Cookie Policy

Surfshark · Official agreement

Read the agreement

35 of 35 cards

Legal Rights & Agreement Rules · Context

Policy last updated July 23, 2026

The cookie policy shows a last-update date of July 23, 2026 (written 2026.07.23). This document does not say when that version took effect, how users are told of changes, or whether earlier versions remain relevant.

Supporting quotations

Last Update 2026.07.23.

Not stated here

  • No effective date, change-notice method or version history appears in this document.

Data Access & Collection · Context

What counts as a cookie in this policy

Surfshark uses the word cookies as a collective term covering cookies, pixels, web beacons and other similar technologies, so statements in this policy about cookies cover all of them. A cookie is described as a small string of data transferred to your device for identification purposes, and Surfshark says cookies help it provide, protect and improve its Services and Website.

Supporting quotations

Most sites on the internet, including Surfshark’s, use cookies, pixels, web beacons, and other similar technologies (collectively called “cookies”)
to help provide, protect, and improve our Services and Website
A cookie is a small string of data that transfers to your device for identification purposes.

Qualifications & exceptions

  • The collective definition is stated for this policy only.

Data Access & Collection · Company practice

Necessary cookies are placed without explicit consent

Necessary cookies are described as crucial for the Website's core operations. Surfshark says they are placed on your devices automatically, with no explicit consent needed.

Supporting quotations

These cookies are crucial for the core operations of our Website, and they're automatically placed on your devices to keep things running smoothly — no explicit consent needed.

Qualifications & exceptions

  • The no-consent statement is made for necessary cookies only; this table does not say whether the other categories need consent.

Not stated here

  • The cookie table in section 3 labels cookies Essential and Functional; section 2 names Necessary, Analytic, Marketing and Affiliate, so how Essential and Functional map to these categories is not stated.

Use & Processing · Company practice

Analytic cookies track browsing behavior to improve the Website

Analytic cookies help Surfshark understand your browsing behavior: which parts of the Website you find most engaging and where you hit errors. Surfshark says it uses this to improve the Website and analyze its performance.

Supporting quotations

These cookies help us to understand your browsing behavior. They track which parts of our Website you find most engaging and flag any areas where you hit an error. They allow us to make improvements to our Website and analyze their performance.

Not stated here

  • This passage does not say whether analytic cookies need consent.

Data Access & Collection · Company practice

Marketing cookies track activity and are set by third parties

Marketing cookies are used to track user activity and sessions so Surfshark can deliver a more personalized service. Surfshark says they are set by third parties with whom it executes marketing campaigns and allow it to provide marketing relevant to you.

Supporting quotations

These cookies are used to track user activity and sessions so that we can deliver a more personalized service. Marketing cookies are set by third parties with whom we execute marketing campaigns and allow us to provide marketing relevant to you.

Qualifications & exceptions

  • The definition says marketing cookies are set by third parties.

Not stated here

  • The first-party cookie table in section 3 also labels some cookies set by Surfshark itself as Marketing; this definition does not explain that.

Cross-references

  • contrast (model-proposed): Marketing and referral parameter cookies, 30 days — contrast: Section 2 says marketing cookies are set by third parties, while the first-party table lists cookies with provenance Surfshark that carry the Marketing category. The policy does not explain how first-party cookies fit that description.

Linking & Identification · Company practice

Affiliate cookies identify referred customers for commission

Affiliate cookies let Surfshark identify customers referred to its Website by partners so it can grant the referrers their commission.

Supporting quotations

Affiliate cookies allow us to identify the customers referred to our Website by our partners so that we can grant the referrers their commission.

Data Access & Collection · Context

First-party cookies are placed by the Website itself

First-party cookies are placed directly by the Surfshark Website on your device.

Supporting quotations

These are placed directly by our Website on your device.

Sharing & Disclosure · Company practice

Third-party cookies come from services integrated into the Website

Third-party cookies are placed by other services integrated into the Website, such as analytics or advertising platforms. As an example, if you click a partner's link to reach Surfshark's site, a third-party cookie might be used to track that interaction so the partner can provide you with relevant offers.

Supporting quotations

These are placed by other services that are integrated into our Website, like analytics or advertising platforms.
if you click a partner's link to reach our site, a third-party cookie might be used to track that interaction so that the partner can provide you with relevant offers

Qualifications & exceptions

  • The partner-link scenario is given as an example and uses 'might'.

Retention & Deletion · Company practice

Session cookies are deleted when you close your browser

Session cookies are temporary and are deleted as soon as you close your browser.

Supporting quotations

These are temporary and are deleted as soon as you close your browser.

Retention & Deletion · Company practice

Persistent cookies stay for a set time unless you delete them

Persistent cookies stay on your device for a set amount of time, which can range from a few days to several years, and the policy says they remain unless you delete them yourself. For deleting or limiting cookies, section 4 points to the Cookie Preferences link in the Website footer and to browser configuration options, and warns that rejecting cookies may limit Website functionality and access to some features.

Supporting quotations

These stay on your device for a set amount of time, which can range from a few days to several years. They will remain there unless you delete them yourself.
How to control cookies?
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.
the majority of cookie types can be regulated or eradicated via your web browser's configuration options
when you choose to reject cookies, this choice may limit the functionality of the Website and you may lose access to some of its features

Qualifications & exceptions

  • Duration is stated as a range: a few days to several years.
  • Rejecting cookies may limit functionality or access to some features.

Not stated here

  • The sentence says persistent cookies remain unless you delete them but also that they last a set time; it does not say whether they expire on their own at the end of that time. Expiry periods for Surfshark's own first-party cookies are listed in section 3.

Data Access & Collection · Company practice

Cookie tables list first-party cookies and new ones may be added

Surfshark says it may occasionally test new cookies on its Website and that any permanently adopted will be added to the tables below. The first table lists the first-party cookies the Website employs, giving each cookie's expiry, provenance, purpose and category.

Supporting quotations

We may occasionally test new cookies on our Website, and any that are permanently adopted will be added to the tables below.
Our Website employs the following first-party cookies:
Cookie Expiry Provenance Purpose Category

Qualifications & exceptions

  • New cookies may be tested before being listed; only those permanently adopted are said to be added to the tables.

Not stated here

  • Cookies being tested may not appear in the tables, so the lists may not show every cookie in use at a given moment.
  • The table uses Essential and Functional category labels that section 2 does not define (section 2 names Necessary, Analytic, Marketing and Affiliate); whether Functional cookies need consent is not stated.

Security & Safeguards · Company practice

Authentication and encrypted session identifier cookies

Surfshark lists five first-party cookies for sessions and authentication: surfshark-uuid (1 year, maintains an encrypted session identifier, Functional), _ssli (13 months, maintains authenticated session settings, Functional), _sstk and _ssrtk (1 year each, used for authentication purposes, Essential) and _ssexp (2 hours, used for authentication purposes, Essential).

Supporting quotations

surfshark-uuid 1 year Surfshark Maintains an encrypted session identifier Functional
_ssli 13 months Surfshark Maintains authenticated session settings Functional
_sstk 1 year Surfshark Used for authentication purposes Essential
_ssrtk 1 year Surfshark Used for authentication purposes Essential
_ssexp 2 hours Surfshark Used for authentication purposes Essential

Qualifications & exceptions

  • Expiry, purpose and category are as listed for each cookie; the Essential and Functional labels are the table's own.

Not stated here

  • The table does not explain what each authentication cookie contains beyond the stated purpose.

Account & Service Control · Company practice

Cookies supporting third-party sign-in

Four first-party session cookies support third-party authentication and are labeled Essential: shark-oauth-link, shark-oauth-verify, shark-oauth-referrer and shark-oauth-skip-prompt. Each expires at the end of the session. A fifth cookie in the same family, shark-oauth-challenge, appears in the next table row.

Supporting quotations

shark-oauth-link Session Surfshark Supports third-party authentication Essential
shark-oauth-verify Session Surfshark Supports third-party authentication Essential
shark-oauth-referrer Session Surfshark Supports third-party authentication Essential
shark-oauth-skip-prompt Session Surfshark Supports third-party authentication Essential

Qualifications & exceptions

  • All four are Session cookies with provenance Surfshark.

Not stated here

  • The table does not say which third-party sign-in providers these cookies serve.

Use & Processing · Company practice

Analytic cookies: session status and cross-session attributes

Two cookies are categorized Analytic: _sp_ses.{{DOMAIN HASH}} (30 minutes) is described as determining the current session authentication status, and _sp_id.{{DOMAIN HASH}} (13 months) as persisting attributes across sessions.

Supporting quotations

_sp_ses.{{DOMAIN HASH}} 30 minutes Surfshark Determines the current session authentication status Analytic
_sp_id.{{DOMAIN HASH}} 13 months Surfshark Persists attributes across sessions Analytic

Qualifications & exceptions

  • The cookie names contain a {{DOMAIN HASH}} placeholder as printed in the source.

Not stated here

  • The listed purposes (authentication status, persisting attributes) do not say which attributes are kept or exactly what analytics results; the Analytic category is the table's own label.

Linking & Identification · Company practice

Marketing and referral parameter cookies, 30 days

Six first-party cookies last 30 days. Five are categorized Marketing and store the parameter of a previous visit (sf-af, sf-ap) or the prior page URL (sf-lu, sf-la, sf-fi); sf-rf stores referral program information and is categorized Functional.

Supporting quotations

sf-af 30 days Surfshark Stores the parameter of the previous visit Marketing
sf-ap 30 days Surfshark Stores the parameter of the previous visit Marketing
sf-lu 30 days Surfshark Stores the prior page URL Marketing
sf-la 30 days Surfshark Stores the prior page URL Marketing
sf-fi 30 days Surfshark Stores the prior page URL Marketing
sf-rf 30 days Surfshark Stores referral program information Functional

Qualifications & exceptions

  • All six list Surfshark as provenance and a 30-day expiry.

Not stated here

  • Section 2 describes marketing cookies as set by third parties, but these Marketing-labeled cookies list Surfshark as provenance; the policy does not explain the difference.
  • The table does not say what the stored 'parameter of the previous visit' contains or whether it is shared with partners.

Data Access & Collection · Company practice

Language, coupon and promotion cookies

Three first-party cookies store site choices: surfshark-locale (29 days, selected website language, Functional), surfshark-coupon (session, the applied coupon code, Essential) and surfshark-cancel-deal (session, session data regarding applicable promotions, Functional).

Supporting quotations

surfshark-locale 29 days Surfshark Stores selected website language Functional
surfshark-coupon Session Surfshark Stores the applied coupon code Essential
surfshark-cancel-deal Session Surfshark Maintains session data regarding applicable promotions Functional

Use & Processing · Company practice

Survey, pop-up and interface-experiment cookies

Six first-party cookies record interactions with surveys, pop-ups and experiments, all labeled Functional: surfshark-on-exit-dialog-shown and surfshark-intent-survey-shown (1 year, exit and intent surveys), surfshark-purchase-survey-showed (1 year, order-related exit survey), surfshark-sticky-cta-closed (session, engagement with promotional pop-ups), surfshark-experiments (1 year, session data for interface optimization research) and surfshark-experiments-exclude (session, session segmentation for interface optimization).

Supporting quotations

surfshark-on-exit-dialog-shown 1 year Surfshark Stores interactions with exit surveys Functional
surfshark-intent-survey-shown 1 year Surfshark Stores session data related to intent surveys Functional
surfshark-purchase-survey-showed 1 year Surfshark Stores interaction data for order-related exit survey Functional
surfshark-sticky-cta-closed Session Surfshark Captures engagement data for promotional pop-ups Functional
surfshark-experiments 1 year Surfshark Maintains session data for interface optimization research Functional
surfshark-experiments-exclude Session Surfshark Manages session segmentation for interface optimization Functional

Qualifications & exceptions

  • Four of the six last one year; the other two are session cookies.

Not stated here

  • The table does not say how survey or experiment data is used beyond the stated purposes.

Use & Processing · Company practice

Notification, setup guide, upgrade screen and app-download cookies

Six Functional first-party cookies remember interface state: surfshark-hide-renewal-off-notification and surfshark-hide-renewal-not-supported-notification (30 days, engagement with auto-renewal notifications), surfshark-hide-setup-guide (1 year, setup guide interactions), surfshark-skip-upgrade (14 days, upgrade screen interactions), surfshark-app-auto-download-triggered (1 year, whether an automatic application download started) and surfshark-hide-manual-setup-startup (1 year, actions on the setup screen).

Supporting quotations

surfshark-hide-renewal-off-notification 30 days Surfshark Stores engagement status for auto-renewal notification Functional
surfshark-hide-renewal-not-supported-notification 30 days Surfshark Stores engagement status for auto-renewal notification Functional
surfshark-hide-setup-guide 1 year Surfshark Stores interactions within the setup guide Functional
surfshark-skip-upgrade 14 days Surfshark Stores interactions with upgrade screen Functional
surfshark-app-auto-download-triggered 1 year Surfshark Stores the initiation status of automatic application downloads Functional
surfshark-hide-manual-setup-startup 1 year Surfshark Stores information about actions on setup screen Functional

Qualifications & exceptions

  • Expiries range from 14 days to 1 year.

Use & Processing · Company practice

Onboarding and upgrade redirect cookies

Three first-party session cookies handle navigation: surfshark-product (redirects back to the product after an additional product purchase, Functional), surfshark-upgrade-initially-skipped (session redirection after an upgrade transaction, Functional) and surfshark-onboarding-task (navigation state between onboarding tasks, Essential).

Supporting quotations

surfshark-product Session Surfshark Redirects back to product after additional product purchase Functional
surfshark-onboarding-task Session Surfshark Manages navigation state between onboarding tasks Essential
surfshark-upgrade-initially-skipped Session Surfshark Manages session redirection following an upgrade transaction Functional

Qualifications & exceptions

  • All three expire at the end of the session.

Not stated here

  • Another onboarding-related cookie, surfshark-onboarding-upgrade-visited, appears in the final table row.

Charges & Financial Obligations · Company practice

Purchase, payment and order-flow cookies

Nine first-party cookies support purchases and payments, all expiring at the end of the session: surfshark-purchase-error, surfshark-teams-purchase-error, surfshark-free-trial-purchase-error and surfshark-card-purchase-error (show purchase-related errors), surfshark-payment-settings-success and surfshark-payment-settings-processing-error (payment update success and payment method update errors), surfshark-success-purchase (displays purchase history), surfshark-ref-checkout-path (purchase flow redirection after a failed payment) and surfshark-purchase-data (supports payment processing). All are labeled Essential.

Supporting quotations

surfshark-purchase-error Session Surfshark Shows purchase-related errors Essential
surfshark-teams-purchase-error Session Surfshark Shows purchase-related errors Essential
surfshark-free-trial-purchase-error Session Surfshark Shows purchase-related errors Essential
surfshark-card-purchase-error Session Surfshark Shows purchase-related errors Essential
surfshark-payment-settings-success Session Surfshark Shows payment update success status Essential
surfshark-payment-settings-processing-error Session Surfshark Shows payment method update errors status Essential
surfshark-success-purchase Session Surfshark Displays purchase history Essential
surfshark-ref-checkout-path Session Surfshark Facilitates purchase flow redirection after failed payment Essential
surfshark-purchase-data Session Surfshark Supports payment processing Essential

Qualifications & exceptions

  • All nine are session cookies labeled Essential.

Not stated here

  • The table does not say whether payment card details are stored in these cookies; third-party payment providers are listed separately in the next table.

Use & Processing · Company practice

Error and fallback-workflow cookies

Two Functional first-party session cookies handle errors: surfshark-expired-url (stores session errors to facilitate redirection to fallback workflows) and surfshark-activate-user-error (indicates errors to facilitate redirection to fallback workflows).

Supporting quotations

surfshark-expired-url Session Surfshark Stores session errors to facilitate redirection to fallback workflows Functional
surfshark-activate-user-error Session Surfshark Indicates errors to facilitate redirection to fallback workflows Functional

Qualifications & exceptions

  • Both are session cookies.

Account & Service Control · Company practice

Final first-party table rows: sign-in challenge and onboarding upgrade routing

The first-party cookie table ends with two more cookies: shark-oauth-challenge (session, supports third-party authentication, Essential), part of the same sign-in family listed earlier, and surfshark-onboarding-upgrade-visited (1 year, manages session routing following interaction with the upgrade interface, Functional).

Supporting quotations

shark-oauth-challenge Session Surfshark Supports third-party authentication Essential
surfshark-onboarding-upgrade-visited 1 year Surfshark Manages session routing following interaction with the upgrade interface Functional

Qualifications & exceptions

  • shark-oauth-challenge is a session cookie; surfshark-onboarding-upgrade-visited lasts 1 year despite its 'session routing' purpose.

Not stated here

  • The table does not say which third-party authentication providers are involved.

Sharing & Disclosure · Company practice

Third-party service providers Surfshark currently uses

Surfshark lists third-party service providers it currently uses, with each provider's purpose, a link to its privacy policy and how to disable it. The introduction says the providers it currently uses 'include' those listed, and the table sits under the section on specific cookies Surfshark collects.

Supporting quotations

What specific cookies Surfshark collects?
Third-party service providers we currently use include:
Service provider Purpose Privacy policy How to disable

Qualifications & exceptions

  • The list is introduced as 'include', which does not say it is exhaustive.
  • Each provider's own privacy policy is linked but not supplied in this document.

Not stated here

  • The table does not name the cookies each provider sets or say what personal information each receives.
  • The TikTok privacy-policy link points to a page whose address names the EEA, which the policy does not explain for other audiences.

Sharing & Disclosure · Company practice

Essential payment, security and platform providers cannot be turned off

Five providers are listed with purpose Essential and 'Cannot be turned off': Adyen, Apple, Cloudflare, PayPal and ProcessOut. The table does not say what Apple does for the Website.

Supporting quotations

Adyen Essential
Cannot be turned off
Apple Essential
Cannot be turned off
Cloudflare Essential
Cannot be turned off
Paypal Essential
Cannot be turned off
ProcessOut Essential
Cannot be turned off

Qualifications & exceptions

  • Marked 'Cannot be turned off' in the How to disable column.

Not stated here

  • The table gives no detail about what each Essential provider does beyond the Essential label.

Sharing & Disclosure · User right or choice

Analytics, advertising and functionality providers with an opt-out link

Five providers have an opt-out link in the How to disable column: AppsFlyer (analytics, advertising), Google (analytics, advertising, functionality), Meta (analytics, advertising), TVSquared (analytics, advertising) and Zendesk (functionality).

Supporting quotations

AppsFlyer Analytics, advertising
Opt-out
Google Analytics, advertising, functionality
Opt-out
Meta Analytics, advertising
Opt-out
TVSquared Analytics, advertising
Opt-out
Zendesk Functionality
Opt-out here

Qualifications & exceptions

  • The opt-out is each provider's own opt-out link; Surfshark's table does not describe its steps.

Not stated here

  • The linked opt-out pages are not supplied in this document, so this card cannot say what each opt-out does or whether it stops all data collection or only targeted advertising.

Sharing & Disclosure · User right or choice

Providers disabled through application or browser settings

Six providers say to change your application or browser settings to disable cookies: Iterable (analytics, advertising, functionality), Microsoft (advertising), Purchasely (functionality, analytics), TikTok Information Technologies (advertising), Typeform (functionality) and OpenAI (advertising). No separate opt-out link is given for them.

Supporting quotations

Iterable Analytics, advertising, functionality
Please change your application or browser settings to disable cookies
Microsoft Advertising
Please change your application or browser settings to disable cookies
Purchasely Functionality, Analytics
Please change your application or browser settings to disable cookies
TikTok Information Technologies Advertising
Please change your application or browser settings to disable cookies
Typeform Functionality
Please change your application or browser settings to disable cookies
OpenAI Advertising
Please change your application or browser settings to disable cookies

Qualifications & exceptions

  • The disabling route is application or browser settings, not a provider-specific opt-out.

Not stated here

  • The table does not say what disabling these cookies in browser settings affects, beyond section 4's warning that rejecting cookies may limit functionality.

Account & Service Control · User right or choice

You can control cookies through the footer link and browser settings

Surfshark says you can control the cookies deployed on your devices: you may update your cookie preferences at any time through the 'Cookie Preferences' link in the Website footer, and the majority of cookie types can be regulated or eradicated through your browser's configuration options. It warns that rejecting cookies may limit the Website's functionality and you may lose access to some features.

Supporting quotations

How to control cookies?
You can control the cookies deployed on your devices.
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.
the majority of cookie types can be regulated or eradicated via your web browser's configuration options
when you choose to reject cookies, this choice may limit the functionality of the Website and you may lose access to some of its features

Qualifications & exceptions

  • The browser-settings route covers the majority of cookie types, not all.
  • Rejecting cookies may limit Website functionality and access to some features.

Not stated here

  • The policy does not say which cookie types cannot be controlled through the browser, though section 3 marks several providers as 'Cannot be turned off'.

Cross-references

  • contrast (model-proposed): Essential payment, security and platform providers cannot be turned off — contrast: Section 4 says you can control the cookies deployed on your devices, while the provider table marks several Essential providers as 'Cannot be turned off'. Section 4 limits browser control to the majority of cookie types, but does not say which ones are excluded.

Account & Service Control · Procedure

Links to browser cookie instructions

For detailed instructions on adjusting cookie preferences, Surfshark points to links for Google Chrome, Apple Safari, Microsoft Edge, Mozilla Firefox and Opera. These are links to outside support pages, not instructions in the policy itself.

Supporting quotations

For detailed instructions on adjusting cookie preferences within various commonly used browsers, please consult the following directional links:
Google Chrome
Apple Safari
Microsoft Edge
Mozilla Firefox
Opera

Qualifications & exceptions

  • Instructions are on the browsers' own support pages, which are not supplied in this document.

Legal Rights & Agreement Rules · Restriction or exception

Surfshark disclaims responsibility for external sites' cookies and data practices

Surfshark notes that its Website may contain links to external sites outside its control, which may send their own cookies, collect data or ask for personal information. It urges you to read those sites' own policies, says it does not accept responsibility or liability for third-party websites' data protection or privacy practices, and says your use of those sites is entirely your own responsibility.

Supporting quotations

our Website may contain links to external sites that may take you outside of our Website and are beyond our control
these other sites may send their own cookies to users, collect data, or solicit personal information
We do not accept any responsibility or liability for the data protection or privacy practices of third-party websites and your use of third-party websites is entirely your own responsibility.

Qualifications & exceptions

  • The disclaimer is about external sites reached by links, not about the third-party providers whose cookies operate within Surfshark's Website, which are listed above.

Not stated here

  • The policy does not say how this disclaimer applies to third-party providers integrated into the Website.

Use & Processing · Company practice

The Website does not respond to do-not-track signals

Asked whether the Website responds to do-not-track signals, Surfshark answers 'Currently, it doesn't.' It says it does not recognize automated browser signals regarding tracking mechanisms, which may include do-not-track instructions.

Supporting quotations

Does our website respond to do-not-track signals?
Currently, it doesn’t.
At this time, Surfshark does not recognize automated browser signals regarding tracking mechanisms, which may include “do-not-track” instructions.

Qualifications & exceptions

  • Stated as the current position ('At this time'), which may change.
  • The statement concerns automated browser signals; the policy offers browser cookie settings as the alternative.

Not stated here

  • The policy does not describe what happens to a request that carries a do-not-track signal beyond saying it is not recognized.

Account & Service Control · User right or choice

Browser settings are offered instead of do-not-track

Surfshark says you can tweak your browser settings to achieve very similar results, and can change your privacy preferences for cookies and similar technologies through your browser: accept all cookies, block certain cookies, require your consent before a cookie is placed, or block all cookies. It warns that blocking all cookies will affect your online experience and may prevent you from enjoying the full features of the Website. This matches section 4, which also offers the 'Cookie Preferences' footer link and warns that rejecting cookies may limit functionality.

Supporting quotations

You can tweak your specific browser settings to achieve very similar results.
you can change your privacy preferences regarding the use of cookies and similar technologies through your browser
You may set your browser to accept all cookies, block certain cookies, require your consent before a cookie is placed in your browser, or block all cookies.
blocking all cookies will affect your online experience and may prevent you from enjoying the full features offered by our Website
How to control cookies?
You may update your cookie preferences at any time by selecting the 'Cookie Preferences' link in the Website footer.

Qualifications & exceptions

  • Blocking all cookies may degrade the experience and limit Website features.
  • The browser route is described as achieving 'very similar results', not the same as honoring a do-not-track signal.

Not stated here

  • The policy does not say in what way the results are 'very similar' to a do-not-track signal, and browser settings do not by themselves cover non-cookie technologies such as pixels and web beacons that the policy's definition of cookies includes.