically loose (it says Surfshark gathers statistical information and 'to display customized advertisements'); read as a statement that cookies are used for both statistics and customized advertising.
Data Access & Collection · Company practice
Necessary cookies are placed without explicit consent
Necessary cookies are described as crucial for the Website's core operations. Surfshark says they are placed on your devices automatically, with no explicit consent needed.
Supporting quotations
These cookies are crucial for the core operations of our Website, and they're automatically placed on your devices to keep things running smoothly — no explicit consent needed.
Qualifications & exceptions
The no-consent statement is made for necessary cookies only; this table does not say whether the other categories need consent.
Not stated here
The cookie table in section 3 labels cookies Essential and Functional; section 2 names Necessary, Analytic, Marketing and Affiliate, so how Essential and Functional map to these categories is not stated.
Use & Processing · Company practice
Analytic cookies track browsing behavior to improve the Website
Analytic cookies help Surfshark understand your browsing behavior: which parts of the Website you find most engaging and where you hit errors. Surfshark says it uses this to improve the Website and analyze its performance.
Supporting quotations
These cookies help us to understand your browsing behavior. They track which parts of our Website you find most engaging and flag any areas where you hit an error. They allow us to make improvements to our Website and analyze their performance.
Not stated here
This passage does not say whether analytic cookies need consent.
Data Access & Collection · Company practice
Marketing cookies track activity and are set by third parties
Marketing cookies are used to track user activity and sessions so Surfshark can deliver a more personalized service. Surfshark says they are set by third parties with whom it executes marketing campaigns and allow it to provide marketing relevant to you.
Supporting quotations
These cookies are used to track user activity and sessions so that we can deliver a more personalized service. Marketing cookies are set by third parties with whom we execute marketing campaigns and allow us to provide marketing relevant to you.
Qualifications & exceptions
The definition says marketing cookies are set by third parties.
Not stated here
The first-party cookie table in section 3 also labels some cookies set by Surfshark itself as Marketing; this definition does not explain that.
Cross-references
contrast (model-proposed): Marketing and referral parameter cookies, 30 days — contrast: Section 2 says marketing cookies are set by third parties, while the first-party table lists cookies with provenance Surfshark that carry the Marketing category. The policy does not explain how first-party cookies fit that description.
Linking & Identification · Company practice
Affiliate cookies identify referred customers for commission
Affiliate cookies let Surfshark identify customers referred to its Website by partners so it can grant the referrers their commission.
Supporting quotations
Affiliate cookies allow us to identify the customers referred to our Website by our partners so that we can grant the referrers their commission.
Data Access & Collection · Context
First-party cookies are placed by the Website itself
First-party cookies are placed directly by the Surfshark Website on your device.
Supporting quotations
These are placed directly by our Website on your device.
Sharing & Disclosure · Company practice
Third-party cookies come from services integrated into the Website
Third-party cookies are placed by other services integrated into the Website, such as analytics or advertising platforms. As an example, if you click a partner's link to reach Surfshark's site, a third-party cookie might be used to track that interaction so the partner can provide you with relevant offers.
Supporting quotations
These are placed by other services that are integrated into our Website, like analytics or advertising platforms.
if you click a partner's link to reach our site, a third-party cookie might be used to track that interaction so that the partner can provide you with relevant offers
Qualifications & exceptions
The partner-link scenario is given as an example and uses 'might'.
Retention & Deletion · Company practice
Session cookies are deleted when you close your browser
Session cookies are temporary and are deleted as soon as you close your browser.
Supporting quotations
These are temporary and are deleted as soon as you close your browser.
Retention & Deletion · Company practice
Persistent cookies stay for a set time unless you delete them
Persistent cookies stay on your device for a set amount of time, which can range from a few days to several years, and the policy says they remain unless you delete them yourself. For deleting or limiting cookies, section 4 points to the Cookie Preferences link in the Website footer and to browser configuration options, and warns that rejecting cookies may limit Website functionality and access to some features.
Supporting quotations
These stay on your device for a set amount of time, which can range from a few days to several years. They will remain there unless you delete them yourself.
How to control cookies?
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.
the majority of cookie types can be regulated or eradicated via your web browser's configuration options
when you choose to reject cookies, this choice may limit the functionality of the Website and you may lose access to some of its features
Qualifications & exceptions
Duration is stated as a range: a few days to several years.
Rejecting cookies may limit functionality or access to some features.
Not stated here
The sentence says persistent cookies remain unless you delete them but also that they last a set time; it does not say whether they expire on their own at the end of that time. Expiry periods for Surfshark's own first-party cookies are listed in section 3.
Data Access & Collection · Company practice
Cookie tables list first-party cookies and new ones may be added
Surfshark says it may occasionally test new cookies on its Website and that any permanently adopted will be added to the tables below. The first table lists the first-party cookies the Website employs, giving each cookie's expiry, provenance, purpose and category.
Supporting quotations
We may occasionally test new cookies on our Website, and any that are permanently adopted will be added to the tables below.
Our Website employs the following first-party cookies:
Cookie Expiry Provenance Purpose Category
Qualifications & exceptions
New cookies may be tested before being listed; only those permanently adopted are said to be added to the tables.
Not stated here
Cookies being tested may not appear in the tables, so the lists may not show every cookie in use at a given moment.
The table uses Essential and Functional category labels that section 2 does not define (section 2 names Necessary, Analytic, Marketing and Affiliate); whether Functional cookies need consent is not stated.
Security & Safeguards · Company practice
Authentication and encrypted session identifier cookies
Surfshark lists five first-party cookies for sessions and authentication: surfshark-uuid (1 year, maintains an encrypted session identifier, Functional), _ssli (13 months, maintains authenticated session settings, Functional), _sstk and _ssrtk (1 year each, used for authentication purposes, Essential) and _ssexp (2 hours, used for authentication purposes, Essential).
Supporting quotations
surfshark-uuid 1 year Surfshark Maintains an encrypted session identifier Functional
_sstk 1 year Surfshark Used for authentication purposes Essential
_ssrtk 1 year Surfshark Used for authentication purposes Essential
_ssexp 2 hours Surfshark Used for authentication purposes Essential
Qualifications & exceptions
Expiry, purpose and category are as listed for each cookie; the Essential and Functional labels are the table's own.
Not stated here
The table does not explain what each authentication cookie contains beyond the stated purpose.
Account & Service Control · Company practice
Cookies supporting third-party sign-in
Four first-party session cookies support third-party authentication and are labeled Essential: shark-oauth-link, shark-oauth-verify, shark-oauth-referrer and shark-oauth-skip-prompt. Each expires at the end of the session. A fifth cookie in the same family, shark-oauth-challenge, appears in the next table row.
All four are Session cookies with provenance Surfshark.
Not stated here
The table does not say which third-party sign-in providers these cookies serve.
Security & Safeguards · Company practice
Fraud prevention, consent record and cookie-enablement check
Three Essential first-party cookies cover security and consent bookkeeping: surfshark-cf-uuid (30 minutes, used to prevent fraud), surfshark-consent-state (13 months, stores cookie consent) and shark-check (session, checks cookie enablement status).
Supporting quotations
surfshark-cf-uuid 30 min Surfshark Used to prevent fraud Essential
shark-check Session Surfshark Checks cookie enablement status Essential
Qualifications & exceptions
Expiries differ: 30 minutes, 13 months and the browsing session.
Use & Processing · Company practice
Analytic cookies: session status and cross-session attributes
Two cookies are categorized Analytic: _sp_ses.{{DOMAIN HASH}} (30 minutes) is described as determining the current session authentication status, and _sp_id.{{DOMAIN HASH}} (13 months) as persisting attributes across sessions.
Supporting quotations
_sp_ses.{{DOMAIN HASH}} 30 minutes Surfshark Determines the current session authentication status Analytic
_sp_id.{{DOMAIN HASH}} 13 months Surfshark Persists attributes across sessions Analytic
Qualifications & exceptions
The cookie names contain a {{DOMAIN HASH}} placeholder as printed in the source.
Not stated here
The listed purposes (authentication status, persisting attributes) do not say which attributes are kept or exactly what analytics results; the Analytic category is the table's own label.
Linking & Identification · Company practice
Marketing and referral parameter cookies, 30 days
Six first-party cookies last 30 days. Five are categorized Marketing and store the parameter of a previous visit (sf-af, sf-ap) or the prior page URL (sf-lu, sf-la, sf-fi); sf-rf stores referral program information and is categorized Functional.
Supporting quotations
sf-af 30 days Surfshark Stores the parameter of the previous visit Marketing
sf-ap 30 days Surfshark Stores the parameter of the previous visit Marketing
sf-lu 30 days Surfshark Stores the prior page URL Marketing
sf-la 30 days Surfshark Stores the prior page URL Marketing
sf-fi 30 days Surfshark Stores the prior page URL Marketing
sf-rf 30 days Surfshark Stores referral program information Functional
Qualifications & exceptions
All six list Surfshark as provenance and a 30-day expiry.
Not stated here
Section 2 describes marketing cookies as set by third parties, but these Marketing-labeled cookies list Surfshark as provenance; the policy does not explain the difference.
The table does not say what the stored 'parameter of the previous visit' contains or whether it is shared with partners.
Data Access & Collection · Company practice
Language, coupon and promotion cookies
Three first-party cookies store site choices: surfshark-locale (29 days, selected website language, Functional), surfshark-coupon (session, the applied coupon code, Essential) and surfshark-cancel-deal (session, session data regarding applicable promotions, Functional).
Supporting quotations
surfshark-locale 29 days Surfshark Stores selected website language Functional
surfshark-coupon Session Surfshark Stores the applied coupon code Essential
surfshark-cancel-deal Session Surfshark Maintains session data regarding applicable promotions Functional
Use & Processing · Company practice
Survey, pop-up and interface-experiment cookies
Six first-party cookies record interactions with surveys, pop-ups and experiments, all labeled Functional: surfshark-on-exit-dialog-shown and surfshark-intent-survey-shown (1 year, exit and intent surveys), surfshark-purchase-survey-showed (1 year, order-related exit survey), surfshark-sticky-cta-closed (session, engagement with promotional pop-ups), surfshark-experiments (1 year, session data for interface optimization research) and surfshark-experiments-exclude (session, session segmentation for interface optimization).
Supporting quotations
surfshark-on-exit-dialog-shown 1 year Surfshark Stores interactions with exit surveys Functional
surfshark-intent-survey-shown 1 year Surfshark Stores session data related to intent surveys Functional
surfshark-purchase-survey-showed 1 year Surfshark Stores interaction data for order-related exit survey Functional
surfshark-sticky-cta-closed Session Surfshark Captures engagement data for promotional pop-ups Functional
surfshark-experiments 1 year Surfshark Maintains session data for interface optimization research Functional
surfshark-experiments-exclude Session Surfshark Manages session segmentation for interface optimization Functional
Qualifications & exceptions
Four of the six last one year; the other two are session cookies.
Not stated here
The table does not say how survey or experiment data is used beyond the stated purposes.
Use & Processing · Company practice
Notification, setup guide, upgrade screen and app-download cookies
Six Functional first-party cookies remember interface state: surfshark-hide-renewal-off-notification and surfshark-hide-renewal-not-supported-notification (30 days, engagement with auto-renewal notifications), surfshark-hide-setup-guide (1 year, setup guide interactions), surfshark-skip-upgrade (14 days, upgrade screen interactions), surfshark-app-auto-download-triggered (1 year, whether an automatic application download started) and surfshark-hide-manual-setup-startup (1 year, actions on the setup screen).
Supporting quotations
surfshark-hide-renewal-off-notification 30 days Surfshark Stores engagement status for auto-renewal notification Functional
surfshark-hide-renewal-not-supported-notification 30 days Surfshark Stores engagement status for auto-renewal notification Functional
surfshark-hide-setup-guide 1 year Surfshark Stores interactions within the setup guide Functional
surfshark-skip-upgrade 14 days Surfshark Stores interactions with upgrade screen Functional
surfshark-app-auto-download-triggered 1 year Surfshark Stores the initiation status of automatic application downloads Functional
surfshark-hide-manual-setup-startup 1 year Surfshark Stores information about actions on setup screen Functional
Qualifications & exceptions
Expiries range from 14 days to 1 year.
Use & Processing · Company practice
Onboarding and upgrade redirect cookies
Three first-party session cookies handle navigation: surfshark-product (redirects back to the product after an additional product purchase, Functional), surfshark-upgrade-initially-skipped (session redirection after an upgrade transaction, Functional) and surfshark-onboarding-task (navigation state between onboarding tasks, Essential).
Supporting quotations
surfshark-product Session Surfshark Redirects back to product after additional product purchase Functional
surfshark-onboarding-task Session Surfshark Manages navigation state between onboarding tasks Essential
surfshark-upgrade-initially-skipped Session Surfshark Manages session redirection following an upgrade transaction Functional
Qualifications & exceptions
All three expire at the end of the session.
Not stated here
Another onboarding-related cookie, surfshark-onboarding-upgrade-visited, appears in the final table row.
Charges & Financial Obligations · Company practice
Purchase, payment and order-flow cookies
Nine first-party cookies support purchases and payments, all expiring at the end of the session: surfshark-purchase-error, surfshark-teams-purchase-error, surfshark-free-trial-purchase-error and surfshark-card-purchase-error (show purchase-related errors), surfshark-payment-settings-success and surfshark-payment-settings-processing-error (payment update success and payment method update errors), surfshark-success-purchase (displays purchase history), surfshark-ref-checkout-path (purchase flow redirection after a failed payment) and surfshark-purchase-data (supports payment processing). All are labeled Essential.
The table does not say whether payment card details are stored in these cookies; third-party payment providers are listed separately in the next table.
Use & Processing · Company practice
Error and fallback-workflow cookies
Two Functional first-party session cookies handle errors: surfshark-expired-url (stores session errors to facilitate redirection to fallback workflows) and surfshark-activate-user-error (indicates errors to facilitate redirection to fallback workflows).
Supporting quotations
surfshark-expired-url Session Surfshark Stores session errors to facilitate redirection to fallback workflows Functional
surfshark-activate-user-error Session Surfshark Indicates errors to facilitate redirection to fallback workflows Functional
Qualifications & exceptions
Both are session cookies.
Use & Processing · Company practice
Support chat continuity cookie
The first-party session cookie surfshark-chat-session (Functional) maintains support chat continuity during site navigation.
Supporting quotations
surfshark-chat-session Session Surfshark Maintains support chat continuity during site navigation Functional
Qualifications & exceptions
Session cookie.
Account & Service Control · Company practice
Final first-party table rows: sign-in challenge and onboarding upgrade routing
The first-party cookie table ends with two more cookies: shark-oauth-challenge (session, supports third-party authentication, Essential), part of the same sign-in family listed earlier, and surfshark-onboarding-upgrade-visited (1 year, manages session routing following interaction with the upgrade interface, Functional).
surfshark-onboarding-upgrade-visited 1 year Surfshark Manages session routing following interaction with the upgrade interface Functional
Qualifications & exceptions
shark-oauth-challenge is a session cookie; surfshark-onboarding-upgrade-visited lasts 1 year despite its 'session routing' purpose.
Not stated here
The table does not say which third-party authentication providers are involved.
Sharing & Disclosure · Company practice
Third-party service providers Surfshark currently uses
Surfshark lists third-party service providers it currently uses, with each provider's purpose, a link to its privacy policy and how to disable it. The introduction says the providers it currently uses 'include' those listed, and the table sits under the section on specific cookies Surfshark collects.
Supporting quotations
What specific cookies Surfshark collects?
Third-party service providers we currently use include:
Service provider Purpose Privacy policy How to disable
Qualifications & exceptions
The list is introduced as 'include', which does not say it is exhaustive.
Each provider's own privacy policy is linked but not supplied in this document.
Not stated here
The table does not name the cookies each provider sets or say what personal information each receives.
The TikTok privacy-policy link points to a page whose address names the EEA, which the policy does not explain for other audiences.
Sharing & Disclosure · Company practice
Essential payment, security and platform providers cannot be turned off
Five providers are listed with purpose Essential and 'Cannot be turned off': Adyen, Apple, Cloudflare, PayPal and ProcessOut. The table does not say what Apple does for the Website.
Supporting quotations
Adyen Essential
Cannot be turned off
Apple Essential
Cannot be turned off
Cloudflare Essential
Cannot be turned off
Paypal Essential
Cannot be turned off
ProcessOut Essential
Cannot be turned off
Qualifications & exceptions
Marked 'Cannot be turned off' in the How to disable column.
Not stated here
The table gives no detail about what each Essential provider does beyond the Essential label.
Sharing & Disclosure · User right or choice
Analytics, advertising and functionality providers with an opt-out link
Five providers have an opt-out link in the How to disable column: AppsFlyer (analytics, advertising), Google (analytics, advertising, functionality), Meta (analytics, advertising), TVSquared (analytics, advertising) and Zendesk (functionality).
The opt-out is each provider's own opt-out link; Surfshark's table does not describe its steps.
Not stated here
The linked opt-out pages are not supplied in this document, so this card cannot say what each opt-out does or whether it stops all data collection or only targeted advertising.
Sharing & Disclosure · User right or choice
Providers disabled through application or browser settings
Six providers say to change your application or browser settings to disable cookies: Iterable (analytics, advertising, functionality), Microsoft (advertising), Purchasely (functionality, analytics), TikTok Information Technologies (advertising), Typeform (functionality) and OpenAI (advertising). No separate opt-out link is given for them.
Supporting quotations
Iterable Analytics, advertising, functionality
Please change your application or browser settings to disable cookies
Microsoft Advertising
Please change your application or browser settings to disable cookies
Purchasely Functionality, Analytics
Please change your application or browser settings to disable cookies
TikTok Information Technologies Advertising
Please change your application or browser settings to disable cookies
Typeform Functionality
Please change your application or browser settings to disable cookies
OpenAI Advertising
Please change your application or browser settings to disable cookies
Qualifications & exceptions
The disabling route is application or browser settings, not a provider-specific opt-out.
Not stated here
The table does not say what disabling these cookies in browser settings affects, beyond section 4's warning that rejecting cookies may limit functionality.
Account & Service Control · User right or choice
You can control cookies through the footer link and browser settings
Surfshark says you can control the cookies deployed on your devices: you may update your cookie preferences at any time through the 'Cookie Preferences' link in the Website footer, and the majority of cookie types can be regulated or eradicated through your browser's configuration options. It warns that rejecting cookies may limit the Website's functionality and you may lose access to some features.
Supporting quotations
How to control cookies?
You can control the cookies deployed on your devices.
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.
the majority of cookie types can be regulated or eradicated via your web browser's configuration options
when you choose to reject cookies, this choice may limit the functionality of the Website and you may lose access to some of its features
Qualifications & exceptions
The browser-settings route covers the majority of cookie types, not all.
Rejecting cookies may limit Website functionality and access to some features.
Not stated here
The policy does not say which cookie types cannot be controlled through the browser, though section 3 marks several providers as 'Cannot be turned off'.
Cross-references
contrast (model-proposed): Essential payment, security and platform providers cannot be turned off — contrast: Section 4 says you can control the cookies deployed on your devices, while the provider table marks several Essential providers as 'Cannot be turned off'. Section 4 limits browser control to the majority of cookie types, but does not say which ones are excluded.
Account & Service Control · Procedure
Links to browser cookie instructions
For detailed instructions on adjusting cookie preferences, Surfshark points to links for Google Chrome, Apple Safari, Microsoft Edge, Mozilla Firefox and Opera. These are links to outside support pages, not instructions in the policy itself.
Supporting quotations
For detailed instructions on adjusting cookie preferences within various commonly used browsers, please consult the following directional links:
Instructions are on the browsers' own support pages, which are not supplied in this document.
Account & Service Control · User right or choice
Opt-out pages for advertising cookies
To disable advertising cookies, Surfshark points to the Network Advertising Initiative's opt-out page, the Digital Advertising Alliance's opt-out page, and youronlinechoices.eu.
Supporting quotations
if you would like to disable advertising cookies, please learn more at
These are outside opt-out pages operated by other organizations, not controls on Surfshark's own Website.
Not stated here
The policy does not say whether using these pages affects every provider listed in the third-party table.
Legal Rights & Agreement Rules · Restriction or exception
Surfshark disclaims responsibility for external sites' cookies and data practices
Surfshark notes that its Website may contain links to external sites outside its control, which may send their own cookies, collect data or ask for personal information. It urges you to read those sites' own policies, says it does not accept responsibility or liability for third-party websites' data protection or privacy practices, and says your use of those sites is entirely your own responsibility.
Supporting quotations
our Website may contain links to external sites that may take you outside of our Website and are beyond our control
these other sites may send their own cookies to users, collect data, or solicit personal information
We do not accept any responsibility or liability for the data protection or privacy practices of third-party websites and your use of third-party websites is entirely your own responsibility.
Qualifications & exceptions
The disclaimer is about external sites reached by links, not about the third-party providers whose cookies operate within Surfshark's Website, which are listed above.
Not stated here
The policy does not say how this disclaimer applies to third-party providers integrated into the Website.
Use & Processing · Company practice
The Website does not respond to do-not-track signals
Asked whether the Website responds to do-not-track signals, Surfshark answers 'Currently, it doesn't.' It says it does not recognize automated browser signals regarding tracking mechanisms, which may include do-not-track instructions.
Supporting quotations
Does our website respond to do-not-track signals?
Currently, it doesn’t.
At this time, Surfshark does not recognize automated browser signals regarding tracking mechanisms, which may include “do-not-track” instructions.
Qualifications & exceptions
Stated as the current position ('At this time'), which may change.
The statement concerns automated browser signals; the policy offers browser cookie settings as the alternative.
Not stated here
The policy does not describe what happens to a request that carries a do-not-track signal beyond saying it is not recognized.
Account & Service Control · User right or choice
Browser settings are offered instead of do-not-track
Surfshark says you can tweak your browser settings to achieve very similar results, and can change your privacy preferences for cookies and similar technologies through your browser: accept all cookies, block certain cookies, require your consent before a cookie is placed, or block all cookies. It warns that blocking all cookies will affect your online experience and may prevent you from enjoying the full features of the Website. This matches section 4, which also offers the 'Cookie Preferences' footer link and warns that rejecting cookies may limit functionality.
Supporting quotations
You can tweak your specific browser settings to achieve very similar results.
you can change your privacy preferences regarding the use of cookies and similar technologies through your browser
You may set your browser to accept all cookies, block certain cookies, require your consent before a cookie is placed in your browser, or block all cookies.
blocking all cookies will affect your online experience and may prevent you from enjoying the full features offered by our Website
How to control cookies?
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.
Qualifications & exceptions
Blocking all cookies may degrade the experience and limit Website features.
The browser route is described as achieving 'very similar results', not the same as honoring a do-not-track signal.
Not stated here
The policy does not say in what way the results are 'very similar' to a do-not-track signal, and browser settings do not by themselves cover non-cookie technologies such as pixels and web beacons that the policy's definition of cookies includes.